CVE-2021-22182

An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request...

CVE-2021-22182

Removed by vendor...

CVE-2021-22182

An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request...

CVE-2021-22182

An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request...

CVE-2021-22182: Improper Neutralization of Input During Web Page Generation

An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request...

PT-2021-14893 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 13.7 and later Description: A stored XSS issue has been found in merge requests, affecting the security of the system. Recommendations: For versions 13.7 and later, update to a version that includes a fix for this issue...

GitLab 跨站脚本漏洞

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. A cross-site scripting vulnerability exists in GitLab versions after 13.7, which stems from the...

Prototype Pollution

Overview tree-kit is a Tree utilities which provides a full-featured extend and object-cloning facility, and various tools to deal with nested object structures. Affected versions of this package are vulnerable to Prototype Pollution via dotPath.set. PoC: const dotPath = require'tree-kit'...

Prototype Pollution

merge is vulnerable to prototype pollution. The function recursiveMerge allows for an injection of arbitrary properties into existing construct prototypes and modification of attributes such as proto, constructor and prototype...

CVE-2020-28499

All versions of package merge are vulnerable to Prototype Pollution via recursiveMerge...

CVE-2020-28499

All versions of package merge are vulnerable to Prototype Pollution via recursiveMerge...

Design/Logic Flaw

All versions of package merge are vulnerable to Prototype Pollution via recursiveMerge...

CVE-2020-28499

CVE-2020-28499 affects the Node.js merge package. The vulnerability is a prototype pollution weakness in the _recursiveMerge function that exists in all versions before 2.1.1. Exploitation could allow an attacker to modify object prototypes, potentially leading to arbitrary code execution or mani...

CVE-2020-28499

All versions of package merge are vulnerable to Prototype Pollution via recursiveMerge...

0726react (0.1.1), 11-builder (0.1.0) +15995 more potentially affected by CVE-2020-28499 via merge (>=1.0.0, <=2.1.0)

merge NPM version =1.0.0, =1.0.0, =0.0.1, =3.0.2, =0.1.0, =1.0.0, =0.0.1, =1.0.3, =0.1.4, =1.0.0-beta.1, =1.0.0-beta.2 - 960.css 1.0.0 and more Source cves: CVE-2020-28499 Source advisory: MEND:CVE-2020-28499...

PT-2021-11555

Name of the Vulnerable Software and Affected Versions: merge versions prior to 2.1.1 Description: The issue concerns Prototype Pollution via the recursiveMerge function. This affects the merge package, potentially allowing for malicious modifications to the prototype. Recommendations: For version...

CVE-2020-28499: Undefined Security Weakness

All versions of package merge are vulnerable to Prototype Pollution via recursiveMerge...

selinux:secilc-fuzzer: Use-of-uninitialized-value in __cil_ordered_item_insert

Project: https://github.com/SELinuxProject/selinux.git Detailed Report: https://oss-fuzz.com/testcase?key=4842594079211520 Project: selinux Fuzzing Engine: libFuzzer Fuzz Target: secilc-fuzzer Job Type: libfuzzermsanselinux Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

CVE-2021-26707

The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library...

Prototype Pollution

Overview merge-deep is a recursively merges values in a javascript object. Affected versions of this package are vulnerable to Prototype Pollution. Merge-deep actively attempts to prevent prototype pollution by blocking object property merges into proto, however it still allows for prototype...