149 matches found
Prototype Pollution
Overview merge-deep2 is a Recursively merge values in a javascript object. Affected versions of this package are vulnerable to Prototype Pollution via the mergeDeep function. PoC // Create the following PoC file: // PoC.js var mergeDeep2 = require"merge-deep2" var obj = var maliciouspayload =...
CVE-2021-39227
ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using merge and clone helper methods in the src/core/util.ts module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports...
PT-2021-22477 · Apache · Apache Echarts
Name of the Vulnerable Software and Affected Versions: ZRender versions prior to 5.2.1 Apache ECharts versions prior to 5.2.1 Description: The issue results in prototype pollution when using merge and clone helper methods in the src/core/util.ts module. It affects Apache ECharts, which uses and...
UBUNTU-CVE-2021-39253
A crafted NTFS image can cause an out-of-bounds read in ntfsrunlistsmergei in NTFS-3G 2021.8.22...
GHSA-58G2-9FQR-36Q2 Prototype Pollution in Proto
This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function...
Prototype Pollution in Proto
This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function...
Prototype Pollution
Proto is vulnerable to prototype pollution. An attacker is able to exploit the vulnerability to inject arbitrary properties into existing construct prototypes and modify attributes such as proto, constructor and prototype via the merge function...
CVE-2021-23426
This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function...
Design/Logic Flaw
This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function...
CVE-2021-23426
This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function...
CVE-2021-23426
Proto is vulnerable to prototype pollution via the merge function across all versions. The root cause is an unsafe recursive merge (and related path-based pollution) that can inject properties into Object.prototype (proto , constructor, prototype). Potential impact includes DoS and possible remot...
CVE-2021-23426 Prototype Pollution
This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function...
CVE-2021-23426
This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function...
CVE-2021-23426: Undefined Security Weakness
This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function...
PT-2021-15514
Name of the Vulnerable Software and Affected Versions Proto affected versions not specified Description The issue allows an attacker to inject and pollute the object property of an application using Proto by leveraging the merge function. This can potentially lead to unintended behavior or securi...
Prototype Pollution
Overview Proto is an An extensible program-code-template for creating objects Affected versions of this package are vulnerable to Prototype Pollution. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function. PoC var proto = require'Proto...
Unspecified vulnerability in ts-nodash
ts-nodash is a tool that provides object manipulation. A security vulnerability exists in ts-nodash that stems from a lack of validated input, and all versions of package -nodash are vulnerable to prototype contamination via the Merge function. No detailed vulnerability details are provided at th...
CVE-2021-23403
All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge function due to lack of validation input...