@glossgenius/eslint-config (>=1.0.2 <=1.0.7), @halonext/nestjs-express-cassandra (>=7.0.0 <=7.1.0) +7 more potentially affected by CVE-2021-26707 via merge-deep (>=3.0.0 <=3.0.2)

merge-deep NPM version =3.0.0, =1.0.2, =7.0.0, =5.2.0, =6.0.1, =0.0.1, =0.1.0, =0.0.11, =1.0.0, =1.2.4 Source cves: CVE-2021-26707 Source advisory: SNYK:JS-MERGEDEEP-1070277...

Prototype Pollution

Amendment This was deemed not a vulnerability. Overview highcharts is a JavaScript charting library based on SVG, with fallbacks to VML and canvas for old browsers. Affected versions of this package are vulnerable to Prototype Pollution via the merge function. The function recursively merges the...

AngularJS: Prototype pollution in merge function could result in code injection

A prototype pollution vulnerability was found in AngularJS. A remote attacker could abuse this flaw by providing malicious input to the merge function by overriding or adding properties of the Object.prototype, allowing possible injection of code...

Prototype Pollution

Overview rfc6902 is a Complete implementation of RFC6902 patch and diff Affected versions of this package are vulnerable to Prototype Pollution. It may allow attackers to inject or modify the methods and properties of the global object constructor. PoC // poc.js var rfc6902 = require"rfc6902" var...

Prototype Pollution

Overview prototyped.js is a Common typescript ready prototypes available in both es5 and es6 Affected versions of this package are vulnerable to Prototype Pollution. PoC const set = require"prototyped.js/dist/object/set".default; console.log"Prototype before set", .isAdmin; set, "proto.isAdmin",...

Prototype Pollution

Overview @lyngs/digger is an Use digger to value, from deep inside of an . Affected versions of this package are vulnerable to Prototype Pollution via the main functionality. PoC const digger = require"@lyngs/digger"; console.log'Prototype before dig', .isAdmin; digger, 'proto.isAdmin', true,...

@lyngs/chain (>=0.5.0 <=0.5.1) potentially affected by unknown CVE via @lyngs/merge (=1.0.9)

@lyngs/merge NPM version =1.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on @lyngs/merge and may be impacted: - @lyngs/chain =0.5.0, =0.5.1 Source cves: unknown CVE Source advisory: SNYK:JS-LYNGSMERGE-1069823...

Prototype Pollution

Overview @lyngs/merge is an Use merge to merge every value. supporting types: . Affected versions of this package are vulnerable to Prototype Pollution via the main functionality. PoC const merge = require'@lyngs/merge'; console.log"prototype before merge", .isAdmin; mergedummy: 1,...

Prototype Pollution

Overview nested-object-assign is a Package to support nested merging of objects & properties, using Object.Assign Affected versions of this package are vulnerable to Prototype Pollution via the default function, as demonstrated by running the PoC below. PoC // poc.js const assign =...

Prototype Pollution

Overview total.js is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. It can be used as web, desktop, service or IoT application. Affected versions of this package are vulnerable to Prototype Pollution. The set function can be...

Prototype Pollution in fabiospampinato/plain-object-merge

Description plain-object-merge is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: javascript // poc.js const merge = require'plain-object-merge' console.log'Before: ' + .polluted merge, JSON.parse'"proto": "polluted": true' console.log'After: ' + .polluted 2...

Prototype Pollution

merge-deep is vulnerable to prototype pollution attacks. An attacker is able to inject and overwrite arbitrary properties such as proto, constructor or prototype, resulting in privilege escalation, denial of service or potential arbitrary code execution...

Prototype Pollution

Overview properties-reader is a Properties file reader for Node.js Affected versions of this package are vulnerable to Prototype Pollution. PoC by Eugene Lim: payload.properties proto polluted = polluted poc.js: var propertiesReader = require'properties-reader';...

Prototype Pollution

Overview handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source. POC // compile the template var s2 = 'a/." ||...

IBM HTTP Server 8.5.0.0 <= 8.5.5.0 / 8.0.0.0 <= 8.0.0.6 / 7.0.0.0 <= 7.0.0.29 / 6.1.0.0 <= 6.1.0.45 (227047)

The version of IBM HTTP Server running on the remote host is affected by a vulnerability. moddav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service segmentation fault via a MERGE reques...

Prototype Pollution

Overview inireader is a small module for nodejs. You can parse .ini configuration files with it. Affected versions of this package are vulnerable to Prototype Pollution. This vulnerability relates to the parse function is concentrating arrays. Depending on if user input is provided, an attacker c...

Prototype Pollution in yowainwright/common-utilities

Description @common-utilities/merge-objects is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: // poc.js var a = require"@common-utilities/merge-objects" const payload = JSON.parse'"proto":"polluted":"Yes! Its Polluted"'; var obj = console.log"Before : " +...

Prototype Pollution

Overview multi-ini is an ini-file parser which supports multi line, multiple levels and arrays to get a maximum of compatibility with Zend config files. Affected versions of this package are vulnerable to Prototype Pollution. It is possible to pollute an object's prototype by specifying the...

GHSA-45Q2-34RF-MR94 Code Injection in mquery

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property e.g., proto can be copied during a merge or clone operation...

AngularJS: Prototype pollution in merge function could result in code injection

A prototype pollution vulnerability was found in AngularJS. A remote attacker could abuse this flaw by providing malicious input to the merge function by overriding or adding properties of the Object.prototype, allowing possible injection of code...