3064 matches found
CVE-2018-16469
CVE-2018-16469 affects the merge package before version 1.2.1. The vulnerability arises in the merge.recursive function, which can be tricked into adding or modifying properties of Object.prototype. These polluted properties become present on all objects, potentially enabling a denial-of-service ...
CVE-2018-16469
The merge.recursive function in the merge package 1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects allowing for a denial of service attack...
PT-2018-3812
Name of the Vulnerable Software and Affected Versions lodash versions prior to 4.17.11 Description A prototype pollution issue was discovered in the merge, mergeWith, and defaultsDeep functions of the lodash library. This issue can be exploited to add or modify properties of Object.prototype. The...
PT-2018-13593
Name of the Vulnerable Software and Affected Versions merge versions prior to 1.2.1 Description The issue allows the merge.recursive function in the merge package to be tricked into adding or modifying properties of the Object prototype. This can lead to a denial of service attack, as these...
GNU Binutils Binary File Descriptor library null pointer dereference vulnerability
GNU Binutils a.k.a. GNU Binary Utilities or binutils is a set of programming language utilities developed by the GNU Project to work with object files in a variety of formats, with connectors, assemblers, and other tools for object files and archives.The Binary File Descriptor BFD library a.k.a...
DEBIAN-CVE-2018-18606
An issue was discovered in the mergestrings function in merge.c in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in bfdaddmergesection when attempting to merge sections with large alignments. A specially crafted ELF...
UBUNTU-CVE-2018-18606
An issue was discovered in the mergestrings function in merge.c in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in bfdaddmergesection when attempting to merge sections with large alignments. A specially crafted ELF...
Null pointer dereference
An issue was discovered in the mergestrings function in merge.c in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in bfdaddmergesection when attempting to merge sections with large alignments. A specially crafted ELF...
UBUNTU-CVE-2018-18605
A heap-based buffer over-read issue was discovered in the function secmergehashlookup in merge.c in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.31, because bfdaddmergesection mishandles section merges when size is not a multiple of entsize. A specially...
CVE-2018-18606
An issue was discovered in the mergestrings function in merge.c in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in bfdaddmergesection when attempting to merge sections with large alignments. A specially crafted ELF...
CVE-2018-18606
CVE-2018-18606 affects GNU Binutils (libbfd). The issue is a NULL pointer dereference in _bfd_add_merge_section during merging of sections with large alignments, enabling DoS via crafted ELF. Multiple vendors document this under Binutils remediation; confirmed fixes involve upgrading Binutils to ...
Prototype Pollution
Overview All versions of merge-options are vulnerable to Prototype Pollution Recommendation Update to version 1.0.1 or greater. References - HackerOne Report - GitHub Commit - GitHub Advisory...
Prototype Pollution
Overview All versions of merge-objects are vulnerable to Prototype Pollution. Recommendation No fix is available for this vulnerability at this time. It is our recommendation to use an alternative package. References - HackerOne Report - GitHub Advisory...
Prototype Pollution
Overview All versions of merge-recursive are vulnerable to Prototype Pollution. When malicious user input is merged with another object it allows the attacker to modify the prototype of Object via proto causing the addition or modification of an existing property. Proof of concept: var merge =...
Unspecified Vulnerability in Oracle MySQL Server (CNVD-2019-26720)
Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in the Server: Merge subcomponent of the MySQL Server component of Oracle MySQL, versions 5.6.41 and earlier, 5.7.23...
UBUNTU-CVE-2018-3247
Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Merge. Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to...
Prototype Pollution in merge-options
All versions of merge-options are vulnerable to Prototype Pollution Recommendation Update to version 1.0.1 or greater...
@aftonbladet/roc-package-web-app-gaea (>=0.1.0 <=0.4.1), @bitfirer/vue-qriously (=0.0.1) +133 more potentially affected by CVE-2018-3752 via merge-options (>=0.0.42 <=1.0.0)
merge-options NPM version =0.0.42, =0.1.0, =0.1.0, =0.0.1, =1.0.0, =0.1.0, =0.3.5, =0.1.6, =1.0.0-beta.1, =2.0.0, =1.0.0, =1.1.0, =1.16.1 and more Source cves: CVE-2018-3752 Source advisory: OSV:GHSA-QW93-45R3-P66P...
