merge-deep 代码问题漏洞

merge-deep is an open source tool . It is used to recursively merge values in JavaScript objects. A code issue vulnerability exists in Nerge-deep2 that stems from the product's susceptibility to prototype contamination by the mergeDeep function. The following products and versions are affected:...

CVE-2021-23700: Improperly Controlled Modification of Object Prototype Attributes

All versions of package merge-deep2 are vulnerable to Prototype Pollution via the mergeDeep function...

GitLab 访问控制错误漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features.GitLab CE/EE is vulnerable to an access control error that stems from the...

Sandbox Bypass

Overview realms-shim is a shim implementation of the Realm API Proposal. Affected versions of this package are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector. PoC javascript import Realm from 'realms-shim' let realm = Realm.makeRootRealm; realm.evaluate function test try tes...

Sandbox Bypass

Overview realms-shim is a shim implementation of the Realm API Proposal. Affected versions of this package are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector. PoC javascript import Realm from 'realms-shim' let realm = Realm.makeRootRealm; try realm.evaluate...

Prototype Pollution

Overview @fabiocaccamo/utils.js is a JavaScript utils for lazy devs. Affected versions of this package are vulnerable to Prototype Pollution via the set and method, which merges the path and value parameters based on the key:value. PoC const utils = require"@fabiocaccamo/utils.js"; const obj = ;...

GHSA-VPF5-82C8-9V36 Prototype Pollution in algoliasearch-helper

The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters.parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the...

Prototype Pollution in algoliasearch-helper

The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters.parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the...

CVE-2021-23433

The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters.parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the...

Design/Logic Flaw

The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters.parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the...

CVE-2021-23433

The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters.parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the...

CVE-2021-23433: Improperly Controlled Modification of Object Prototype Attributes

The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters.parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the...

PT-2021-15521

Name of the Vulnerable Software and Affected Versions algoliasearch-helper versions prior to 3.6.2 Description The issue arises from the use of the merge function in src/SearchParameters/index.js, specifically in the SearchParameters. parseNumbers function, without protection against prototype...

kernel security, bug fix, and enhancement update

4.18.0-348.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x...

Security update for drbd-utils (low)

openSUSE Security Update: Security update for drbd-utils Announcement ID: openSUSE-SU-2021:3665-1 Rating: low References: 1029961 1185132 1189363 SLE-21057 Affected Products: openSUSE Leap 15.3 An update that contains security fixes and contains one feature can now be installed. Description: This...

httpd: Unexpected URL matching with 'MergeSlashes OFF'

A flaw was found in Apache httpd. A possible regression from an earlier security fix broke behavior of MergeSlashes. The highest threat from this vulnerability is to data integrity...

CVE-2021-39904

An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows a Merge Request creator to resolve discussions and apply suggestion...

CVE-2021-39904

An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows a Merge Request creator to resolve discussions and apply suggestion...

CVE-2021-39904

An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows a Merge Request creator to resolve discussions and apply suggestion...

Improper access control

An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows a Merge Request creator to resolve discussions and apply suggestion...