Prototype Pollution

Overview ts-deepmerge is an a deep merge function that automatically infers the return type based on your input, without mutating the source objects. Affected versions of this package are vulnerable to Prototype Pollution due to missing sanitization of the merge function. PoC: js var tsDeepmerge ...

CVE-2021-23397

All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main merge function. Maintainer suggests using @generates/merger instead...

CVE-2021-23397

All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main merge function. Maintainer suggests using @generates/merger instead...

Information disclosure

All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main merge function. Maintainer suggests using @generates/merger instead...

CVE-2021-23397 Prototype Pollution

All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main merge function. Maintainer suggests using @generates/merger instead...

CVE-2021-23397

All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main merge function. Maintainer suggests using @generates/merger instead...

CVE-2021-23397

CVE-2021-23397 affects all versions of @ianwalter/merge and enables Prototype Pollution via the main merge function. Root cause: unsafe recursive merge can copy a proto property from a polluted source, enabling prototype contamination and potential remote code execution or DoS, as described in co...

CVE-2021-23397

All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main merge function. Maintainer suggests using @generates/merger instead...

CVE-2021-23397: Improperly Controlled Modification of Object Prototype Attributes

All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main merge function. Maintainer suggests using @generates/merger instead...

merge 安全漏洞

merge is a tool for recursively merging JavaScript objects. A security vulnerability exists in @ianwalter/merge, which stems from the package's susceptibility to prototype contamination via the main merge function...

PT-2022-9397 · Npm · @Ianwalter/Merge +1

Name of the Vulnerable Software and Affected Versions: @ianwalter/merge versions all Description: The issue concerns Prototype Pollution via the main merge function. The maintainer suggests using @generates/merger instead, as @ianwalter/merge is deprecated. Recommendations: For all versions,...

Fedora: Security Advisory for git-octopus (FEDORA-2022-3e1ade35db)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security Bulletin: CVE-2020-8203

Summary Node.js lodash module is vulnerable to a denial of service, caused by a prototype pollution attack. A remote attacker could exploit this vulnerability using the merge, mergeWith, and defaultsDeep functions to inject properties onto Object.prototype to crash the server and possibly execute...

[SECURITY] Fedora 36 Update: golang-github-evanphx-json-patch-5.5.0-3.fc36

Jsonpatch is a library which provides functionallity for both applying RFC6902 JSON patches against documents, as well as for calculating & applying RFC7396 JSON merge patches...

GSD-2022-1003731 bfq: Update cgroup information before merging bio

bfq: Update cgroup information before merging bio This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.198 by commit...

GSD-2022-1003019 bfq: Update cgroup information before merging bio

bfq: Update cgroup information before merging bio This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.14 by commit...

Prototype Pollution

Overview @loopback/rest is a The REST API package for loopback-next Affected versions of this package are vulnerable to Prototype Pollution via JSON payloads containing constructor. Details Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to...

Malicious code in @msmg/vue-merge-data-qa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 148b5fef898978c5cca2c43755dc356409fd64fed11c1c4104fc0ba40a586ac5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in uxpin-merge-ms-fabric (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6770965c2fb106f9c16c4bba9ca9724909591f0a1e2f43d34a55f322aca56f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6883 Malicious code in uxpin-merge-ms-fabric (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6770965c2fb106f9c16c4bba9ca9724909591f0a1e2f43d34a55f322aca56f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...