CVE-2022-25878 Prototype Pollution

The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption...

CVE-2022-25878

The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption...

@agconnect/database (>=1.1.0, <=1.3.2), @ardenthq/sdk-egld (>=1.0.0, <=1.3.1) +124 more potentially affected by CVE-2022-25878 via protobufjs (>=6.10.0, <=6.10.2)

protobufjs NPM version =6.10.0, =1.1.0, =1.0.0, =3.0.0-next.36, =3.0.0-next.36, =3.0.0-next.36, =3.0.0-next.36, =0.0.0, =0.0.0-beta.20200917165907, =0.0.0-beta.20200724145337, =0.0.0-beta.20200724123546, =0.0.0-beta.20200724123546, =0.0.0-beta.20210111150545 and more Source cves: CVE-2022-25878...

@0cfg/rpc-common (>=0.0.1, <=0.1.3), @0cfg/rpc-node (>=0.0.1, <=0.1.3) +299 more potentially affected by CVE-2022-25878 via protobufjs (>=6.11.1, <=6.11.2)

protobufjs NPM version =6.11.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =0.0.2, =0.1.0, =0.4.0, =4.0.0, =1.0.0, =0.4.21, =1.0.3-next.0, =0.1.0-alpha.32, =0.1.0-alpha.0, =0.4.115, =0.5.167 and more Source cves: CVE-2022-25878 Source advisory: MEND:CVE-2022-25878...

CVE-2022-25878

CVE-2022-25878 affects protobufjs with Prototype Pollution (Object.prototype) via untrusted input to util.setProperty, ReflectionObject.setParsedOption, or .proto parsing. Connected docs show a related entry (CVE-2023-36665) describing protobufjs 6.10.0–7.x before 7.2.5 as vulnerable to prototype...

CVE-2022-25878 Prototype Pollution

The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption...

CVE-2022-25878

The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption...

PT-2022-17583

Name of the Vulnerable Software and Affected Versions protobufjs versions prior to 6.11.3 Description The issue concerns a Prototype Pollution vulnerability that can allow an attacker to add or modify properties of the Object.prototype. This can occur in two main ways: by providing untrusted user...

CVE-2022-25878: Improperly Controlled Modification of Object Prototype Attributes

The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption...

@agconnect/database (>=1.1.0, <=1.3.2), @ardenthq/sdk-egld (>=1.0.0, <=1.3.1) +124 more potentially affected by CVE-2022-25878 via protobufjs (>=6.10.0, <=6.10.2)

protobufjs NPM version =6.10.0, =1.1.0, =1.0.0, =3.0.0-next.36, =3.0.0-next.36, =3.0.0-next.36, =3.0.0-next.36, =0.0.0, =0.0.0-beta.20200917165907, =0.0.0-beta.20200724145337, =0.0.0-beta.20200724123546, =0.0.0-beta.20200724123546, =0.0.0-beta.20210111150545 and more Source cves: CVE-2022-25878...

@0cfg/rpc-common (>=0.0.1, <=0.1.3), @0cfg/rpc-node (>=0.0.1, <=0.1.3) +299 more potentially affected by CVE-2022-25878 via protobufjs (>=6.11.1, <=6.11.2)

protobufjs NPM version =6.11.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =0.0.2, =0.1.0, =0.4.0, =4.0.0, =1.0.0, =0.4.21, =1.0.3-next.0, =0.1.0-alpha.32, =0.1.0-alpha.0, =0.4.115, =0.5.167 and more Source cves: CVE-2022-25878 Source advisory: SNYK:JS-PROTOBUFJS-2441248...

Prototype Pollution

Overview protobufjs is a protocol buffer for JavaScript & TypeScript. Affected versions of this package are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user...

GHSA-4GPV-CVMQ-6526 Denial of Service in protobufjs

Withdrawn: Duplicate of GHSA-762f-c2wg-m8c8...

Denial of Service in protobufjs

Withdrawn: Duplicate of GHSA-762f-c2wg-m8c8...

GHSA-762F-C2WG-M8C8 Denial of Service in protobufjs

Versions of protobufjs before 5.0.3 and 6.8.6 are vulnerable to a regular expression denial of service when parsing crafted invalid .proto files. Recommendation Update to version 5.0.3, 6.8.6 or later...

@angular/bazel (>=5.0.0-beta.5, <=7.0.0), @atomist/sample-sdm (>=0.5.1-atomist-update-latest-1540938130032.20181101043939, <=0.5.1-master.20181101044648) +123 more potentially affected by CVE-2018-3738 via protobufjs (>=5.0.0, <=5.0.2)

protobufjs NPM version =5.0.0, =5.0.0-beta.5, =0.5.1-atomist-update-latest-1540938130032.20181101043939, =0.2.2-20180615211533, =0.2.4-20180621213746, =0.1.0-20180815155955, =0.0.6, =1.2.1, =1.0.2, =5.0.1, =1.3.1, =0.0.7, =1.3.0, =0.0.1, =0.0.1, =0.0.12 and more Source cves: CVE-2018-3738 Source...

@angular/bazel (>=5.0.0-beta.5, <=7.0.0), @atomist/sample-sdm (>=0.5.1-atomist-update-latest-1540938130032.20181101043939, <=0.5.1-master.20181101044648) +123 more potentially affected by CVE-2018-3738 via protobufjs (>=5.0.0, <=5.0.2)

protobufjs NPM version =5.0.0, =5.0.0-beta.5, =0.5.1-atomist-update-latest-1540938130032.20181101043939, =0.2.2-20180615211533, =0.2.4-20180621213746, =0.1.0-20180815155955, =0.0.6, =1.2.1, =1.0.2, =5.0.1, =1.3.1, =0.0.7, =1.3.0, =0.0.1, =0.0.1, =0.0.12 and more Source cves: CVE-2018-3738 Source...

@accordproject/cicero-cli (>=0.2.48, <=0.3.16), @accordproject/cicero-common (>=0.2.50, <=0.2.54) +114 more potentially affected by CVE-2018-3738 via protobufjs (>=6.1.0, <=6.8.5)

protobufjs NPM version =6.1.0, =0.2.48, =0.2.50, =0.2.46, =0.2.46, =0.2.46, =0.0.37, =0.0.36, =0.0.37, =0.1.0, =1.0.0, =2.2.0 - @ibmblockchain/composer-playground 0.16.2 and more Source cves: CVE-2018-3738 Source advisory: OSV:GHSA-762F-C2WG-M8C8...

Denial of Service in protobufjs

Versions of protobufjs before 5.0.3 and 6.8.6 are vulnerable to a regular expression denial of service when parsing crafted invalid .proto files. Recommendation Update to version 5.0.3, 6.8.6 or later...

@accordproject/cicero-cli (>=0.2.48, <=0.3.16), @accordproject/cicero-common (>=0.2.50, <=0.2.54) +114 more potentially affected by CVE-2018-3738 via protobufjs (>=6.1.0, <=6.8.5)

protobufjs NPM version =6.1.0, =0.2.48, =0.2.50, =0.2.46, =0.2.46, =0.2.46, =0.0.37, =0.0.36, =0.0.37, =0.1.0, =1.0.0, =2.2.0 - @ibmblockchain/composer-playground 0.16.2 and more Source cves: CVE-2018-3738 Source advisory: GHSA-762F-C2WG-M8C8...