Prototype Pollution

Overview com.graphhopper:graphhopper-web-bundle is a GraphHopper routing engine as a web-service Affected versions of this package are vulnerable to Prototype Pollution. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or proto payload. P...

Vdisks Are Not Deleted From VDisk Store after Being Deleted From PVS Console

After doing a merge, deleting vdisk versions on PVS console does not delete them from vdisk store, no errors are seen on PVS console. After deleting the versions, if we check store using File Explorer, we still see the vdisk versions present...

Security update for fossil (moderate)

openSUSE Security Update: Security update for fossil Announcement ID: openSUSE-SU-2021:1052-1 Rating: moderate References: 1187988 Affected Products: openSUSE Backports SLE-15-SP1 An update that contains security fixes can now be installed. Description: This update for fossil fixes the following...

CVE-2021-25953

Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution...

CVE-2021-25953

Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution...

CVE-2021-25953

Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution...

Remote code execution

Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution...

CVE-2021-25953

Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution...

CVE-2021-25953

Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution...

CVE-2021-25953

Summary: CVE-2021-25953 affects the JavaScript utility library putil-merge . Affected versions are 1.0.0 through 3.6.6 . Root cause: prototype pollution in the merge logic of putil-merge, enabling property contamination of built-in prototypes. Impact (as stated): denial of service and potential r...

GitLab: Stored-XSS in merge requests

Summary As an attacker I could do XSS on Web.com because it is vulnerable Stored XSS, also known as persistent XSS, is more damaging than non-persistent XSS. It occurs when a malicious script is injected directly into a vulnerable web application. Steps to reproduce 1. Go to https://gitlab.com/ 2...

putil-merge 安全漏洞

putil-merge is an open source solution for merging two or more objects. It supports deep merging, cloning attributes, copying descriptors and filtering. A security vulnerability exists in putil-merge, which stems from a prototype contamination vulnerability in "putil-merge" versions 1.0.0 through...

PT-2021-16879 · Unknown · Putil-Merge

Name of the Vulnerable Software and Affected Versions: putil-merge versions 1.0.0 through 3.6.6 Description: The issue allows an attacker to cause a denial of service and may lead to remote code execution due to a prototype pollution vulnerability. Recommendations: For versions 1.0.0 through 3.6....

CVE-2021-25953: Improperly Controlled Modification of Object Prototype Attributes

Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution...

Prototype Pollution

Overview Proto is an An extensible program-code-template for creating objects Affected versions of this package are vulnerable to Prototype Pollution. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function. PoC var proto = require'Proto...

UBUNTU-CVE-2021-22230

Improper code rendering while rendering merge requests could be exploited to submit malicious code. This vulnerability affects GitLab CE/EE 9.3 and later through 13.11.6, 13.12.6, and 14.0.2...

CVE-2021-22230

Improper code rendering while rendering merge requests could be exploited to submit malicious code. This vulnerability affects GitLab CE/EE 9.3 and later through 13.11.6, 13.12.6, and 14.0.2...

CVE-2021-22230

Improper code rendering while rendering merge requests could be exploited to submit malicious code. This vulnerability affects GitLab CE/EE 9.3 and later through 13.11.6, 13.12.6, and 14.0.2...

CVE-2021-22230

Improper code rendering while rendering merge requests could be exploited to submit malicious code. This vulnerability affects GitLab CE/EE 9.3 and later through 13.11.6, 13.12.6, and 14.0.2...

CVE-2021-22230

CVE-2021-22230 affects GitLab CE/EE from v9.3 through v14.0.2, with the underlying issue: improper code rendering during merge-request rendering that enables submitting malicious code. The connected sources confirm this affects GitLab releases in the 13.x series (notably 13.11.6 and 13.12.6) and ...