AngularJS: Prototype pollution in merge function could result in code injection

A prototype pollution vulnerability was found in AngularJS. A remote attacker could abuse this flaw by providing malicious input to the merge function by overriding or adding properties of the Object.prototype, allowing possible injection of code...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution. The vulnerability is in the extend function. PoC const decal = require'decal'; console.log'Before:', .polluted; const o = JSON.parse'"proto":"polluted":"1"'; decal.extend, true, o; console.log'After:', .polluted;...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution. The vulnerability is in the set function. PoC const decal = require'decal'; console.log'Before:', .polluted; decal.set, "proto.polluted", "1337"; console.log'After:', .polluted; Details Prototype Pollution is a...

Prototype Pollution

Overview jiff is a JSON diff and patch based on rfc6902 Affected versions of this package are vulnerable to Prototype Pollution. When the operation specified is 'add', the function adds in the target object the property specified in the path, however it does not properly check the key being set,...

Prototype Pollution

mquery is vulnerable to prototype pollution. The vulnerability exists as it does not prevent proto, constructor, prototype to be added in a merge or clone operation...

Prototype Pollution

Overview mquery is an Expressive query building for MongoDB Affected versions of this package are vulnerable to Prototype Pollution via the merge function within lib/utils.js. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program. PoC...

Prototype Pollution

Overview rxdb is a RxDB short for Reactive Database is a NoSQL-database for JavaScript Applications like Websites, hybrid Apps, Electron-Apps, Progressive Web Apps and NodeJs. Affected versions of this package are vulnerable to Prototype Pollution via the merge function within lib/utils.js...

CVE-2020-35149

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property e.g., proto can be copied during a merge or clone operation...

CVE-2020-35149

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property e.g., proto can be copied during a merge or clone operation...

Mquery Security Vulnerability

Aheckmann Mquery is a Javascript-based codebase for efficiently generating Mongdb query statements from the individual developer Aheckmann. A security vulnerability exists in mquery lib/utils.js versions prior to 3.2.3, which allows contamination attacks because a special attribute e.g. proto can...

PDF Cat Split & Merge Software Exploits a dll Hijacking Vulnerability

PDF Cat Split and Merge Software is a PDF file to merge the operation of the software. PDF Cat Split & Merge Software has a dll hijacking vulnerability, which can be exploited by attackers to load a dll without signing and file verification, resulting in dll hijacking...

Prototype Pollution

Overview systeminformation is a simple system and OS information library. Affected versions of this package are vulnerable to Prototype Pollution. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands. Note: The fix for this vulnerability is...

Prototype Pollution

Overview merge is a library that allows you to merge multiple objects into one, optionally creating a new cloned object. Similar to the jQuery.extend but more flexible. Works in Node.js and the browser. Affected versions of this package are vulnerable to Prototype Pollution via recursiveMerge...

@amaspace-editor/builder (>=0.0.52 <=0.0.522), @instacart/eslint-config (=0.3.0) +13 more potentially affected by CVE-2020-28499 via merge (=2.1.0)

merge NPM version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on merge and may be impacted: - @amaspace-editor/builder =0.0.52, =1.4.2, =4.0.19, =1.0.21, =4.0.30, =1.0.34, =2.0.25, =3.0.17, =1.0.19, =4.0.21, =4.0.26 Source cves: CVE-2020-28499...

Prototype Pollution

controlled-merge is vulnerable to prototype pollution. Lack of validation allows an attacker to inject arbitrary properties into proto or constructor to crash the application and potentially obtain remote code execution...

CVE-2020-28268

Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution...

CVE-2020-28268

Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution...

Remote code execution

Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution...

CVE-2020-28268

Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution...

CVE-2020-28268

The CVE-2020-28268 entry concerns controlled-merge prototype pollution in versions 1.0.0–1.2.0. The root cause is a prototype pollution vulnerability that can cause a denial of service and may lead to remote code execution. Documentation in PT-2020-16958 notes the issue and provides a remediation...