PT-2021-25726

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.53 Description A potential issue exists where fences may be leaked on merge failure. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

PT-2021-25622

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 4.9 through 5.13.4 Description: A potential issue exists where fences may be leaked on merge failure. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions 4.9...

PT-2021-25851

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.199 Description A potential issue exists where fences may be leaked on merge failure. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

PT-2021-25788

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.135 Description A potential issue exists where fences may be leaked on merge failure. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

PT-2021-29783

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.135 Description The issue is related to a potential security vulnerability in the dma-buf/sync file component. It has been noted that fences may leak on merge failure. The actual impact and attack plausibili...

SUSE: Security Advisory (SUSE-SU-2021:2555-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Prototype Pollution

Overview mootools is an a library for web development, with support for OOP. Affected versions of this package are vulnerable to Prototype Pollution. This is due to the ability to pass untrusted input to Object.merge PoC: require"mootools" Object.merge, JSON.parse""proto": "vulnerable": true"...

Prototype Pollution

Overview com.graphhopper:graphhopper-web-bundle is a GraphHopper routing engine as a web-service Affected versions of this package are vulnerable to Prototype Pollution. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or proto payload. P...

Vdisks Are Not Deleted From VDisk Store after Being Deleted From PVS Console

After doing a merge, deleting vdisk versions on PVS console does not delete them from vdisk store, no errors are seen on PVS console. After deleting the versions, if we check store using File Explorer, we still see the vdisk versions present...

Security update for fossil (moderate)

openSUSE Security Update: Security update for fossil Announcement ID: openSUSE-SU-2021:1052-1 Rating: moderate References: 1187988 Affected Products: openSUSE Backports SLE-15-SP1 An update that contains security fixes can now be installed. Description: This update for fossil fixes the following...

CVE-2021-25953

Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution...

CVE-2021-25953

Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution...

Remote code execution

Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution...

CVE-2021-25953

Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution...

CVE-2021-25953

Summary: CVE-2021-25953 affects the JavaScript utility library putil-merge . Affected versions are 1.0.0 through 3.6.6 . Root cause: prototype pollution in the merge logic of putil-merge, enabling property contamination of built-in prototypes. Impact (as stated): denial of service and potential r...

CVE-2021-25953

Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution...

CVE-2021-25953

Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution...

GitLab: Stored-XSS in merge requests

Summary As an attacker I could do XSS on Web.com because it is vulnerable Stored XSS, also known as persistent XSS, is more damaging than non-persistent XSS. It occurs when a malicious script is injected directly into a vulnerable web application. Steps to reproduce 1. Go to https://gitlab.com/ 2...

putil-merge 安全漏洞

putil-merge is an open source solution for merging two or more objects. It supports deep merging, cloning attributes, copying descriptors and filtering. A security vulnerability exists in putil-merge, which stems from a prototype contamination vulnerability in "putil-merge" versions 1.0.0 through...

PT-2021-16879 · Unknown · Putil-Merge

Name of the Vulnerable Software and Affected Versions: putil-merge versions 1.0.0 through 3.6.6 Description: The issue allows an attacker to cause a denial of service and may lead to remote code execution due to a prototype pollution vulnerability. Recommendations: For versions 1.0.0 through 3.6....