[SECURITY] Fedora 36 Update: golang-github-evanphx-json-patch-5.5.0-3.fc36

Jsonpatch is a library which provides functionallity for both applying RFC6902 JSON patches against documents, as well as for calculating & applying RFC7396 JSON merge patches...

GSD-2022-1003731 bfq: Update cgroup information before merging bio

bfq: Update cgroup information before merging bio This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.198 by commit...

GSD-2022-1003019 bfq: Update cgroup information before merging bio

bfq: Update cgroup information before merging bio This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.14 by commit...

Prototype Pollution

Overview @loopback/rest is a The REST API package for loopback-next Affected versions of this package are vulnerable to Prototype Pollution via JSON payloads containing constructor. Details Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to...

Malicious code in @msmg/vue-merge-data-qa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 148b5fef898978c5cca2c43755dc356409fd64fed11c1c4104fc0ba40a586ac5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6883 Malicious code in uxpin-merge-ms-fabric (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6770965c2fb106f9c16c4bba9ca9724909591f0a1e2f43d34a55f322aca56f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in uxpin-merge-ms-fabric (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6770965c2fb106f9c16c4bba9ca9724909591f0a1e2f43d34a55f322aca56f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Memory Safety Issue when using `patch` or `merge` on `state` and assign the result back to `state`

Affected versions of this crate maintains references to memory that might have been freed already. If affects the following two tremor-script language constructs: A Merge where we assign the result back to the target expression and the expression to be merged needs to reference the event: let sta...

GHSA-3PP4-64MP-9CG9 Memory Safety Issue when using `patch` or `merge` on `state` and assign the result back to `state`

Affected versions of this crate maintains references to memory that might have been freed already. If affects the following two tremor-script language constructs: A Merge where we assign the result back to the target expression and the expression to be merged needs to reference the event: let sta...

CVE-2022-29220

github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests PRs. Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set t...

Design/Logic Flaw

github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests PRs. Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set t...

CVE-2022-29220 No verification of commits origin in github-action-merge-dependabot

github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests PRs. Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set t...

github-action-merge-dependabot 数据伪造问题漏洞

github-action-merge-dependabot is used to automatically approve and merge dependabot PRs. A security vulnerability exists in github-action-merge-dependabot versions prior to 3.2.0, which stems from the fact that it does not check whether commits created by dependabot are verified with the correct...

Approved spender can not withdraw or merge

Lines of code Vulnerability details In the current implementation, withdraw and merge veNFT can be called by approved spender or token owner. function withdrawuint tokenId external nonreentrant assertisApprovedOrOwnermsg.sender, tokenId; function mergeuint from, uint to external...

withdraw() and merge() functions of VotingEscrow won't work when an approved user(not owner) calls because _burn() function fails.

Lines of code Vulnerability details Impact withdraw and merge functions of VotingEscrow won't work when an approved usernot owner calls. Proof of Concept withdraw and merge functions call burn function inside and burn function calls removeTokenFrom using msg.sender. But removeTokenFrom requires...

VotingEscrow's merge and withdraw aren't available for approved users

Lines of code Vulnerability details Users who are approved, but do not own a particular NFT, are supposed to be eligible to call merge and withdraw from the NFT. Currently burn, used by merge and withdraw to remove the NFT from the system, will revert unless the sender is the owner of NFT as the...

Learn How Hackers Can Hijack Your Online Accounts Even Before You Create Them

Malicious actors can gain unauthorized access to users' online accounts via a new technique called "account pre-hijacking," latest research has found. The attack takes aim at the account creation process that's ubiquitous in websites and other online platforms, enabling an adversary to perform a...

Prototype Pollution

dset is vulnerable to prototype pollution. An attacker can inject properties into existing construct prototypes via the merge function in the merge.js and modify attributes such as proto, constructor, and prototype...

GHSA-23WX-CGXQ-VPWX Prototype Pollution in dset

All versions of dset prior to 3.1.2 are vulnerable to Prototype Pollution via dset/merge mode, as the dset function checks for prototype pollution by validating if the top-level path contains proto, constructor or prototype. By crafting a malicious object, it is possible to bypass this check and...

Prototype Pollution in dset

All versions of dset prior to 3.1.2 are vulnerable to Prototype Pollution via dset/merge mode, as the dset function checks for prototype pollution by validating if the top-level path contains proto, constructor or prototype. By crafting a malicious object, it is possible to bypass this check and...