CVE-2024-23339

CVE-2024-23339 نظرة عامة على الثغرة CVE-2024-23339 CVSS : 6.5 23 يناير 2024 تلوث النموذج الأولي ProtoType Pollution في حزمة node.js جزء من مشروع rebob وصف الثغرة github advisories hoolock هي مجموعة من الأدوات المساعدة خفيفة الوزن مصممة للحفاظ على حجم صغير عند التجميع. بدءًا من الإصدار 2.0.0 وقبل...

CLSA-2026-1774830277 TuxCare security update for object-path (3 CVEs)

TuxCare rebuilt object-path to address 3 CVEs. Fixed in 0.11.4-tuxcare.1...

PT-2026-74214

TuxCare rebuilt object-path to address 3 CVEs. Fixed in 0.11.4-tuxcare.1...

Plone < 2.5.3 XSS

The version of Plone installed on the remote host is prior to 2.5.3. It is, therefore, affected by a cross-site scripting XSS vulnerability, in the skins/plonetemplates/defaulterrormessage.pt due to improper validation of the typename parameter to Members/ipa/createObject before returning it to...

Security update for sssd

This update for sssd fixes the following issues CVE-2026-14474: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation bsc1270709. CVE-2026-14476: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypas...

CVE-2026-31216

The nexent v1.7.5.2 backend service contains an unauthorized arbitrary storage file deletion vulnerability in its file management API. The DELETE /storage/objectname:path endpoint lacks authentication, authorization, and input validation mechanisms. Unauthenticated remote attackers can send craft...

EUVD-2021-2112

Malware in sbrugna...

EUVD-2020-1425

Malware in sbrugna...

EUVD-2022-1036

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2021-23434

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the...

Linux Distros Unpatched Vulnerability : CVE-2021-3805

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' CVE-2021-3805 Note that Nessus relies on th...

MAL-2025-16781 Malicious code in change-object-path (npm)

The package change-object-path was found to contain malicious code...

MAL-2025-33017 Malicious code in set-object-path (npm)

The package set-object-path was found to contain malicious code...

change-object (0.0.0) potentially affected by unknown CVE via change-object-path (0.0.1)

change-object-path NPM version 0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on change-object-path and may be impacted: - change-object 0.0.0 Source cves: unknown CVE Source advisory: OSV:MAL-2025-16781...

@xizhouh/former (>=0.0.1, <=1.1.1), @xizhouh/formless (>=0.0.1, <=0.0.6) +1 more potentially affected by unknown CVE via set-object-path (2.0.1)

set-object-path NPM version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on set-object-path and may be impacted: - @xizhouh/former =0.0.1, =0.0.1, =0.3.0, =0.3.3 Source cves: unknown CVE Source advisory: OSV:MAL-2025-33017...

Malicious code in set-object-path (npm)

The package set-object-path was found to contain malicious code...

Malicious code in change-object-path (npm)

The package change-object-path was found to contain malicious code...

Security Bulletin: There is a vulnerablity in the object-path library affecting IBM watsonx Code Assistant IDE Extensions

Summary There is a vulnerablity in the object-path library affecting IBM watsonx Code Assistant IDE Extensions. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2021-23434 DESCRIPTION: Node.js object-path module could allow a remote attack...

UIOMatic 注入漏洞

UIOMatic is a tool by Tim Geyssens personal developer. It automatically generates an integrated crud UI for npoco poco based db tables. An injection vulnerability exists in UIOMatic version 5, which stems from the file /src/UIOMatic/wwwroot/backoffice/resources/uioMaticObject.r that can lead to S...

CVE-2021-3805

A flaw was found in the object-path nodejs library when the del function is called to validate object properties. An attacker can manipulate or alter the prototype of an object causing the modification of default properties on all objects. This could lead into a service disruption or a denial of...