Prototype Pollution

mongoose is vulnerable to Prototype Pollution. An attacker who has the ability to insert a document is able to inject properties into existing prototypes via the init function of document.js and modify the attributes such as proto and constructor, via the the index parameter, resulting in Prototy...

@a-la-fois/api (>=0.0.25 <=0.0.39), @a-la-fois/doc-client (>=0.0.1 <=0.0.39) +46 more potentially affected by CVE-2023-3696 via mongoose (>=7.0.0 <=7.3.2)

mongoose NPM version =7.0.0, =0.0.25, =0.0.1, =0.0.25, =0.0.1, =0.0.25, =3.12.0, =2.0.18, =0.3.0, =0.3.0, =0.3.0, =1.0.0, =0.1.33, =0.1.35 - @meniuapp/data =0.0.2 and more Source cves: CVE-2023-3696 Source advisory: OSV:GHSA-9M93-W8W6-76HH...

@3kles/3kles-coremongodb (>=1.2.3 <=1.3.1), @3kles/storagebox-common (=1.0.3) +85 more potentially affected by CVE-2023-3696 via mongoose (>=6.0.1 <=6.11.2)

mongoose NPM version =6.0.1, =1.2.3, =0.0.1, =0.0.1, =0.1.0, =0.1.0, =0.0.5, =0.5.0, =1.0.13, =1.2.18, =1.2.34-beta and more Source cves: CVE-2023-3696 Source advisory: OSV:GHSA-9M93-W8W6-76HH...

1405-authtokens (>=1.0.1 <=1.0.5), 1405_logging (=1.0.0) +3991 more potentially affected by CVE-2023-3696 via mongoose (>=1.0.0 <=5.13.2)

mongoose NPM version =1.0.0, =1.0.1, =1.0.7, =0.0.1, =0.0.2, =0.3.0, =0.0.1, =0.17.6, =0.0.1, =1.0.16, =1.0.30, =3.7.0, =3.8.2 and more Source cves: CVE-2023-3696 Source advisory: OSV:GHSA-9M93-W8W6-76HH...

Mongoose Prototype Pollution vulnerability

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.3, 6.11.3, and 5.13.20...

GHSA-9M93-W8W6-76HH Mongoose Prototype Pollution vulnerability

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.3, 6.11.3, and 5.13.20...

CVE-2023-3696

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4...

Code injection

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4...

CVE-2023-3696 Prototype Pollution in automattic/mongoose

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4...

CVE-2023-3696

CVE-2023-3696 affects the GitHub repository automattic/mongoose, with the vulnerability present in versions before 7.3.4. The root cause is a prototype pollution flaw in the code path used for object merging. Exploitation details are not provided in the supplied documents, but CVSS metrics indica...

CVE-2023-3696 Prototype Pollution in automattic/mongoose

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4...

CVE-2023-3696 Prototype Pollution in automattic/mongoose

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4...

Automattic Mongoose 安全漏洞

Automattic Mongoose is a MongoDB object modeling tool for asynchronous environments. A security vulnerability exists in Automattic Mongoose versions prior to 7.3.4 that stems from the presence of a prototype contamination vulnerability...

Cesanta Mongoose Web Server < 7.3.4 Prototype Pollution Vulnerability

Cesanta Mongoose Web Server is prone to a prototype pollution vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2023-3708 · Mongoose · Mongoose

Name of the Vulnerable Software and Affected Versions: mongoose versions prior to 7.3.4 mongoose versions prior to 6.11.3 mongoose versions prior to 5.13.20 Description: The issue is related to a prototype pollution vulnerability in the Mongoose library. This vulnerability can be exploited by a...

Mongoose Prototype Pollution Vulnerability

If an attacker has some way to control an object on the Mongo server through one way or another, it is possible to cause prototype pollution on any Mongoose client. Notably, if a poorly implemented service allows a user to control the object in findByIdAndUpdate and similar functions, this bug...

CVE-2023-34188

The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests...

DEBIAN-CVE-2023-34188

The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests...

Code injection

The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests...

UBUNTU-CVE-2023-34188

The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests...