1543 matches found
Prototype Pollution in badopcode/nodash
Description ts-nodash is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: // poc.js var merge = require"ts-nodash".Merge const payload = JSON.parse'"proto":"polluted":"Yes! Its Polluted"'; var obj = console.log"Before : " + .polluted; mergeobj, payload;...
Qnap Systems Cross-Site Scripting Vulnerability in Multiple Products
Qnap Systems QNAP QTS is a Turbo NAS operating system from Qnap Systems, China. The system provides file storage, management, backup, multimedia applications and security monitoring, etc. QNAP Systems QUTS Hero is a NAS operating system for file management from QNAP Systems, China. The system...
Microsoft Visual Studio Code Code Injection Vulnerability
Microsoft Visual Studio Code is an open source code editor from Microsoft Corporation USA. A code injection vulnerability exists in Microsoft Visual Studio Code. The following products and versions are affected:Visual Studio Code TS-Lint Extension...
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection. The injection point is located in line 45 in main entry of package in lib/process-promises.js. PoC var a =require"ts-process-promises"; a.exec"touch JHU",; Remediation There is no fixed version for ts-process-promises...
hltc-webapi-master (>=1.0.0, <=1.2.0), verda (>=0.1.0, <=1.2.1) potentially affected by CVE-2020-7784 via ts-process-promises (1.0.2)
ts-process-promises NPM version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on ts-process-promises and may be impacted: - hltc-webapi-master =1.0.0, =0.1.0, =1.2.1 Source cves: CVE-2020-7784 Source advisory: SNYK:JS-TSPROCESSPROMISES-1048334...
CentOS: Security Advisory for bpftool (CESA-2020:5023)
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
QNAP Systems TS-870 SQL Injection Vulnerability
QNAP Systems TS-870 is a NAS Network Attached Storage appliance from China Weilian QNAP Systems. A security vulnerability exists in the QNAP Systems TS-870 using firmware version 4.3.4.0486. An attacker could exploit the vulnerability to use LIMIT and retrieve data...
QNAP Systems TS-870 Command Injection Vulnerability (CNVD-2020-62934)
QNAP Systems TS-870 is a NAS Network Attached Storage appliance from China Weilian QNAP Systems. A command injection vulnerability exists in the UserName of the Music Station for the file upload feature in the QNAP Systems TS-870 using firmware version 4.3.4.0486. An attacker could exploit this...
QNAP Systems TS-870 Cross-Site Scripting Vulnerability (CNVD-2020-62488)
QNAP Systems TS-870 is a NAS Network Attached Storage appliance from China Weilian QNAP Systems. A cross-site scripting vulnerability exists in the QNAP Systems TS-870 using firmware version 4.3.4.0486. The vulnerability stems from a lack of proper validation of client data by the WEB application...
QNAP Systems TS-870 Cross-Site Scripting Vulnerability
QNAP Systems TS-870 is a NAS Network Attached Storage appliance from China Weilian QNAP Systems. A cross-site scripting vulnerability exists in PhotoStation Filenames in the QNAP Systems TS-870 using firmware version 4.3.4.0486. The vulnerability stems from a lack of proper validation of client...
QNAP Systems TS-870 Cross-Site Scripting Vulnerability
QNAP Systems TS-870 is a NAS Network Attached Storage appliance from China Weilian QNAP Systems. A cross-site scripting vulnerability exists in the QNAP Systems TS-870 using firmware version 4.3.4.0486. The vulnerability stems from a lack of proper validation of client data by the WEB application...
Prototype Pollution
ts-dot-prop is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...
ts-ingenierie.com Cross Site Scripting vulnerability OBB-1380272
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
QNAP Systems TS-870 Cross-Site Request Forgery Vulnerability
QNAP Systems TS-870 is a NAS Network Attached Storage appliance from China Weilian QNAP Systems. A cross-site request forgery vulnerability exists in the QNAP Systems TS-870 using firmware version 4.3.4.0486. The vulnerability stems from a WEB application that does not adequately validate that a...
openSUSE Security Update : libmediainfo / mediainfo (openSUSE-2020-1390)
This update for libmediainfo, mediainfo fixes the following issues : libmediainfo was updated to version 20.08 : Added : - MPEG-H 3D Audio full featured support group presets, switch groups, groups, signal groups - MP4/MOV: support of more metadata locations - JSON and XML outputs: authorize...
Node.js third-party modules: [ts-dot-prop] Prototype Pollution
I would like to report a Prototype Pollution vulnerability in ts-dot-prop. It allows an attacker to inject properties on Object.prototype. Module module name: ts-dot-prop version: 1.4.0 npm page: https://www.npmjs.com/package/ts-dot-prop Module Description TypeScript utility to transform nested...
Denial of Service in grpc-ts-health-check
Versions of grpc-ts-health-check prior to 2.0.0 are vulnerable to Denial of Service. The package exposes an API endpoint that may allow attackers to set the service's health status to failing. This can lead to Denial of Service as Kubernetes blocks traffic to services with a failing status...
GHSA-M86M-5M44-PC93 Denial of Service in grpc-ts-health-check
Versions of grpc-ts-health-check prior to 2.0.0 are vulnerable to Denial of Service. The package exposes an API endpoint that may allow attackers to set the service's health status to failing. This can lead to Denial of Service as Kubernetes blocks traffic to services with a failing status...
ts-location.fr Cross Site Scripting vulnerability OBB-1237712
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Royal TS Authentication Bypass Vulnerability
Royal TS is a remote management solution from the Royal Apps team. The solution offers secure connection sharing, file synchronization, and more. A security vulnerability exists in versions prior to Royal TS 5. An attacker can exploit this vulnerability with the help of brute force method to bypa...