BIT-TYPO3-2020-11066

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, calling unserialize on malicious user-submitted content can lead to modification of dynamically-determined object attributes and result in triggering deletion of an arbitrary...

Zammad Information Disclosure Vulnerability (CNVD-2023-9769727)

Zammad is a suite of ticket management software from the German company Zammad. Zammad suffers from an information disclosure vulnerability that stems from the use of the public endpoint /api/v1/signshow as its login screen, which returns internal configuration data for user object attributes. An...

CVE-2023-50453: Undefined Security Weakness

An issue was discovered in Zammad before 6.2.0. It uses the public endpoint /api/v1/signshow for its login screen. This endpoint returns internal configuration data of user object attributes, such as selectable values, which should not be visible to the public...

CVE-2023-50453

An issue was discovered in Zammad before 6.2.0. It uses the public endpoint /api/v1/signshow for its login screen. This endpoint returns internal configuration data of user object attributes, such as selectable values, which should not be visible to the public...

CVE-2023-43177

CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes...

Design/Logic Flaw

CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes...

SUSE CVE-2020-25720

A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator...

CVE-2023-0574 Server-Side Request Forgery

Server-Side Request Forgery SSRF, Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentication Attempts vulnerability in YugaByte, Inc. Yugabyte Managed allows Accessing Functionality Not Properly Constrained by ACLs, Communicati...

CVE-2023-0574

CVE-2023-0574 affects Yugabyte Managed (versions 2.0.0.0–2.13.0.0). The issue combines Server-Side Request Forgery (SSRF) with improperly controlled modification of dynamically-determined object attributes and improper restriction of excessive authentication attempts, allowing access to functiona...

PT-2023-16377

Name of the Vulnerable Software and Affected Versions Yugabyte DB version 2.17.0.0 Description The issue affects Yugabyte DB, allowing for Server-Side Request Forgery SSRF, Improperly Controlled Modification of Dynamically-Determined Object Attributes, and Improper Restriction of Excessive...

AZL-36987 CVE-2018-14628 affecting package samba 4.18.3-2

An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store...

Prototype Pollution

flat is vulnerable to prototype pollution. The vulnerability exists in the unflatten function of index.js, due to the improper checks for the key1 variable which allows an attacker to modify object prototype attributes...

CVE-2020-36632

A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes 'prototype pollution'. It is possible to initiate the atta...

DEBIAN-CVE-2022-2200

If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading to privileged code execution. This vulnerability affects Firefox 102, Firefox ESR 91.11, Thunderbird 102, and Thunderbird 91.11...

Prototype Pollution in jsgui-lang-essentials

All versions of package jsgui-lang-essentials are vulnerable to Prototype Pollution due to allowing all Object attributes to be altered, including their magical attributes such as proto, constructor and prototype...

GHSA-P3PG-64PV-V7JG Prototype Pollution in jsgui-lang-essentials

All versions of package jsgui-lang-essentials are vulnerable to Prototype Pollution due to allowing all Object attributes to be altered, including their magical attributes such as proto, constructor and prototype...

CVE-2022-25301

All versions of package jsgui-lang-essentials are vulnerable to Prototype Pollution due to allowing all Object attributes to be altered, including their magical attributes such as proto, constructor and prototype...

CVE-2022-25301

All versions of package jsgui-lang-essentials are vulnerable to Prototype Pollution due to allowing all Object attributes to be altered, including their magical attributes such as proto, constructor and prototype...

CVE-2022-25301

All versions of package jsgui-lang-essentials are vulnerable to Prototype Pollution due to allowing all Object attributes to be altered, including their magical attributes such as proto, constructor and prototype...

PT-2022-17197

Name of the Vulnerable Software and Affected Versions jsgui-lang-essentials affected versions not specified Description The issue allows alteration of all Object attributes, including magical attributes such as proto, constructor, and prototype, leading to Prototype Pollution. Recommendations At...