CVE-2020-8268

Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...

CVE-2020-8268

Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...

CVE-2020-8268

The CVE-2020-8268 entry relates to the json8-merge-patch npm package. Affected software: json8-merge-patch prior to version 1.0.3. Root cause: the apply function fails to restrict access to object prototypes, enabling prototype pollution. Potential impact: modification of for-prototype behavior w...

PT-2020-20072

Name of the Vulnerable Software and Affected Versions json8-merge-patch versions prior to 1.0.3 Description The issue allows attackers to inject or modify methods and properties of the global object constructor due to a prototype pollution vulnerability in the json8-merge-patch npm package...

CVE-2020-8268: Modification of Assumed-Immutable Data (MAID)

Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...

UBUNTU-CVE-2020-7746

This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options or the defaults options are deeply merged with provided options. However, during this operation, the keys of the object being...

CVE-2020-7746

This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options or the defaults options are deeply merged with provided options. However, during this operation, the keys of the object being...

OS Command Injection

pdf-merge is vulnerable to remote code execution. An attacker is able to inject and execute arbitrary OS commands via the execOptions parameter...

Prototype Pollution

Overview y18n is a the bare-bones internationalization library used by yargs Affected versions of this package are vulnerable to Prototype Pollution due to improper sanitization. PoC by po6ix: js const y18n = require'y18n'; y18n.setLocale'proto'; y18n.updateLocalepolluted: true;...

BigBlueButton Greenlight Cross-Site Scripting Vulnerability

BigBlueButton is BigBlueButton community of a set of open source Web conferencing system . A cross-site scripting vulnerability exists in BigBlueButton Greenlight version 2.7.6, which stems from a cross-site scripting XSS vulnerability in the "merge account" function of admin .js. No details of t...

CVE-2020-27642

A cross-site scripting XSS vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6...

CVE-2020-27642

A cross-site scripting XSS vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6...

Cross site scripting

A cross-site scripting XSS vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6...

CVE-2020-27642

BigBlueButton Greenlight 2.7.6 is affected by a cross-site scripting (XSS) vulnerability in the merge account functionality implemented in admins.js. This is consistently described across multiple sources (CVE-2020-27642 and related records) as an XSS in the merge account path. The vulnerability ...

CVE-2020-27642

A cross-site scripting XSS vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6...

PT-2020-16741

Name of the Vulnerable Software and Affected Versions BigBlueButton Greenlight version 2.7.6 Description A cross-site scripting XSS issue exists in the 'merge account' functionality in admins.js. This could potentially allow for malicious script execution. Recommendations For BigBlueButton...

CVE-2020-27642: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6...

Prototype Pollution

Overview @tsed/core is a package of Ts.ED framework. Affected versions of this package are vulnerable to Prototype Pollution. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on if user input is provided, an attacker can overwrite and...

Prototype Pollution

Overview immer is a package that allows you to create your next immutable state by mutating the current one. Affected versions of this package are vulnerable to Prototype Pollution. PoC const applyPatches, enablePatches = require"immer"; enablePatches; let obj = ; console.log"Before : " +...

Prototype Pollution

Overview chart.js is a Simple HTML5 charts using the canvas element. Affected versions of this package are vulnerable to Prototype Pollution. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options or the defaults options are deep...