RHEL 7 : python-XStatic-jQuery (RHSA-2020:5581)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:5581 advisory. python-XStatic-jQuery is the jQuery javascript library packaged for Python's setuptools Security Fixes: Prototype pollution in object's prototype...

jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection

A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the extend function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with...

bootstrap: XSS in the affix configuration target property

A flaw was found in Bootstrap, where it is vulnerable to Cross-site scripting caused by improper validation of user-supplied input by the affix configuration target property. This flaw allows a remote attacker to execute a script in a victim's Web browser within the security context of the hostin...

PT-2020-17011

Name of the Vulnerable Software and Affected Versions js-data versions prior to 3.0.10 Description The issue concerns Prototype Pollution via the deepFillIn function. This allows for potential manipulation of object properties. No information is provided about the estimated number of affected...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution. The vulnerability is in the set function. PoC const decal = require'decal'; console.log'Before:', .polluted; decal.set, "proto.polluted", "1337"; console.log'After:', .polluted; Details Prototype Pollution is a...

Information disclosure

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property e.g., proto can be copied during a merge or clone operation...

CVE-2020-35149: Undefined Security Weakness

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property e.g., proto can be copied during a merge or clone operation...

Buffer Overflow

MuPDF is vulnerable to buffer overflow. This vulnerability allow attackers to execute arbitrary code via a crafted PDF file. This occurs with a large BDC property name that overflows the allocated size of a display list node...

Healthcare 2021: Cyberattacks to Center on COVID-19 Spying, Patient Data

Sophisticated cybercriminals have been trying to steal COVID-19 vaccine research – and researchers say there’s more of that to come going into 2021. Intellectual property theft will join ransomware, cloud-stored patient data theft and advanced phishing efforts as the main hallmarks of...

Unauthorized Access Vulnerability in Zijin Bridge RealHistorian Cross-Platform Real-Time Database

RealHistorian cross-platform real-time database is independently developed by Zijinqiao, with completely independent intellectual property rights, and has been successfully applied in many national key fields, such as civil ships and military industry. There is an unauthorized access vulnerabilit...

November spam roundup: Stalkers, property tips, porn, stern words and PayPal

Today were rounding up some of the interesting pieces of spam currently in circulation, taking in everything from housing deals to mysteriously free slices of cash. You may have seen some of these already. Hopefully we can help make up your mind about whatevers lurking in your mailbox. A full hou...

Systeminformation Operating System Command Injection Vulnerability

systeminformation is an Npm software library for individual developers individual developers to obtain operating system information. A security vulnerability exists in systeminformation version 4.30.2, which can be exploited by an attacker to override properties and functions of an object, leadin...

PT-2020-19787

Name of the Vulnerable Software and Affected Versions systeminformation versions prior to 4.30.2 Description The issue allows an attacker to overwrite the properties and functions of an object, potentially leading to the execution of OS commands. This is due to a flaw in the systeminformation...

CVE-2020-7778: Improper Neutralization of Special Elements used in an OS Command

This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands...

Prototype Pollution

Overview merge is a library that allows you to merge multiple objects into one, optionally creating a new cloned object. Similar to the jQuery.extend but more flexible. Works in Node.js and the browser. Affected versions of this package are vulnerable to Prototype Pollution via recursiveMerge...

Prototype Pollution

Overview asciitable.js is a Generate a ASCII Table from a bidimensional array of strings Affected versions of this package are vulnerable to Prototype Pollution via the main function. POC var a = require"asciitable.js"; var b = JSON.parse'"proto":"test":123'; a,b; console.log.test Details Prototy...

CVE-2020-7770: Improperly Controlled Modification of Object Prototype Attributes

This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution...

PT-2020-21399

Name of the Vulnerable Software and Affected Versions json-logic-js versions prior to 2.0.0 Description The issue allows a malicious user to modify the prototype of Object through the method property name in the operation method. This can lead to modification of any existing property that will...

The vulnerability of the Logging component of the Oracle Hospitality OPERA 5 Property Services software solution allows a hacker to gain full control over the application.

The vulnerability of the Logging component in the Oracle Hospitality OPERA 5 Property Services software solution relates to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to gain full control over the application through the HTTP network protocol...

rajasthanpropertypoint.co.in Cross Site Scripting vulnerability OBB-1496467

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...