Important: Red Hat Security Advisory: RHV 4.4 SP1 [ovirt-4.5.3-3] security update

Updated RHV packages that fix several bugs and add various enhancements are now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Insecure Temporary File

Overview com.fasterxml.util:java-merge-sort is a package for basic configurable disk-backed N-way merge sort Affected versions of this package are vulnerable to Insecure Temporary File. in the StdTempFileProvider function in StdTempFileProvider.java, which uses the permissive File.createTempFile...

at.molindo:esi4j (>=3.0.0 <=3.0.2), at.molindo:scrutineer (=3.0.0) +9 more potentially affected by CVE-2022-24913 via com.fasterxml.util:java-merge-sort (>=1.0.0 <=1.0.2)

com.fasterxml.util:java-merge-sort MAVEN version =1.0.0, =3.0.0, =6.5.0, =2.3.0, =0.5.3, =0.5.3, =0.9.0, =0.5.3, =0.5.3, =0.9.0, =1.0.2, =1.0.4 Source cves: CVE-2022-24913 Source advisory: SNYK:JAVA-COMFASTERXMLUTIL-3227926...

Prototype Pollution

Overview dot-lens is a Simple, compiled dot lenses Affected versions of this package are vulnerable to Prototype Pollution via the set function in index.js file. PoC var dot = require"dot-lens" console.log"before:"+.test dot.set"proto.test","123" console.log"after:"+.test Details Prototype...

Prototype Pollution

Overview flatnest is a Flatten/Nest Javascript objects. Affected versions of this package are vulnerable to Prototype Pollution via the nest function in the flatnest/nest.js file. Details Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to...

Prototype Pollution

Overview collection.js is a Minimalistic JavaScript library for working with collections of data. Affected versions of this package are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js. PoC javascript var collection = require"collection.js"...

Prototype Pollution

Overview utilities is an A classic collection of JavaScript utilities Affected versions of this package are vulnerable to Prototype Pollution via the mix function. PoC javascript var utilities = require"utilities" badobjects= test:"123" console.log"Before:"+.test...

Prototype Pollution

Overview progressbar.js is a Responsive and slick progress bars with animated SVG paths Affected versions of this package are vulnerable to Prototype Pollution via the function extend in the file utils.js. PoC js var progressbar = require"progressbar.js" BADJSON = JSON.parse'"proto":"test":123';...

Prototype Pollution

Overview whet.extend is an A sharped version of port of jQuery.extend that actually works on node.js Affected versions of this package are vulnerable to Prototype Pollution due to improper user input sanitization when using the extend and findValue functions. Details Prototype Pollution is a...

Prototype Pollution

Overview rangy is an A cross-browser DOM range and selection library Affected versions of this package are vulnerable to Prototype Pollution when using the extend function in file rangy-core.js.The function uses recursive merge which can lead an attacker to modify properties of the Object.prototy...

WordPress plugin Easy Forms for MailChimp 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

AngularJS: Prototype pollution in merge function could result in code injection

A prototype pollution vulnerability was found in AngularJS. A remote attacker could abuse this flaw by providing malicious input to the merge function by overriding or adding properties of the Object.prototype, allowing possible injection of code...

AngularJS: Prototype pollution in merge function could result in code injection

A prototype pollution vulnerability was found in AngularJS. A remote attacker could abuse this flaw by providing malicious input to the merge function by overriding or adding properties of the Object.prototype, allowing possible injection of code...

CVE-2022-44721

CVE-2022-44721 has been merged into CVE-2022-2841 and is not an active vulnerability entry. The connected records detail a CrowdStrike Falcon uninstall-protection issue (Uninstallation Handler) affecting multiple firmware/builds, with exploitation involving bypassing a one-time token/uninstall pr...

kernel: bfq: Avoid merging queues with different parents

In the Linux kernel, the following vulnerability has been resolved: bfq: Avoid merging queues with different parents It can happen that the parent of a bfqq changes between the moment we decide two queues are worth to merge and set bic-stablemergebfqq and the moment bfqsetupmerge is called. This...

Exploit for CVE-2022-21350

It is an offensive tool for Java-based web applications. The rep...

If the Ethereum Merge Fails, L2s Will Be More Vital Than Ever

By Waqas Ethereum merge is an upgrade to the Ethereum blockchain which will happen in mid-September 2022. This is a post from HackRead.com Read the original post: If the Ethereum Merge Fails, L2s Will Be More Vital Than Ever...

The vulnerabilities of the merge, mergeWith, and defaultsDeep functions in the Lodash library allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the merge, mergeWith, and defaultsDeep functions in the Lodash library is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

Wrong assumption of block time might cause wrong value of votingDelay, votingPeriod

Lines of code Vulnerability details Impact In NounsDAOLogic, there are some constants in the system are estimated with an assumption that block time is 15 second. These constants are used to check value of votingPeriod and votingDelay. Actually, the merge is near and after the merge blocks come...

Prototype Pollution

ts-deepmerge is vulnerable to pollution prototype. The vulnerability exists because of missing sanitization of the merge parameters in 'src/index.test.ts', allowing an attacker to inject malicious characteristics to add new values to a javascript application object prototype,overwriting or...