CVE-2020-8554

Create Kubernetes cluster root@kitploit: kind create cluster --config ./kind.yaml The cluster must have certmanager: https://cert-manager.io/docs/installation/kubernetes/ Test vulnerability root@kitploit: kubectl apply -f - 'EOF' apiVersion: v1 kind: Namespace metadata: name: kubeproxy-mitm ---...

CVE-2026-87933 DaveGamble cJSON cJSON_Utils.c cJSONUtils_MergePatch use after free

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtilsMergePatch of the file cJSONUtils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to...

CVE-2026-3030-Prototype-Pollution-in-JSON-Merge-Patch

CVE-2026-3030 – Contaminación de prototipos en JSON Merge Patch Código del programa Node.js root@kitploit: // server.js - Vulnerable REST API with deep merge const express = require'express'; const app = express; app.useexpress.json; let config = role: 'user', settings: ; // Insecure deep merge...

ROOT-APP-NPM-CVE-2020-28499 CVE-2020-28499 in @rootio/merge - Patched by Root

Root has patched CVE-2020-28499 in the @rootio/merge package for Root:npm. Multiple fixed versions available...

EUVD-2021-1022

Malware in sbrugna...

CVE-2020-8268

Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...

PT-2024-3288 · Wikimedia +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions 1.39.6 and earlier, 1.40.x versions prior to 1.40.2, 1.41.x versions prior to 1.41.1 Description: An issue was discovered in WikibaseLexeme, related to inadequate access control. This issue allows an attacker to make an edi...

PT-2023-5557 · Eclipse +3 · Eclipse Jgit +3

Name of the Vulnerable Software and Affected Versions: Eclipse JGit versions prior to 6.6.1.202309021850-r Eclipse JGit versions prior to 6.7.0.202309050840-r Eclipse JGit versions 5.13.3 prior to 5.13.3.202401111512-r Description: The issue is related to the handling of symbolic links in Eclipse...

GHSA-8V9X-9XQG-R8MR Prototype pollution in json8-merge-patch

Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...

Prototype pollution in json8-merge-patch

Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...

Paul Humphreys patchmerge 安全漏洞

Paul Humphreys patchmerge is Paul Humphreys an open source application . Provides an implementation of JSON Merge Patch RFC 7396 with extensions to support merging arrays of objects . A security vulnerability exists in patchmerge versions 1.0.0 through 1.0.1 that can be exploited by an attacker t...

Prototype Pollution

json8-merge-patch is vulnerable to prototype pollution. Failure to sanitize the apply functions allows for injection of arbitrary properties into existing construct prototypes and modification of attributes such as proto, constructor and prototype...

CVE-2020-8268

Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...

CVE-2020-8268

Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...

CVE-2020-8268

Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...

CVE-2020-8268

The CVE-2020-8268 entry relates to the json8-merge-patch npm package. Affected software: json8-merge-patch prior to version 1.0.3. Root cause: the apply function fails to restrict access to object prototypes, enabling prototype pollution. Potential impact: modification of for-prototype behavior w...

CVE-2020-8268

Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...

Prototype Pollution in pierreinglebert/json-merge-patch

Description json-merge-patch is vulnerable to Prototype Pollution. This package fails to restrict access to prototypes of objects, allowing for modification of prototype behavior using a proto payload, which may result in Information Disclosure/DoS/RCE. Proof of Concept 1. Create the following Po...

Node.js third-party modules: [json8-merge-patch] Prototype Pollution

I would like to report a Prototype Pollution vulnerability in json8-merge-patch The apply function fails to restrict access to prototypes of objects, allowing for modification of prototype behavior. Module module name: json8-merge-patch version: v1.0.1 npm page:...