3951 matches found
Prototype Pollution
Overview shvl is a Get and set dot-notated properties within an object Affected versions of this package are vulnerable to Prototype Pollution due to an incomplete fix not protecting against the constructor.prototype vector. PoC js var shvl = require"shvl" let obj = console.log"Before: " +...
Prototype Pollution
Overview In mquery before version 3.2.3 there is a prototype pollution vulnerability because a special property e.g., proto can be copied during a merge or clone operation. Recommendation Upgrade to version 3.2.3 or later References - CVE - GitHub Advisory...
Prototype Pollution
Overview set-deep-prop is a Set the value of a deeply nested object or array Affected versions of this package are vulnerable to Prototype Pollution via the main functionality. PoC const setDeepProp = require'set-deep-prop'; setDeepProp,'proto', 'x', 'polluted'; console.log.a; // polluted Details...
'merge_sort::merge()' crashes with double-free for `T: Drop`
In the affected versions of this crate, mergesort::merge wildly duplicates and drops ownership of T without guarding against double-free. Due to such implementation, simply invoking mergesort::merge on Vec can cause double free bugs...
PT-2021-19620
Name of the Vulnerable Software and Affected Versions: algorithmica crate through 2021-03-07 Description: The issue is related to a double free in the merge sort::merge function. In the affected versions of the algorithmica crate, merge sort::merge duplicates and drops ownership of T without...
Prototype Pollution
Overview copy-props is a Copy properties deeply between two objects. Affected versions of this package are vulnerable to Prototype Pollution via the main functionality. POC const copyProps = require'copy-props'; var maliciouspayload = '"proto":"polluted":"polluted"'; console.log"Before : " +...
CVE-2021-22182
An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request...
CVE-2021-22182
An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request...
UBUNTU-CVE-2021-22182
An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request...
CVE-2021-22182
An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request...
CVE-2021-22182
An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request...
CVE-2021-22182
Removed by vendor...
CVE-2021-22182
An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request...
CVE-2021-22182
An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request...
PT-2021-14893 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions 13.7 and later Description: A stored XSS issue has been found in merge requests, affecting the security of the system. Recommendations: For versions 13.7 and later, update to a version that includes a fix for this issue...
CVE-2021-22182: Improper Neutralization of Input During Web Page Generation
An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request...
GitLab 跨站脚本漏洞
GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. A cross-site scripting vulnerability exists in GitLab versions after 13.7, which stems from the...
Prototype Pollution
Overview tree-kit is a Tree utilities which provides a full-featured extend and object-cloning facility, and various tools to deal with nested object structures. Affected versions of this package are vulnerable to Prototype Pollution via dotPath.set. PoC: const dotPath = require'tree-kit'...
Prototype Pollution
merge is vulnerable to prototype pollution. The function recursiveMerge allows for an injection of arbitrary properties into existing construct prototypes and modification of attributes such as proto, constructor and prototype...