3081 matches found
CVE-2020-13901
An issue was discovered in janus-gateway aka Janus WebRTC Server through 0.10.0. janussdpmerge in sdp.c has a stack-based buffer overflow...
Prototype Pollution
Overview @uifabric/utilities is a package that includes a number of basic utility functions required by most Fluent UI React components. Affected versions of this package are vulnerable to Prototype Pollution. The merge function available within the utilities package of FabricUI allows one object...
Node.js third-party modules: [objtools] Prototype pollution
I would like to report a prototype pollution vulnerability in objtools module. It allows an attacker to inject properties on Object.prototype. Module module name: objtools version: 2.0.1 npm page: https://www.npmjs.com/package/objtools Module Description objtools provides several utility function...
Node.js third-party modules: [extend-merge] Prototype pollution
I would like to report a prototype pollution vulnerability in extend-merge module. It allows an attacker to inject properties on Object.prototype. Module module name: extend-merge version: 1.0.5 npm page: https://www.npmjs.com/package/extend-merge Module Description Shallow extend and deep merge...
Prototype Pollution
Overview objutil is a Javascript Object util methods with deep traverse, with ES6 tree shaking methods. Affected versions of this package are vulnerable to Prototype Pollution. The merge method could be tricked into adding or modifying properties of Object.prototype. PoC var a = x:1,y: w:1, z:2 v...
Node.js third-party modules: [plain-object-merge] Prototype pollution
I would like to report a prototype pollution vulnerability in plain-object-merge module. It allows an attacker to inject properties on Object.prototype. Module module name: plain-object-merge version: 1.0.1 npm page: https://www.npmjs.com/package/plain-object-merge Module Description Extremely fa...
FreeBSD : Gitlab -- Multiple Vulnerabilities (e8483115-8b8e-11ea-bdcf-001b217b3468)
Gitlab reports : Path Traversal in NuGet Package Registry Workhorse Bypass Leads to File Disclosure OAuth Application Client Secrets Revealed Code Owners Approval Rules Are Not Updated for Existing Merge Requests When Source Branch Changes Code Owners Protection Not Enforced from Web UI Repositor...
wxHexEditor - Hex Editor / Disk Editor for Huge Files or Devices on Linux, Windows and MacOSX
wxHexEditor is another Free Hex Editor, build because there is no good hex editor for Linux system, specially for big files. Low Level Data Recovery with wxHexEditor wxHexEditor is not an ordinary hex editor, but could work as low level disk editor too. If you have problems with your HDD or...
Prototype Pollution
Overview grunt-util-property is a Grunt util for getting and setting properties. Affected versions of this package are vulnerable to Prototype Pollution. The function call could be tricked into adding or modifying properties of Object.prototype using a proto payload. PoC var grunt = require"grunt...
CVE-2020-10976
GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget...
CVE-2020-10976
GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget...
Cross site request forgery (csrf)
GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget...
CVE-2020-10976
GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget...
CVE-2020-10976
CVE-2020-10976 affects GitLab EE/CE versions 8.17 through 12.9, with information leakage when querying the merge request widget. The issue is a server-side information disclosure vulnerability (network vector, no authentication) leading to partial confidentiality impact. It is addressed in GitLab...
CVE-2020-10976
GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget...
CVE-2020-10976
Removed by vendor...
PT-2020-12461 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab EE/CE versions 8.17 to 12.9 Description: The issue concerns information leakage when querying a merge request widget. Recommendations: For GitLab EE/CE versions 8.17 to 12.9, update to a version that contains a fix for this issue to...
CVE-2018-3728
hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data MAID vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existi...
Prototype Pollution
Overview ini-parser is a package to parse .ini files. Affected versions of this package are vulnerable to Prototype Pollution. The library could be tricked into adding or modifying properties of Object.prototype using a proto payload. PoC var a = require"ini-parser"; a.parse'proto\ntoString=JHU';...