CVE-2020-28500

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service ReDoS via the toNumber, trim and trimEnd functions...

CVE-2020-28500 Regular Expression Denial of Service (ReDoS)

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service ReDoS via the toNumber, trim and trimEnd functions...

CVE-2020-28500

CVE-2020-28500 affects Lodash prior to 4.17.21, vulnerability is Regular Expression Denial of Service (ReDoS) via toNumber, trim and trimEnd. Connected IBM bulletin confirms the issue and enumerates the affected versions; the remediation is to upgrade Lodash to 4.17.21 or later. No exploitation d...

PT-2021-3189

Name of the Vulnerable Software and Affected Versions lodash versions prior to 4.17.21 Description The issue is related to the toNumber, trim, and trimEnd functions in the lodash library, which can lead to an uncontrolled consumption of resources, potentially causing a denial of service. This can...

lodash Security Vulnerabilities

lodash is an open source JavaScript utility library. A security vulnerability exists in lodash that stems from vulnerability to Regular Expression Denial of Service ReDoS attacks...

CVE-2020-28500: Undefined Security Weakness

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service ReDoS via the toNumber, trim and trimEnd functions...

lodash code injection vulnerability

lodash is an open source JavaScript utility library. A code injection vulnerability exists in lodash, which arises from a network system or product that does not properly filter specific elements of externally entered data during the construction of executable commands. An attacker could exploit...

PT-2021-3188

Name of the Vulnerable Software and Affected Versions Lodash versions prior to 4.17.21 Description The issue is related to Command Injection via the template function, which can be exploited by a remote attacker to execute arbitrary commands. This is due to the lack of neutralization of special...

CVE-2021-23337: Improper Control of Generation of Code

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function...

RHEL 8 : Red Hat Virtualization (RHSA-2020:5611)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5611 advisory. The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host,...

Important: Red Hat Security Advisory: Red Hat Virtualization security, bug fix, and enhancement update

An update for cockpit-ovirt, redhat-release-virtualization-host, redhat-virtualization-host, and v2v-conversion-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

nodejs-lodash: prototype pollution in zipObjectDeep function

A flaw was found in nodejs-lodash in versions 4.17.15 and earlier. A prototype pollution attack is possible which can lead to arbitrary code execution. The primary threat from this vulnerability is to data integrity and system availability...

Security Bulletin: A vulnerability in JavaScript affects IBM License Metric Tool v9 (CVE-2020-8203).

Summary There is a vulnerability in JavaScript library Lodash that is used by IBM License Metric Tool. Vulnerability Details CVEID: CVE-2020-8203 DESCRIPTION: Node.js lodash module is vulnerable to a denial of service, caused by a prototype pollution attack. A remote attacker could exploit this...

Security Bulletin: A security vulnerability in Node.js lodash module affects IBM Cloud Pak for Multicloud Management Infrastructure Management.

Summary Security Bulletin: A security vulnerability in Node.js lodash module affects IBM Cloud Pak for Multicloud Management Infrastructure Management. Vulnerability Details Third Party Entry: 183560 DESCRIPTION: Node.js lodash module denial of service CVSS Base score: 7.5 CVSS Temporal Score: Se...

Security Bulletin: Potential vulnerability with Node.js lodash module

Summary A potential vulnerability has been identified related to Node.js lodash module. Refer to details for additional information. Vulnerability Details Third Party Entry: 183560 DESCRIPTION: Node.js lodash module denial of service CVSS Base score: 7.5 CVSS Temporal Score: See:...

Security Bulletin: Node.js module upgrade for IBM Cloud Pak for Data Streams Flows

Summary A Node.js module has released an update that addresses a security issue. It is recommended to upgrade the module. Vulnerability Details Third Party Entry: 183560 DESCRIPTION: Node.js lodash module denial of service CVSS Base score: 7.5 CVSS Temporal Score: See:...

nodejs-lodash: prototype pollution in zipObjectDeep function

A flaw was found in nodejs-lodash in versions 4.17.15 and earlier. A prototype pollution attack is possible which can lead to arbitrary code execution. The primary threat from this vulnerability is to data integrity and system availability...

Low: Red Hat Security Advisory: Red Hat Virtualization security, bug fix, and enhancement update

An update is now available for Red Hat Virtualization Engine 4.4. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link...

RHEL 8 : Red Hat Virtualization (RHSA-2020:5179)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5179 advisory. The org.ovirt.engine-root is a core component of oVirt. The following packages have been upgraded to a later upstream version: engine-db-que...

Code Injection

Overview lodash is a modern JavaScript utility library delivering modularity, performance, & extras. Affected versions of this package are vulnerable to Code Injection due the improper validation of options.variable key names in .template. An attacker can execute arbitrary code at template...