129837 matches found
Improper Input Sanitization
alt-design/alt-redirect is vulnerable to improper input sanitization. The vulnerability is due to the addon failing to consistently strip query-string parameters—such as case-varied, encoded, or duplicate keys—which allows an attacker to bypass sanitization and potentially perform cache poisoning...
PT-2025-48543
Name of the Vulnerable Software and Affected Versions Express.js versions prior to 5.2.0 Express.js versions prior to 4.22.0 Description Express.js, a minimalist web framework for Node.js, is affected by an issue where the request.query object inherits all object prototype properties when using t...
Security Bulletin: Astronomer with IBM is vulnerable to prototype pollution due to the fast-redact package (CVE-2025-57319)
Summary Fast-redact is used by Astronomer with IBM as part of object redaction functionality. Vulnerability Details CVEID:CVE-2025-57319 DESCRIPTION: fast-redact is a package that provides do very fast object redaction. A Prototype Pollution vulnerability in the nestedRestore function of...
SUSE-SU-2025:21158-1 Security update for himmelblau
This update for himmelblau fixes the following issues: - Update to version 0.9.23+git.0.9776141: CVE-2025-59044: Fixed GID collision of same-name groups allowing privilege escalation bsc1250687 depsrust: bump the all-cargo-updates group CVE-2025-58160: tracing-subscriber: Fixed log pollution...
OPENSUSE-SU-2025-20114-1 Security update for himmelblau
This update for himmelblau fixes the following issues: - Update to version 0.9.23+git.0.9776141: CVE-2025-59044: Fixed GID collision of same-name groups allowing privilege escalation bsc1250687 depsrust: bump the all-cargo-updates group CVE-2025-58160: tracing-subscriber: Fixed log pollution...
OPENSUSE-SU-2025:20114-1 Security update for himmelblau
This update for himmelblau fixes the following issues: - Update to version 0.9.23+git.0.9776141: CVE-2025-59044: Fixed GID collision of same-name groups allowing privilege escalation bsc1250687 depsrust: bump the all-cargo-updates group CVE-2025-58160: tracing-subscriber: Fixed log pollution...
Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service and code injection [CVE-2025-57350]
Summary Node.js module csvtojson is used by IBM App Connect Enterprise Certified Container for processing CSV data. IBM App Connect Enterprise Certified Container DesignerAuthoring, IntegrationRuntime and IntergrationServer operands are vulnerable to denial of service and code injection. This...
Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to different node modules (CVE-2025-57350,CVE-2025-56200 & CVE-2025-64118)
Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to multiple vulnerabilities due to csvtojson, node-tar packages and validator modules CVE-2025-57350,CVE-2025-56200 &...
Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java and Node.js
Summary There are multiple vulnerabilities in Java and Node.js used by IBM Transformation Advisor. Vulnerability Details CVEID:CVE-2025-57353 DESCRIPTION: The Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype pollution vulnerability. Due to insufficient...
CVE-2025-13204
npm package expr-eval is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue. Mitigation Mitigation for this issue is eithe...
CVE-2025-64718
js-yaml is a JavaScript YAML parser and dumper. In js-yaml 4.1.0 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution proto. All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml...
Security Bulletin: Multiple Vulnerabilities in IBM Decision Optimization for Cloud Pak for Data (CVE-2025-57350, CVE-2025-53057 and CVE-2025-53066)
Summary Multiple Vulnerabilities were addressed in IBM Decision Optimization for Cloud Pak for Data version 5.3.0 Vulnerability Details CVEID:CVE-2025-57350 DESCRIPTION: The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype...
Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale if the HDFS layer is enabled are now addressed in 5.2.3.4 (CVE-2025-55163, CVE-2021-4264, CVE-2025-53864, CVE-2025-48924, CVE-2024-6484, CVE-2024-13009)
Summary The following vulnerabilities, which may affect IBM Storage Scale when the HDFS layer is enabled and could lead to weaker-than-expected security, have been addressed in Storage Scale version 5.2.3.4 or later: CVE-2025-55163, CVE-2021-4264, CVE-2025-53864, CVE-2025-48924, CVE-2024-6484, an...
TencentOS Server 3: nodejs-nodemon (TSSA-2022:0261)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0261 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...
Security Bulletin: Astronomer with IBM is vulnerable to HTTP parameter pollution due to the form-data package (CVE-2025-7783)
Summary Form-data is used by Astronomer with IBM as part of the HTTP processing functionality. Vulnerability Details CVEID:CVE-2025-7783 DESCRIPTION: Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution HPP. This vulnerability is associated with program...
Prototype Pollution
rollbar is vulnerable to Prototype Pollution.The vulnerability is due to improper handling of user-supplied input in the utility.set function, which allows an attacker to inject malicious properties into Object.prototype through a crafted payload...
Prototype Pollution
counterpart is vulnerable to Prototype Pollution. The vulnerability is due to insufficient sanitization of user-controlled translation keys, which allows an attacker to supply crafted keys containing prototype chain elements to inject arbitrary properties into the JavaScript Object prototype,...
Prototype Pollution
@hapi/pez is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of multipart payloads, allowing an attacker to craft a part whose content becomes the payload object's prototype, which enables bypassing validation rules or causing exceptions when accessing the request...
GHSA-8GW3-RXH4-V6JX expr-eval vulnerable to Prototype Pollution
npm package expr-eval is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue...
expr-eval vulnerable to Prototype Pollution
npm package expr-eval is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue...