EAP: XXE issue in TransformerFactory

It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks, or read files from the server where EAP is deployed...

The vulnerability of the microprogramming software of the modular controller for the automation of transformer substations of Schneider Electric Easergy T300 (HU250) is related to the use of a less secure encryption algorithm. This allows a hacker to obtain the password.

The vulnerability of the microprogramming software of the modular controller for the automation of transformer substations of Schneider Electric Easergy T300 HU250 is related to the use of a less secure encryption algorithm. Exploiting this vulnerability could allow an attacker operating remotely...

The vulnerability of the microprogrammed software of the modular controller for the automation of transformer substations of Schneider Electric Easergy T300 (HU250) – related to uncontrolled resource consumption – allows a intruder to trigger a maintenance failure.

The vulnerability of the microprogrammed control module software for Schneider Electric Easergy T300 HU250 for transformer substations automation involves an uncontrolled consumption of resources. Exploiting this vulnerability could allow a malicious actor to cause malfunctions in the system due ...

The vulnerability of the microprogrammed control module software for Schneider Electric Easergy T300 (HU250) automation systems, related to the use of vulnerable external software, allows attackers to carry out various attacks on these components.

The vulnerability of the microprogramming software of the modular controller for the automation of transformer substations of Schneider Electric Easergy T300 HU250 is related to the use of a vulnerable external software. Exploiting this vulnerability allows a malicious actor to carry out various...

The vulnerability of the microprogrammed control module software for Schneider Electric Easergy T300 (HU250) automation systems for transformer substations involves insecure management of privileges. This allows attackers to escalate their privileges and perform arbitrary file writing and deletion operations on the device.

The vulnerability of the microprogrammed control module software for Schneider Electric Easergy T300 HU250 automation systems for transformer substations is related to insecure privilege management. Exploiting this vulnerability allows an attacker to escalate their privileges and perform arbitrar...

The vulnerability of the microprogrammed control module software for Schneider Electric Easergy T300 (HU250) automation systems for transformer substations, related to the manipulation of inter-site requests, allows a perpetrator to execute malicious commands under the identity of an authorized user.

The vulnerability of the microprogrammed control module software for automation of transformer substations in Schneider Electric Easergy T300 HU250 is related to the manipulation of inter-site requests. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute malicio...

The vulnerability of the microprogrammed control module software for Schneider Electric Easergy T300 (HU250) automation systems in transformer substations stems from the lack of protection for operational data. This allows a malicious individual to compromise the closed keys used by the device.

The vulnerability of the microprogrammed control module software for Schneider Electric Easergy T300 HU250 automation systems in transformer substations is related to the lack of protection for operational data. Exploiting this vulnerability allows a malicious actor to compromise the closed keys...

The vulnerability of the microprogrammed control module software for Schneider Electric Easergy T300 (HU250) automation systems for transformer substations lies in the improper limitation on the number of unsuccessful authentication attempts. This allows a perpetrator to gain full access.

The vulnerability of the microprogrammed control module software for automation of transformer substations in Schneider Electric Easergy T300 HU250 is related to an improper limitation on the number of unsuccessful authentication attempts. Exploiting this vulnerability can allow a malicious actor...

Prototype pollution in class-transformer

class-transformer through 0.2.3 is vulnerable to Prototype Pollution. The 'classToPlainFromExist' function could be tricked into adding or modifying properties of 'Object.prototype' using a 'proto' payload...

@3volutions/welle7.lib (1.0.1), @acathur/koa-decorator-ts (>=2.7.0, <=2.7.4) +1164 more potentially affected by CVE-2020-7637 via class-transformer (>=0.1.3, <=0.2.3)

class-transformer NPM version =0.1.3, =2.7.0, =1.0.0, =0.1.0, =0.0.4, =0.0.1, =1.0.1, =0.0.1, =1.3.0-next.2, =1.2.0, =1.0.1, =0.0.1, =0.0.1, =0.0.9, =0.0.18 and more Source cves: CVE-2020-7637 Source advisory: OSV:GHSA-6GP3-H3JJ-PRX4...

GHSA-6GP3-H3JJ-PRX4 Prototype pollution in class-transformer

class-transformer through 0.2.3 is vulnerable to Prototype Pollution. The 'classToPlainFromExist' function could be tricked into adding or modifying properties of 'Object.prototype' using a 'proto' payload...

Prototype Pollution

class-transformer is vulnerable to prototype pollution. The vulnerability exists as proto payload could be introduced into the classToPlainFromExist function...

class-transformer input validation error vulnerability

class-transformer is a package that can transform/serialize/deserialize JavaScript objects to class constructors. An input validation error vulnerability exists in class-transformer. The vulnerability stems from a networked system or product that does not properly validate input data. No details ...

CVE-2020-7637

class-transformer before 0.3.1 allow attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying properties of Object.prototype using a proto payload...

CVE-2020-7637

class-transformer before 0.3.1 allow attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying properties of Object.prototype using a proto payload...

CVE-2020-7637

class-transformer before 0.3.1 allow attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying properties of Object.prototype using a proto payload...

Design/Logic Flaw

class-transformer before 0.3.1 allow attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying properties of Object.prototype using a proto payload...

CVE-2020-7637

class-transformer before 0.3.1 allow attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying properties of Object.prototype using a proto payload...

CVE-2020-7637

CVE-2020-7637 affects class-transformer versions prior to 0.3.1. The vulnerability stems from classToPlainFromExist allowing a proto payload to pollute Object.prototype, enabling attacker-controlled modification of object properties. Impact is described as prototype pollution; upstream fixes requ...

CVE-2020-7637

class-transformer before 0.3.1 allow attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying properties of Object.prototype using a proto payload...