3082 matches found
Design/Logic Flaw
This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function...
CVE-2021-23426
Proto is vulnerable to prototype pollution via the merge function across all versions. The root cause is an unsafe recursive merge (and related path-based pollution) that can inject properties into Object.prototype (proto , constructor, prototype). Potential impact includes DoS and possible remot...
CVE-2021-23426 Prototype Pollution
This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function...
CVE-2021-23426
This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function...
Prototype Pollution
Overview dotty is a package that can access properties of nested objects using dot-path notation. Affected versions of this package are vulnerable to Prototype Pollution. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the path parameter a...
Prototype Pollution
Overview jsonpointer is a Simple JSON Addressing. Affected versions of this package are vulnerable to Prototype Pollution. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays. PoC const jsonpointer = require'jsonpointer'...
Prototype Pollution
Overview json-pointer is a set of utilities for JSON pointers described by RFC 6901 Affected versions of this package are vulnerable to Prototype Pollution. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer components are arrays. PoC const pointer =...
Prototype Pollution
Overview algoliasearch-helper is a Helper for implementing advanced search features with algolia Affected versions of this package are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters.parseNumbers without any protection against...
GHSA-JH37-772X-4HPW Double free in algorithmica
An issue was discovered in the algorithmica crate through 2021-03-07 for Rust. In the affected versions of this crate, mergesort::merge wildly duplicates and drops ownership of T without guarding against double-free. Due to such implementation, simply invoking mergesort::merge on Vec can cause...
Double free in algorithmica
An issue was discovered in the algorithmica crate through 2021-03-07 for Rust. In the affected versions of this crate, mergesort::merge wildly duplicates and drops ownership of T without guarding against double-free. Due to such implementation, simply invoking mergesort::merge on Vec can cause...
Double free in algorithmica
An issue was discovered in the algorithmica crate through 2021-03-07 for Rust. In the affected versions of this crate, mergesort::merge wildly duplicates and drops ownership of T without guarding against double-free. Due to such implementation, simply invoking mergesort::merge on Vec can cause...
Design/Logic Flaw
This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge...
CVE-2021-23432
This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge...
mootools 安全漏洞
mootools is a library for web development with OOP support. A security vulnerability exists in mootools that allows an attacker to pass untrusted input to the application's Object.merge...
PT-2021-5800 · Ntfs-3G +7 · Ntfs-3G +7
Name of the Vulnerable Software and Affected Versions: NTFS-3G versions prior to 2021.8.22 Description: The issue is related to a crafted NTFS image that can cause an out-of-bounds read in the ntfs runlists merge i function of the NTFS-3G driver for the FUSE module. This can potentially allow an...
Prototype Pollution
Overview Affected versions of this package are vulnerable to Prototype Pollution when loading config files. Details Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes,...
CVE-2021-23421
All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function...
Code injection
All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function...
CVE-2021-23421
CVE-2021-23421 affects merge-change: all versions are vulnerable to Prototype Pollution via the utils.set function. The root cause is an unsafe recursive merge that can propagate pollution to Object.prototype when certain properties (e.g., proto ) are set or when the path-based API is abused. The...