3081 matches found
Prototype Pollution
Overview asciitable.js is a Generate a ASCII Table from a bidimensional array of strings Affected versions of this package are vulnerable to Prototype Pollution via the main function. POC var a = require"asciitable.js"; var b = JSON.parse'"proto":"test":123'; a,b; console.log.test Details Prototy...
Prototype Pollution
json8-merge-patch is vulnerable to prototype pollution. Failure to sanitize the apply functions allows for injection of arbitrary properties into existing construct prototypes and modification of attributes such as proto, constructor and prototype...
CVE-2020-8268
Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...
CVE-2020-8268
Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...
CVE-2020-8268
Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...
CVE-2020-8268
Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...
CVE-2020-8268
The CVE-2020-8268 entry relates to the json8-merge-patch npm package. Affected software: json8-merge-patch prior to version 1.0.3. Root cause: the apply function fails to restrict access to object prototypes, enabling prototype pollution. Potential impact: modification of for-prototype behavior w...
UBUNTU-CVE-2020-7746
This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options or the defaults options are deeply merged with provided options. However, during this operation, the keys of the object being...
CVE-2020-7746
This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options or the defaults options are deeply merged with provided options. However, during this operation, the keys of the object being...
OS Command Injection
pdf-merge is vulnerable to remote code execution. An attacker is able to inject and execute arbitrary OS commands via the execOptions parameter...
Prototype Pollution
Overview y18n is a the bare-bones internationalization library used by yargs Affected versions of this package are vulnerable to Prototype Pollution due to improper sanitization. PoC by po6ix: js const y18n = require'y18n'; y18n.setLocale'proto'; y18n.updateLocalepolluted: true;...
BigBlueButton Greenlight Cross-Site Scripting Vulnerability
BigBlueButton is BigBlueButton community of a set of open source Web conferencing system . A cross-site scripting vulnerability exists in BigBlueButton Greenlight version 2.7.6, which stems from a cross-site scripting XSS vulnerability in the "merge account" function of admin .js. No details of t...
CVE-2020-27642
A cross-site scripting XSS vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6...
CVE-2020-27642
A cross-site scripting XSS vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6...
Cross site scripting
A cross-site scripting XSS vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6...
CVE-2020-27642
BigBlueButton Greenlight 2.7.6 is affected by a cross-site scripting (XSS) vulnerability in the merge account functionality implemented in admins.js. This is consistently described across multiple sources (CVE-2020-27642 and related records) as an XSS in the merge account path. The vulnerability ...
Prototype Pollution
Overview @tsed/core is a package of Ts.ED framework. Affected versions of this package are vulnerable to Prototype Pollution. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on if user input is provided, an attacker can overwrite and...
Prototype Pollution
Overview immer is a package that allows you to create your next immutable state by mutating the current one. Affected versions of this package are vulnerable to Prototype Pollution. PoC const applyPatches, enablePatches = require"immer"; enablePatches; let obj = ; console.log"Before : " +...
Prototype Pollution
Overview chart.js is a Simple HTML5 charts using the canvas element. Affected versions of this package are vulnerable to Prototype Pollution. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options or the defaults options are deep...