4053 matches found
GHSA-7QQQ-GH2F-WQ76 ts-deepmerge before 2.0.2 vulnerable to Prototype Pollution
The package ts-deepmerge before version 2.0.2 is vulnerable to Prototype Pollution due to missing sanitization of the merge function...
CVE-2022-25907
The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function...
CVE-2022-25907
The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function...
PT-2022-17598 · Unknown · Ts-Deepmerge
Name of the Vulnerable Software and Affected Versions: ts-deepmerge versions prior to 2.0.2 Description: The issue is related to Prototype Pollution due to missing sanitization of the merge function. This allows for potential manipulation of the prototype, leading to various security issues...
deepmerge-ts 安全漏洞
deepmerge-ts is an npm package. It is used to deep merge 2 or more objects with respect to type information. A security vulnerability exists in versions of deepmerge-ts prior to 2.0.2, which stems from the lack of handling of merge functions and is susceptible to prototype contamination...
CVE-2022-25907: Improperly Controlled Modification of Object Prototype Attributes
The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function...
selfdestruct will be banned after "The Purge" phase of ethereum merge. DepositReceiver may be broken. Any interaction between AxelarDepositService may result in the loss of fund.
Lines of code Vulnerability details Impact selfdestruct will be banned after "The Purge" phase of ethereum merge. DepositReceiver may be broken. Any interaction between AxelarDepositService may result in the loss of fund. Since AxelarDepositService that deal with native token is highly associated...
libvirt libvirt-python security update
libvirt 5.7.0-34.el7 - qemu: blockcopy: Allow late opening of the backing chain of a shallow copy Peter Krempa Orabug: 33091019 - qemu: capabilities: Introduce QEMUCAPSBLOCKDEVSNAPSHOTALLOWWRITEONLY Peter Krempa Orabug: 33091019 - qemuDomainBlockCopyCommon: Record updated flags to block job Peter...
org.jenkins-ci.plugins:assembla-merge-request-builder (>=1.1.1, <=1.1.13), org.jenkins-ci.plugins:bitbucket-pullrequest-builder (>=1.4.6, <=1.4.28) +2 more potentially affected by CVE-2022-36883 via org.jenkins-ci.plugins:git (2.2.4)
org.jenkins-ci.plugins:git MAVEN version 2.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:assembla-merge-request-builder =1.1.1, =1.4.6, =1.13-1, =1.1.1, =1.4.2 Source cves:...
org.jenkins-ci.plugins:assembla-merge-request-builder (>=1.1.1, <=1.1.13), org.jenkins-ci.plugins:bitbucket-pullrequest-builder (>=1.4.6, <=1.4.28) +2 more potentially affected by CVE-2022-36884 via org.jenkins-ci.plugins:git (2.2.4)
org.jenkins-ci.plugins:git MAVEN version 2.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:assembla-merge-request-builder =1.1.1, =1.4.6, =1.13-1, =1.1.1, =1.4.2 Source cves:...
Prototype Pollution
ianwalter/merge is vulnerable to prototype pollution. The vulnerability exist in the merge function in merge.js which allows remote attackers to inject malicious payloads...
@generates/cli (>=0.0.2, <=0.0.7), @generates/core (>=0.0.2, <=0.0.7) +19 more potentially affected by CVE-2021-23397 via @ianwalter/merge (9.0.1)
@ianwalter/merge NPM version 9.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @ianwalter/merge and may be impacted: - @generates/cli =0.0.2, =0.0.2, =0.0.40, =0.0.2, =0.0.2, =0.0.0, =9.10.0, =3.0.0, =5.0.0, =0.1.0, =0.0.1, =1.0.0, =0.0.2, =1.2.0 a...
GHSA-42M6-G935-5VMQ @ianwalter/merge Prototype Pollution via `merge` function
All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main merge function. @ianwalter/merge is deprecated and the maintainer suggests using @generates/merger instead...
Prototype Pollution
Overview ts-deepmerge is an a deep merge function that automatically infers the return type based on your input, without mutating the source objects. Affected versions of this package are vulnerable to Prototype Pollution due to missing sanitization of the merge function. PoC: js var tsDeepmerge ...
CVE-2021-23397
All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main merge function. Maintainer suggests using @generates/merger instead...
CVE-2021-23397
All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main merge function. Maintainer suggests using @generates/merger instead...
Information disclosure
All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main merge function. Maintainer suggests using @generates/merger instead...
CVE-2021-23397 Prototype Pollution
All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main merge function. Maintainer suggests using @generates/merger instead...
CVE-2021-23397
CVE-2021-23397 affects all versions of @ianwalter/merge and enables Prototype Pollution via the main merge function. Root cause: unsafe recursive merge can copy a proto property from a polluted source, enabling prototype contamination and potential remote code execution or DoS, as described in co...