DEBIAN-CVE-2020-10289

Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an action message is processed to be sent, and allows for the creation of Python objects. Through this flaw in the ROS core package of actionlib...

CVE-2020-10289

Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an action message is processed to be sent, and allows for the creation of Python objects. Through this flaw in the ROS core package of actionlib...

CVE-2020-10289

Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an action message is processed to be sent, and allows for the creation of Python objects. Through this flaw in the ROS core package of actionlib...

CVE-2020-10289 RVD#2401: Use of unsafe yaml load, ./src/actionlib/tools/library.py:132

Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an action message is processed to be sent, and allows for the creation of Python objects. Through this flaw in the ROS core package of actionlib...

wildfly: unsafe deserialization in Wildfly Enterprise Java Beans

A flaw was found in Wildfly. A remote deserialization attack is possible in the Enterprise Application Beans EJB due to lack of validation/filtering capabilities in wildfly. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availablity...

ShopXO Command Injection Vulnerability

ShopXO is an open source enterprise-level open source e-commerce system. A command injection vulnerability exists in ShopXO v1.8.1. The vulnerability stems from the user input structure to execute the command process, the network system or product fails to correctly filter the special characters,...

Prototype Pollution

Overview datatables.net is a DataTables for jQuery Affected versions of this package are vulnerable to Prototype Pollution. POC The following two files are required to be served by an HTTP server. poc.html: $.fn.dataTable.ext.internal.fnSetObjectDataFn'proto.foo','polluted'; document.write'foo : ...

Prototype Pollution

Overview jsonpointer is a Simple JSON Addressing. Affected versions of this package are vulnerable to Prototype Pollution via the set function. POC by NerdJS const jsonpointer = require'jsonpointer'; jsonpointer.set, '/proto/polluted', true; console.logpolluted; Details Prototype Pollution is a...

Prototype Pollution

Overview gedi is an An evented data API Affected versions of this package are vulnerable to Prototype Pollution via the set function. POC const gedi = require'gedi'; try gedi.set'proto/polluted', true; catche console.logpolluted; Details Prototype Pollution is a vulnerability affecting JavaScript...

Prototype Pollution

Overview connie-lang is a the configuration language for connie. Affected versions of this package are vulnerable to Prototype Pollution in the configuration language library used by connie. POC const connie = require'connie'; const fs = require'fs'; fs.writeFileSync'test.json', "proto":...

Prototype Pollution

Overview property-expr is a tiny util for getting and setting deep object props safely Affected versions of this package are vulnerable to Prototype Pollution via the setter function. POC var expr = require'property-expr'; expr.setter'proto.polluted', true; console.logpolluted; // true Details...

wildfly: unsafe deserialization in Wildfly Enterprise Java Beans

A flaw was found in Wildfly. A remote deserialization attack is possible in the Enterprise Application Beans EJB due to lack of validation/filtering capabilities in wildfly. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availablity...

wildfly: unsafe deserialization in Wildfly Enterprise Java Beans

A flaw was found in Wildfly. A remote deserialization attack is possible in the Enterprise Application Beans EJB due to lack of validation/filtering capabilities in wildfly. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availablity...

Prototype Pollution

Overview Templ8 is a JavaScript Client/ Server Template Engine Affected versions of this package are vulnerable to Prototype Pollution via the parse function. POC const Templ8 = require'Templ8'; var tpl = new Templ8 'proto.polluted=true' ; tpl.parse; console.logpolluted //true Details Prototype...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.3.2 (RHSA-2020:3462)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3462 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release o...

UBUNTU-CVE-2020-14350

It was found that some PostgreSQL extensions did not use searchpath safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affect...

Prototype Pollution

Overview safetydance is an Exception safety in node.js Affected versions of this package are vulnerable to Prototype Pollution via the set function. POC: const safetydance = require'safetydance'; safetydance.set, 'proto.polluted', true; console.logpolluted; //true Details Prototype Pollution is a...

Prototype Pollution

Overview promisehelpers is a Promise helper functions Affected versions of this package are vulnerable to Prototype Pollution via the insert function. POC: const promisehelpers = require'promisehelpers'; var obj = ; promisehelpers.insert'proto', 'polluted', trueobj; console.logpolluted; // true...

Prototype Pollution

Overview nodee-utils is a set of useful helpers Affected versions of this package are vulnerable to Prototype Pollution via the deepSet function. POC: const object = require'nodee-utils'; object.deepSet, 'proto.polluted', true; console.logpolluted; Details Prototype Pollution is a vulnerability...

Prototype Pollution

Overview node-oojs is an Object Oriented JavaScript Affected versions of this package are vulnerable to Prototype Pollution via the setPath function. POC: require'node-oojs'; oojs.setPath'proto.polluted':true; console.logpolluted; Details Prototype Pollution is a vulnerability affecting JavaScrip...