Prototype Pollution

mongoose is vulnerable to pollution prototype. The vulnerability exists in add and path functions in lib/schema.js because it allows setting proto when creating schema with dotted properties which allows a remote attacker to inject and execute malicious property resulting in prototype pollution...

GHSA-H8HF-X3F4-XWGP Mongoose Vulnerable to Prototype Pollution in Schema Object

Description Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows...

Mongoose Vulnerable to Prototype Pollution in Schema Object

Description Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows...

1405-authtokens (>=1.0.1 <=1.0.5), 1405_logging (=1.0.0) +3986 more potentially affected by CVE-2022-24304 via mongoose (>=1.0.0 <=5.13.14)

mongoose NPM version =1.0.0, =1.0.1, =1.0.7, =0.0.1, =0.0.2, =0.3.0, =0.0.1, =0.17.6, =0.0.1, =1.0.16, =1.0.30, =3.7.0, =3.8.2 and more Source cves: CVE-2022-24304 Source advisory: OSV:GHSA-H8HF-X3F4-XWGP...

1stapi (=1.0.0), 3.nodepackagemanager (=1.0.0) +3273 more potentially affected by CVE-2022-24304 via mongoose (>=6.0.1 <=6.4.5)

mongoose NPM version =6.0.1, =1.0.0, =2.0.0, =1.0.0, =0.2.0, =1.0.0, =1.0.0, =1.2.1, =1.0.0, =1.0.0, =1.0.0, =2.12.0, =2.54.0 - @3kles/storagebox-common =1.0.3 and more Source cves: CVE-2022-24304 Source advisory: OSV:GHSA-H8HF-X3F4-XWGP...

Malicious code in mongoos (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ab32f7c212c797143b0b25f1f96b0e6cdce969c148e8ce5973c3c95ad99f2dc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Denial Of Service (DOS)

Mongoose is vulnerable to prototype pollution. The vulnerability is due to the Schema.path function which does not prohibit the setting of the schema object, which can lead to Denial of Service...

GHSA-F825-F98C-GJ3G automattic/mongoose vulnerable to Prototype pollution via Schema.path

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification...

1stapi (=1.0.0), 3.nodepackagemanager (=1.0.0) +3273 more potentially affected by CVE-2022-2564 via mongoose (>=6.0.1 <=6.4.5)

mongoose NPM version =6.0.1, =1.0.0, =2.0.0, =1.0.0, =0.2.0, =1.0.0, =1.0.0, =1.2.1, =1.0.0, =1.0.0, =1.0.0, =2.12.0, =2.54.0 - @3kles/storagebox-common =1.0.3 and more Source cves: CVE-2022-2564 Source advisory: OSV:GHSA-F825-F98C-GJ3G...

1405-authtokens (>=1.0.1 <=1.0.5), 1405_logging (=1.0.0) +3986 more potentially affected by CVE-2022-2564 via mongoose (>=1.0.0 <=5.13.14)

mongoose NPM version =1.0.0, =1.0.1, =1.0.7, =0.0.1, =0.0.2, =0.3.0, =0.0.1, =0.17.6, =0.0.1, =1.0.16, =1.0.30, =3.7.0, =3.8.2 and more Source cves: CVE-2022-2564 Source advisory: OSV:GHSA-F825-F98C-GJ3G...

automattic/mongoose vulnerable to Prototype pollution via Schema.path

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification...

Code injection

Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6...

CVE-2022-2564

Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6...

CVE-2022-2564 Prototype Pollution in automattic/mongoose

Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6...

CVE-2022-2564 Prototype Pollution in automattic/mongoose

Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6...

CVE-2022-2564

CVE-2022-2564 covers a Prototype Pollution vulnerability in automattic/mongoose prior to 6.4.6. Some connected records describe the issue as prototype pollution via Schema.path, which could enable modification of the Object prototype and, per related advisories, potential DoS scenarios. The publi...

CVE-2022-2564 Prototype Pollution in automattic/mongoose

Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6...

PT-2022-17426 · Mongoose · Mongoose

Name of the Vulnerable Software and Affected Versions: mongoose versions prior to 6.4.6 Description: The issue concerns a Prototype Pollution vulnerability in the mongoose package, a MongoDB object modeling tool. This vulnerability affects the Schema.path function, allowing modification of the...

Automattic Mongoose 安全漏洞

Automattic Mongoose is a MongoDB object modeling tool for asynchronous environments. A security vulnerability exists in Automattic Mongoose versions prior to 6.4.6, which stems from the Schema.path function being susceptible to prototype contamination when setting up schema objects, which can be...

Possible prototype pollution in Schema.path

Description Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows...