3085 matches found
GitLab Community Edition和GitLab Enterprise Edition 资源管理错误漏洞
GitLab Enterprise Edition is a content management system GitLab Community Edition is a community edition of GitLab from GitLab, Inc. A resource management error vulnerability exists in GitLab Community Edition CE and Enterprise Edition EE due to insufficient validation of user-supplied input in...
PT-2022-11088 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 0.8.0 through 14.2.5 GitLab CE/EE versions 14.3.0 through 14.3.3 GitLab CE/EE versions 14.4.0 Description: The issue allows certain Unicode characters to be abused, enabling the commitment of malicious code into projects...
deepmerge-ts 安全漏洞
deepmerge-ts is an npm package. It is used to deep merge 2 or more objects with respect to type information. A security vulnerability exists in deepmerge-ts that stems from prototype contamination in the defaultMergeRecords function of the deepmerge.ts file...
CVE-2022-0344
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.4, all versions starting from 10.2 before 14.7.1. Private project paths can be disclosed to unauthorized users via system notes when an Issue is closed via a...
CVE-2022-0344
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.4, all versions starting from 10.2 before 14.7.1. Private project paths can be disclosed to unauthorized users via system notes when an Issue is closed via a...
UBUNTU-CVE-2022-0344
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.4, all versions starting from 10.2 before 14.7.1. Private project paths can be disclosed to unauthorized users via system notes when an Issue is closed via a...
CVE-2022-0344
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.4, all versions starting from 10.2 before 14.7.1. Private project paths can be disclosed to unauthorized users via system notes when an Issue is closed via a...
PT-2022-13118 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions 10.0 through 14.5.4 GitLab versions 10.1 through 14.6.4 GitLab versions 10.2 through 14.7.1 Description: An issue in GitLab allows private project paths to be disclosed to unauthorized users via system notes when an Issue is...
Prototype Pollution
set-in is vulnerable to prototype pollution. An attacker is able to inject malicious property types via setIn method and merge object prototypes into it, resulting in prototype pollution vulnerability...
Denial Of Service (DoS)
qs is vulnerable to denial of service. The vulnerability exists in merge function in qs.js due to lack of sanitization which allows an attacker to cause an application crash...
Prototype Pollution
Overview Affected versions of this package are vulnerable to Prototype Pollution via object-extend. PoC js const extend = require"object-extend"; const payload = JSON.parse'"proto":"isAdmin":"yes"'; extend, payload; const obj = "a":1; console.logobj.isAdmin // print yes on arbitrary objects since...
Prototype Pollution
mixme is vulnerable to prototype pollution. The function mutate and merge allows an attacker to get control of value of “path” and modify attributes such as proto, constructor and prototype...
Prototype Pollution
putil-merge is vulnerable to prototype pollution. The vulnerability exists due to the validations are not handled properly in the merge method in merge.js file which allows an attacker to inject properties into existing construct prototypes and modify attributes...
Prototype Pollution in putil-merge
This affects the package putil-merge before 3.8.0. The merge function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in...
@cscharpf/minio-client-versioned (>=1.0.0 <=1.0.8), @iliad.dev/strapi-adapter (>=0.0.43 <=0.2.2) +46 more potentially affected by CVE-2021-23470 via putil-merge (>=1.2.0 <=3.13.0)
putil-merge NPM version =1.2.0, =1.0.0, =0.0.43, =0.6.0, =0.12.0, =0.6.0, =0.6.0, =0.6.0, =1.0.0-beta.3, =0.6.0, =0.10.0, =0.6.0, =0.93.1, =4.0.1, =4.0.1, =5.0.4 and more Source cves: CVE-2021-23470 Source advisory: OSV:GHSA-4G77-CVGW-GRVW...
GHSA-4G77-CVGW-GRVW Prototype Pollution in putil-merge
This affects the package putil-merge before 3.8.0. The merge function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in...
CVE-2021-23470
This affects the package putil-merge before 3.8.0. The merge function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in...
CVE-2021-23470
This affects the package putil-merge before 3.8.0. The merge function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in...
Hardcoded credentials
This affects the package putil-merge before 3.8.0. The merge function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in...
CVE-2021-23470 Prototype Pollution
This affects the package putil-merge before 3.8.0. The merge function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in...