836 matches found
GHSA-2M96-9W4J-WGV7 Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object via proto causing the addition or modification of an existing property that will exist on all objects. Recommendation Update to version...
GHSA-H726-X36V-RX45 Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via constructor: prototype: ... causing the addition or modification of an existing property that will exist on all objects. Recommendation...
PT-2020-21333
Name of the Vulnerable Software and Affected Versions lodash.merge versions prior to 4.6.2 Description The issue allows a malicious user to modify the prototype of Object via constructor: prototype: ... using the merge function, potentially causing the addition or modification of an existing...
PT-2020-21121
Name of the Vulnerable Software and Affected Versions lodash.mergewith versions prior to 4.6.2 Description The issue allows a malicious user to modify the prototype of Object via constructor: prototype: ... using the mergeWith function, potentially causing the addition or modification of an...
nodejs-lodash: prototype pollution in zipObjectDeep function
A flaw was found in nodejs-lodash in versions 4.17.15 and earlier. A prototype pollution attack is possible which can lead to arbitrary code execution. The primary threat from this vulnerability is to data integrity and system availability...
Security Bulletin: WML CE: TensorBoard: Node.js lodash module is vulnerable to a denial of service, caused by a prototype pollution attack.
Summary Node.js lodash module is vulnerable to a denial of service, caused by a prototype pollution attack. TensorBoard uses lodash. A remote attacker could exploit this vulnerability using the merge, mergeWith, and defaultsDeep functions to inject properties onto Object.prototype to crash the...
CVE-2020-8203
A flaw was found in nodejs-lodash in versions 4.17.15 and earlier. A prototype pollution attack is possible which can lead to arbitrary code execution. The primary threat from this vulnerability is to data integrity and system availability...
0.workspace (>=0.1.0, <=0.1.1), 00ld8nuivn (2.1.0) +60308 more potentially affected by CVE-2020-8203 via lodash (>=3.7.0, <=4.17.18)
lodash NPM version =3.7.0, =0.1.0, =1.0.0, =1.1.0 - 02rjq8i863 1.1.0 - 02vx8qsp01 2.1.0 - 05y6tjgmws 1.1.0 - 066m7q8o0z 2.1.0 - 06buj9h3su 2.1.0 - 06dre15t8r 2.1.0 - 07fgapmu9l 1.1.0 - 07t2xvu6t4 2.1.0 - 0850u4lkpu 1.1.0 - 08cms 1.0.0 and more Source cves: CVE-2020-8203 Source advisory:...
@braneframe/plugin-github (>=0.1.53-main.2922731, <=0.6.7), @dxos/plugin-github (>=0.6.8-main.046e6cf, <=0.7.4) +27 more potentially affected by CVE-2020-8203 via lodash.update (4.10.2)
lodash.update NPM version 4.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on lodash.update and may be impacted: - @braneframe/plugin-github =0.1.53-main.2922731, =0.6.8-main.046e6cf, =0.2.19, =0.0.1, =5.5.0, =8.4.2, =22.1.0-pre.1, =5.2.0, =4.0.0,...
@across-ui/example (>=0.0.1-alpha.4, <=0.0.4-alpha.5), @admui/grid (>=0.1.10, <=0.3.1) +807 more potentially affected by CVE-2020-8203 via lodash-es (>=3.10.1, <=4.17.15)
lodash-es NPM version =3.10.1, =0.0.1-alpha.4, =0.1.10, =0.0.1, =0.0.2, =3.2.1, =3.2.1, =3.2.1, =0.0.1, =3.2.1, =3.2.1, =0.3.14, =0.4.63, =0.4.64 and more Source cves: CVE-2020-8203 Source advisory: OSV:GHSA-P6MC-M468-83GW...
Prototype Pollution in lodash
Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions pick, set, setWith, update, updateWith, and zipObjectDeep allow a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires...
GHSA-P6MC-M468-83GW Prototype Pollution in lodash
Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions pick, set, setWith, update, updateWith, and zipObjectDeep allow a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires...
DEBIAN-CVE-2020-8203
Prototype pollution attack when using .zipObjectDeep in lodash before 4.17.20...
CVE-2020-8203
Prototype pollution attack when using .zipObjectDeep in lodash before 4.17.20...
AZL-44964 CVE-2020-8203 affecting package js-jquery 3.5.0-4
Prototype pollution attack when using .zipObjectDeep in lodash before 4.17.20...
UBUNTU-CVE-2020-8203
Prototype pollution attack when using .zipObjectDeep in lodash before 4.17.20...
CVE-2020-8203
Prototype pollution attack when using .zipObjectDeep in lodash before 4.17.20...
CVE-2020-8203
Prototype pollution attack when using .zipObjectDeep in lodash before 4.17.20...
