Mquery Security Vulnerability

Aheckmann Mquery is a Javascript-based codebase for efficiently generating Mongdb query statements from the individual developer Aheckmann. A security vulnerability exists in mquery lib/utils.js versions prior to 3.2.3, which allows contamination attacks because a special attribute e.g. proto can...

PT-2020-17268

Name of the Vulnerable Software and Affected Versions mquery versions prior to 3.2.3 Description The issue allows a pollution attack because a special property, such as proto , can be copied during a merge or clone operation. This occurs in the lib/utils.js file. Recommendations For versions prio...

PDF Cat Split & Merge Software Exploits a dll Hijacking Vulnerability

PDF Cat Split and Merge Software is a PDF file to merge the operation of the software. PDF Cat Split & Merge Software has a dll hijacking vulnerability, which can be exploited by attackers to load a dll without signing and file verification, resulting in dll hijacking...

Prototype Pollution

Overview systeminformation is a simple system and OS information library. Affected versions of this package are vulnerable to Prototype Pollution. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands. Note: The fix for this vulnerability is...

Prototype Pollution

Overview merge is a library that allows you to merge multiple objects into one, optionally creating a new cloned object. Similar to the jQuery.extend but more flexible. Works in Node.js and the browser. Affected versions of this package are vulnerable to Prototype Pollution via recursiveMerge...

@amaspace-editor/builder (>=0.0.52, <=0.0.522), @instacart/eslint-config (0.3.0) +13 more potentially affected by CVE-2020-28499 via merge (2.1.0)

merge NPM version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on merge and may be impacted: - @amaspace-editor/builder =0.0.52, =1.4.2, =4.0.19, =1.0.21, =4.0.30, =1.0.34, =2.0.25, =3.0.17, =1.0.19, =4.0.21, =4.0.26 Source cves: CVE-2020-28499...

Prototype Pollution

controlled-merge is vulnerable to prototype pollution. Lack of validation allows an attacker to inject arbitrary properties into proto or constructor to crash the application and potentially obtain remote code execution...

CVE-2020-28268

Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution...

CVE-2020-28268

Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution...

Remote code execution

Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution...

CVE-2020-28268

Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution...

CVE-2020-28268

The CVE-2020-28268 entry concerns controlled-merge prototype pollution in versions 1.0.0–1.2.0. The root cause is a prototype pollution vulnerability that can cause a denial of service and may lead to remote code execution. Documentation in PT-2020-16958 notes the issue and provides a remediation...

CVE-2020-28268

Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution...

CVE-2020-28268: Improperly Controlled Modification of Object Prototype Attributes

Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution...

PT-2020-16958 · Unknown · Controlled-Merge

Name of the Vulnerable Software and Affected Versions: controlled-merge versions 1.0.0 through 1.2.0 Description: The issue allows an attacker to cause a denial of service and may lead to remote code execution due to a prototype pollution vulnerability. Recommendations: For versions 1.0.0 through...

Prototype Pollution

Overview asciitable.js is a Generate a ASCII Table from a bidimensional array of strings Affected versions of this package are vulnerable to Prototype Pollution via the main function. POC var a = require"asciitable.js"; var b = JSON.parse'"proto":"test":123'; a,b; console.log.test Details Prototy...

Prototype Pollution

json8-merge-patch is vulnerable to prototype pollution. Failure to sanitize the apply functions allows for injection of arbitrary properties into existing construct prototypes and modification of attributes such as proto, constructor and prototype...

CVE-2020-8268

Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...

CVE-2020-8268

Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...

CVE-2020-8268

Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...