Prototype Pollution

Overview node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities. Affected versions of this package are vulnerable to Prototype Pollution via the util.setPath function. Note: version 0.10.0 is a breaking change removing...

Prototype Pollution

Overview linux-cmdline is a Parser for the Linux kernel command line arguments Affected versions of this package are vulnerable to Prototype Pollution via the constructor. POC: const linuxCmdline = require'linux-cmdline'; linuxCmdline'proto.polluted=true'; console.logpolluted; Details Prototype...

Prototype Pollution

Overview grpc is a gRPC Library for Node Affected versions of this package are vulnerable to Prototype Pollution via loadPackageDefinition. POC: const loadPackageDefinition = require'grpc'; loadPackageDefinition'proto.polluted': true; console.logpolluted; Details Prototype Pollution is a...

Prototype Pollution

Overview @grpc/grpc-js is a gRPC Library for Node Affected versions of this package are vulnerable to Prototype Pollution via loadPackageDefinition. POC: const loadPackageDefinition = require'grpc'; loadPackageDefinition'proto.polluted': true; console.logpolluted; Details Prototype Pollution is a...

Prototype Pollution

Overview dot-notes is a Two way conversions between objects and dot/bracket notation Affected versions of this package are vulnerable to Prototype Pollution via the create function. POC: const dots = require'dot-notes'; dots.create, 'proto.polluted', true; console.logpolluted; Details Prototype...

Prototype Pollution

Overview deeps is a Highly performant utilities to manage deeply nested objects. get, set, merge, flatten, diff etc. Affected versions of this package are vulnerable to Prototype Pollution via the set function. POC: const deeps = require'deeps'; deeps.set, 'proto.polluted', true;...

Prototype Pollution

Overview deep-get-set is a Set and get values on objects via dot-notation strings. Affected versions of this package are vulnerable to Prototype Pollution via the main function. POC: const deep = require'deep-get-set'; deep, 'proto', 'polluted', true; console.logpolluted; Details Prototype...

Prototype Pollution

Overview bmoor is an A basic foundation for other libraries, establishing useful patterbs, and letting them be more. Affected versions of this package are vulnerable to Prototype Pollution via the set function. POC: const bmoor = require'bmoor'; bmoor.set, ""proto.polluted"", true;...

Prototype Pollution

Overview arr-flatten-unflatten is a non-recursive method of flattening an array or arrays and unflattening the result Affected versions of this package are vulnerable to Prototype Pollution via the constructor. POC: const unflatten = require'arr-flatten-unflatten'; unflatten'proto.polluted':true;...

Prototype Pollution

Overview json-pointer is a set of utilities for JSON pointers described by RFC 6901 Affected versions of this package are vulnerable to Prototype Pollution. Multiple reference of object using slash is supported. PoC js var pointer = require'json-pointer'; var obj = ; pointer.setobj,...

The vulnerability of the try_merge_free_space() function in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the trymergefreespace function in the Linux operating system’s kernel is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure...

FreeBSD : Gitlab -- Multiple Vulnerabilities (0a305431-bc98-11ea-a051-001b217b3468)

Gitlab reports : Missing Permission Check on Time Tracking Cross-Site Scripting in PyPi Files API Insecure Authorization Check on Private Project Security Dashboard Cross-Site Scripting in References Cross-Site Scripting in Group Names Cross-Site Scripting in Blob Viewer Cross-Site Scripting in...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: Missing Permission Check on Time Tracking Cross-Site Scripting in PyPi Files API Insecure Authorization Check on Private Project Security Dashboard Cross-Site Scripting in References Cross-Site Scripting in Group Names Cross-Site Scripting in Blob Viewer Cross-Site Scripting in...

CVE-2020-7679

In all versions of package casperjs, the mergeObjects utility function is susceptible to Prototype Pollution...

Prototype Pollution

Overview casperjs is a navigation scripting & testing utility for PhantomJS and SlimerJS. Affected versions of this package are vulnerable to Prototype Pollution. The mergeObjects utility function is susceptible to Prototype Pollution. PoC by Snyk var payload = JSON.parse'"proto": "a": "pwned"';...

PT-2020-19702 · Casperjs Team · Casperjs

Name of the Vulnerable Software and Affected Versions: casperjs versions affected versions not specified Description: The issue concerns a Prototype Pollution vulnerability via the mergeObjects utility function in casperjs, a navigation scripting and testing utility for PhantomJS and SlimerJS. Th...

CVE-2020-14213

In Zammad before 3.3.1, a Customer has ticket access that should only be available to an Agent e.g., read internal data, split, or merge...

DEBIAN-CVE-2020-13901

An issue was discovered in janus-gateway aka Janus WebRTC Server through 0.10.0. janussdpmerge in sdp.c has a stack-based buffer overflow...

CVE-2020-13901

An issue was discovered in janus-gateway aka Janus WebRTC Server through 0.10.0. janussdpmerge in sdp.c has a stack-based buffer overflow...

UBUNTU-CVE-2020-13901

An issue was discovered in janus-gateway aka Janus WebRTC Server through 0.10.0. janussdpmerge in sdp.c has a stack-based buffer overflow...