GitLab: Stored-XSS in merge requests

Hi team, A stored XSS is existing in the merge requests pages. Steps to reproduce 1. In any existing project or create a new project with checking option "Initialize repository with a README" 2. Create a new branch with name '', e.g., git push origin master:"''" 3. Create a new merge request from...

Prototype Pollution

extend-merge is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype through the merge function...

@adamvr/mongration (>=1.0.1 <=1.1.1), @aemcloud/aemcloud-cli (>=0.1.1 <=0.10.8) +2146 more potentially affected by unknown CVE via lodash.merge (>=2.2.1 <=4.6.0)

lodash.merge NPM version =2.2.1, =1.0.1, =0.1.1, =0.70.1, =1.0.1, =2.2.3, =1.3.5, =1.2.2, =0.1.0-18, =1.0.0, =0.0.9, =4.0.0, =1.0.0, =1.0.0-dev-152fa896b5f3eb24fb8b97a28b89f0a83ea5da0f, =1.0.0-dev-a5e815fb69787bead6cfece07fba686b91ed3d3a and more Source cves: unknown CVE Source advisory:...

GHSA-2M96-9W4J-WGV7 Prototype Pollution in lodash.merge

Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object via proto causing the addition or modification of an existing property that will exist on all objects. Recommendation Update to version...

@adamvr/mongration (>=1.0.1 <=1.1.1), @aemcloud/aemcloud-cli (>=0.1.1 <=0.10.8) +2282 more potentially affected by unknown CVE via lodash.merge (>=2.2.1 <=4.6.1)

lodash.merge NPM version =2.2.1, =1.0.1, =0.1.1, =0.70.1, =1.0.1, =2.2.3, =1.3.5, =1.2.2, =0.1.0-18, =0.5.1-atomist-update-latest-1540938130032.20181101043939, =1.0.0, =0.0.9, =4.0.0, =1.0.0, =1.0.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-H726-X36V-RX45...

GHSA-H726-X36V-RX45 Prototype Pollution in lodash.merge

Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via constructor: prototype: ... causing the addition or modification of an existing property that will exist on all objects. Recommendation...

basic-read-config (>=1.0.2 <=1.0.3), blockchain-profile (>=0.1.0 <=0.3.2) +8 more potentially affected by unknown CVE via merge-objects (=1.0.5)

merge-objects NPM version =1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on merge-objects and may be impacted: - basic-read-config =1.0.2, =0.1.0, =0.0.5, =0.3.0, =0.0.1, =1.1.4, =1.4.0, =0.1.0, =0.0.1, =0.5.3 Source cves: unknown CVE Source...

GHSA-992F-WF4W-X36V Prototype Pollution in merge-objects

All versions of merge-objects are vulnerable to Prototype Pollution. Recommendation No fix is available for this vulnerability at this time. It is our recommendation to use an alternative package...

Prototype Pollution in merge-objects

All versions of merge-objects are vulnerable to Prototype Pollution. Recommendation No fix is available for this vulnerability at this time. It is our recommendation to use an alternative package...

GitLab: Revoked User can still view the Merge Request created by him via API

Summary In Gitlab when a user is demoted to Guest role, the Guest user will not be able to view and edit the Merge requests in a project even if the merge request is created by him. But this check is not implemented in API so the Guest user will be able to the following actions for the Merge...

Prototype Pollution

Overview datatables.net is a DataTables for jQuery Affected versions of this package are vulnerable to Prototype Pollution. POC The following two files are required to be served by an HTTP server. poc.html: $.fn.dataTable.ext.internal.fnSetObjectDataFn'proto.foo','polluted'; document.write'foo : ...

Prototype Pollution

Overview jsonpointer is a Simple JSON Addressing. Affected versions of this package are vulnerable to Prototype Pollution via the set function. POC by NerdJS const jsonpointer = require'jsonpointer'; jsonpointer.set, '/proto/polluted', true; console.logpolluted; Details Prototype Pollution is a...

Prototype Pollution

Overview gedi is an An evented data API Affected versions of this package are vulnerable to Prototype Pollution via the set function. POC const gedi = require'gedi'; try gedi.set'proto/polluted', true; catche console.logpolluted; Details Prototype Pollution is a vulnerability affecting JavaScript...

Prototype Pollution

Overview connie-lang is a the configuration language for connie. Affected versions of this package are vulnerable to Prototype Pollution in the configuration language library used by connie. POC const connie = require'connie'; const fs = require'fs'; fs.writeFileSync'test.json', "proto":...

Prototype Pollution

Overview property-expr is a tiny util for getting and setting deep object props safely Affected versions of this package are vulnerable to Prototype Pollution via the setter function. POC var expr = require'property-expr'; expr.setter'proto.polluted', true; console.logpolluted; // true Details...

Prototype Pollution

Overview Templ8 is a JavaScript Client/ Server Template Engine Affected versions of this package are vulnerable to Prototype Pollution via the parse function. POC const Templ8 = require'Templ8'; var tpl = new Templ8 'proto.polluted=true' ; tpl.parse; console.logpolluted //true Details Prototype...

Prototype Pollution

Overview safetydance is an Exception safety in node.js Affected versions of this package are vulnerable to Prototype Pollution via the set function. POC: const safetydance = require'safetydance'; safetydance.set, 'proto.polluted', true; console.logpolluted; //true Details Prototype Pollution is a...

Prototype Pollution

Overview promisehelpers is a Promise helper functions Affected versions of this package are vulnerable to Prototype Pollution via the insert function. POC: const promisehelpers = require'promisehelpers'; var obj = ; promisehelpers.insert'proto', 'polluted', trueobj; console.logpolluted; // true...

Prototype Pollution

Overview nodee-utils is a set of useful helpers Affected versions of this package are vulnerable to Prototype Pollution via the deepSet function. POC: const object = require'nodee-utils'; object.deepSet, 'proto.polluted', true; console.logpolluted; Details Prototype Pollution is a vulnerability...

Prototype Pollution

Overview node-oojs is an Object Oriented JavaScript Affected versions of this package are vulnerable to Prototype Pollution via the setPath function. POC: require'node-oojs'; oojs.setPath'proto.polluted':true; console.logpolluted; Details Prototype Pollution is a vulnerability affecting JavaScrip...