CVE-2020-7724

All versions of package tiny-conf are vulnerable to Prototype Pollution via the set function...

Design/Logic Flaw

All versions of package confucious are vulnerable to Prototype Pollution via the set function...

CVE-2020-7727

Affected software: the gedi package (JavaScript). Vulnerability: Prototype Pollution via the set function. Root cause: unsafe handling of object property paths in set, enabling pollution of Object.prototype under certain inputs. Impact (as stated in related advisories): potential for DoS or remot...

CVE-2020-7724

All versions of package tiny-conf are vulnerable to Prototype Pollution via the set function...

CVE-2020-7714 Prototype Pollution

All versions of package confucious are vulnerable to Prototype Pollution via the set function...

CVE-2020-7714

CVE-2020-7714 affects the npm package confucious via Prototype Pollution in the set function. Affected versions are reported as prior to 0.0.13 (PT-2020-19736), with Snyk listing up to 0.0.12; multiple sources reiterate vulnerability across versions. Root cause is unsafe merging / path-based assi...

CVE-2020-7716

CVE-2020-7716 affects the npm package deeps and is a prototype pollution vulnerability via the set function. Public sources describe affected versions as older than 1.4.6 (GHSA: all versions up to 1.4.5; PT-2020-19738 states prior to 1.4.6). Root cause: unsafe handling in object merging/set that ...

CVE-2020-7724: Improperly Controlled Modification of Object Prototype Attributes

All versions of package tiny-conf are vulnerable to Prototype Pollution via the set function...

CVE-2020-7716: Improperly Controlled Modification of Object Prototype Attributes

All versions of package deeps are vulnerable to Prototype Pollution via the set function...

PT-2020-19736 · Unknown · Confucious

Name of the Vulnerable Software and Affected Versions: confucious versions prior to 0.0.13 Description: The issue concerns Prototype Pollution via the set function. This allows for potential manipulation of object properties, which can lead to various security issues. Recommendations: For version...

PT-2020-19748 · Gedi · Gedi

Name of the Vulnerable Software and Affected Versions: gedi versions prior to 1.6.4 Description: The issue concerns Prototype Pollution via the set function. This allows for potential manipulation of object properties, which can lead to various security issues. Recommendations: For versions prior...

CVE-2020-7727: Improperly Controlled Modification of Object Prototype Attributes

All versions of package gedi are vulnerable to Prototype Pollution via the set function...

PT-2020-19738 · Deeps · Deeps

Name of the Vulnerable Software and Affected Versions: deeps versions prior to 1.4.6 Description: The issue concerns Prototype Pollution via the set function. This allows for potential manipulation of object properties, which could lead to various security issues. Recommendations: For versions...

CVE-2020-7714: Improperly Controlled Modification of Object Prototype Attributes

All versions of package confucious are vulnerable to Prototype Pollution via the set function...

PT-2020-19745 · Tiny-Conf · Tiny-Conf

Name of the Vulnerable Software and Affected Versions: tiny-conf versions prior to 1.1.1 is not mentioned, however, all versions up to and including 1.1.0 are vulnerable, so: tiny-conf versions up to and including 1.1.0 Description: The issue is related to Prototype Pollution via the set function...

CVE-2020-7708

The package irrelon-path before 4.7.0; the package @irrelon/path before 4.7.0 are vulnerable to Prototype Pollution via the set, unSet, pushVal and pullVal functions...

Prototype Pollution

Overview jsonpointer is a Simple JSON Addressing. Affected versions of this package are vulnerable to Prototype Pollution via the set function. POC by NerdJS const jsonpointer = require'jsonpointer'; jsonpointer.set, '/proto/polluted', true; console.logpolluted; Details Prototype Pollution is a...

Prototype Pollution

Overview gedi is an An evented data API Affected versions of this package are vulnerable to Prototype Pollution via the set function. POC const gedi = require'gedi'; try gedi.set'proto/polluted', true; catche console.logpolluted; Details Prototype Pollution is a vulnerability affecting JavaScript...

Prototype Pollution

Overview tiny-conf is a Node.js configuration with files, environment variables, command-line arguments, ... pluggable architecture in order to work in the browser & server-side Affected versions of this package are vulnerable to Prototype Pollution via the set function. POC const tinyConf =...

Prototype Pollution

Overview safetydance is an Exception safety in node.js Affected versions of this package are vulnerable to Prototype Pollution via the set function. POC: const safetydance = require'safetydance'; safetydance.set, 'proto.polluted', true; console.logpolluted; //true Details Prototype Pollution is a...