Cryptocurrency Stealer Malware Distributed via 13 NuGet Packages

Cybersecurity researchers have detailed the inner workings of the cryptocurrency stealer malware that was distributed via 13 malicious NuGet packages as part of a supply chain attack targeting .NET developers. The sophisticated typosquatting campaign, which was uncovered by JFrog late last month,...

Prototype Pollution

Overview mathjs before version 7.5.1 is vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates. Recommendation Upgrade to version 7.5.1 or later References - CVE - GitHub Advisory...

Prototype Pollution in mathjs

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates...

@baic/yolk (>=1.0.0-alpha.2, <=1.0.0-alpha.43), @baic/yolk-miniapp (>=1.0.0-alpha.1, <=1.0.0-alpha.43) +4 more potentially affected by CVE-2020-7743 via mathjs (>=7.1.0, <=7.5.0)

mathjs NPM version =7.1.0, =1.0.0-alpha.2, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.3, =2.0.12, =2.2.25 Source cves: CVE-2020-7743 Source advisory: GHSA-X2FC-MXCX-W4MF...

@baic/yolk (>=1.0.0-alpha.2, <=1.0.0-alpha.43), @baic/yolk-miniapp (>=1.0.0-alpha.1, <=1.0.0-alpha.43) +4 more potentially affected by CVE-2020-7743 via mathjs (>=7.1.0, <=7.5.0)

mathjs NPM version =7.1.0, =1.0.0-alpha.2, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.3, =2.0.12, =2.2.25 Source cves: CVE-2020-7743 Source advisory: OSV:GHSA-X2FC-MXCX-W4MF...

GHSA-X2FC-MXCX-W4MF Prototype Pollution in mathjs

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates...

Prototype Pollution

mathjs is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

CVE-2020-7743

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates...

CVE-2020-7743

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates...

CVE-2020-7743

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates...

Default configuration

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates...

CVE-2020-7743

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates...

CVE-2020-7743 Prototype Pollution

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates...

2d-transformation-solver (>=0.1.1, <=0.2.0), 2diminterpulator (1.0.0) +1066 more potentially affected by CVE-2020-7743 via mathjs (>=0.9.1, <=7.5.0)

mathjs NPM version =0.9.1, =0.1.1, =1.0.0-rc.1, =0.0.1, =0.9.0, =1.0.0, =1.2.0, =1.2.0, =1.0.0, =0.0.1-beta, =0.0.1-beta, =0.0.1-beta, =0.0.0, =0.1.2 and more Source cves: CVE-2020-7743 Source advisory: MEND:CVE-2020-7743...

CVE-2020-7743

The vulnerability described in CVE-2020-7743 affects the mathjs package prior to version 7.5.1, enabling Prototype Pollution via the deepExtend function during configuration updates. This is a general software vulnerability in mathjs, with no explicit exploit details provided in the connected doc...

CVE-2020-7743

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates...

CVE-2020-7743: Improperly Controlled Modification of Object Prototype Attributes

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates...

PT-2020-19760

Name of the Vulnerable Software and Affected Versions mathjs versions prior to 7.5.1 Description The issue concerns Prototype Pollution via the deepExtend function, which is triggered by configuration updates. This function is part of the mathjs package. Recommendations For versions prior to 7.5....

Prototype Pollution

Overview mathjs is a math library for JavaScript and Node.js. It features a flexible expression parser with support for symbolic computation, comes with a large set of built-in functions and constants, and offers an integrated solution to work with diff. Affected versions of this package are...

@baic/yolk (>=1.0.0-alpha.2, <=1.0.0-alpha.43), @baic/yolk-miniapp (>=1.0.0-alpha.1, <=1.0.0-alpha.43) +4 more potentially affected by CVE-2020-7743 via mathjs (>=7.1.0, <=7.5.0)

mathjs NPM version =7.1.0, =1.0.0-alpha.2, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.3, =2.0.12, =2.2.25 Source cves: CVE-2020-7743 Source advisory: SNYK:JS-MATHJS-1016401...