4052 matches found
Prototype Pollution in extend2
The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge...
CVE-2021-23568
The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge...
CVE-2021-23568
The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge...
Code injection
The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge...
CVE-2021-23568
CVE-2021-23568 affects the JavaScript package extend2 (versions before 1.0.1). The vulnerability is a Prototype Pollution in the extend function caused by unsafe recursive merge, enabling an attacker to inject properties (such as proto ) into Object.prototype, potentially leading to DoS or remote...
CVE-2021-23568
The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge...
CVE-2021-23568: Improperly Controlled Modification of Object Prototype Attributes
The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge...
PT-2022-9415
Name of the Vulnerable Software and Affected Versions extend2 versions prior to 1.0.1 Description The issue concerns Prototype Pollution via the extend function due to an unsafe recursive merge. This allows for potential manipulation of the prototype, which can lead to various security issues...
Use After Free in tremor-script
An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A merge operation may result in a use-after-free...
Prototype Pollution
Overview dset is an A tiny 161B utility for safely writing deep Object values! Affected versions of this package are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains proto, constructor or...
NFT token id repeated
Handle MaCree Vulnerability details Impact 1. merge funtion may lead to create repeated NFT token id, so user can not lock XDEFI Proof of Concept run the test case below please beforeEachasync = god, account1, account2, account3 = await ethers.getSigners; XDEFI = await await await...
merge() can cause lock to fail due to tokenId collision
Handle WatchPug Vulnerability details function generateNewTokenIduint256 points internal view returns uint256 tokenId // Points is capped at 128 bits max supply of XDEFI for 10 years locked, total supply of NFTs is capped at 128 bits. return points PoC 1. Alice lock 1 XDEFI for 7 days 3 times got...
DOS - preventing users from locking assets
Handle egjlmn1 Vulnerability details An attacker can prevent any user from locking assets due to the unsafe id generation for the nfts. The id is generated by using only the amount deposited, the duration to lock and the totalSiupply of nfts. The first two are easy for the attacker to copy, so al...
Missing noreentrant modifier on merge() and updateDistribution(), can reenter from the _lock()
Handle Fitraldys Vulnerability details Impact A user can call lock that will call lock, that eventually will call safeMint, the safeMint function will make an external call to the destination address through checkOnERC721Received, and since the merge and updateDistribution didnt have noreentrant...
merge is loss of all assets
Handle danb Vulnerability details merge function mints nft, but doesn't add it to positionOf, which makes it worthless, in addition it burns all the nfts of the user which means they lost all assets. --- The text was updated successfully, but these errors were encountered: All reactions...
_safeMint Will Fail Due To An Edge Case In Calculating tokenId Using The _generateNewTokenId Function
Handle leastwood Vulnerability details Impact NFTs are used to represent unique positions referenced by the generated tokenId. The tokenId value contains the position's score in the upper 128 bits and the index wrt. the token supply in the lower 128 bits. When positions are unlocked after expirin...
CVE-2021-45702
An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A merge operation may result in a use-after-free...
CVE-2021-45702
An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A merge operation may result in a use-after-free...