@amaspace-editor/builder (>=0.0.52, <=0.0.522), @instacart/eslint-config (0.3.0) +13 more potentially affected by CVE-2020-28499 via merge (2.1.0)

merge NPM version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on merge and may be impacted: - @amaspace-editor/builder =0.0.52, =1.4.2, =4.0.19, =1.0.21, =4.0.30, =1.0.34, =2.0.25, =3.0.17, =1.0.19, =4.0.21, =4.0.26 Source cves: CVE-2020-28499...

Prototype Pollution

Overview merge is a library that allows you to merge multiple objects into one, optionally creating a new cloned object. Similar to the jQuery.extend but more flexible. Works in Node.js and the browser. Affected versions of this package are vulnerable to Prototype Pollution via recursiveMerge...

Prototype Pollution

controlled-merge is vulnerable to prototype pollution. Lack of validation allows an attacker to inject arbitrary properties into proto or constructor to crash the application and potentially obtain remote code execution...

CVE-2020-28268

Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution...

CVE-2020-28268

Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution...

Remote code execution

Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution...

CVE-2020-28268

Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution...

CVE-2020-28268

Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution...

CVE-2020-28268

The CVE-2020-28268 entry concerns controlled-merge prototype pollution in versions 1.0.0–1.2.0. The root cause is a prototype pollution vulnerability that can cause a denial of service and may lead to remote code execution. Documentation in PT-2020-16958 notes the issue and provides a remediation...

CVE-2020-28268: Improperly Controlled Modification of Object Prototype Attributes

Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution...

PT-2020-16958 · Unknown · Controlled-Merge

Name of the Vulnerable Software and Affected Versions: controlled-merge versions 1.0.0 through 1.2.0 Description: The issue allows an attacker to cause a denial of service and may lead to remote code execution due to a prototype pollution vulnerability. Recommendations: For versions 1.0.0 through...

Prototype Pollution

Overview asciitable.js is a Generate a ASCII Table from a bidimensional array of strings Affected versions of this package are vulnerable to Prototype Pollution via the main function. POC var a = require"asciitable.js"; var b = JSON.parse'"proto":"test":123'; a,b; console.log.test Details Prototy...

Prototype Pollution

json8-merge-patch is vulnerable to prototype pollution. Failure to sanitize the apply functions allows for injection of arbitrary properties into existing construct prototypes and modification of attributes such as proto, constructor and prototype...

CVE-2020-8268

Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...

CVE-2020-8268

Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...

CVE-2020-8268

Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...

CVE-2020-8268

Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...

CVE-2020-8268

Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...

CVE-2020-8268

The CVE-2020-8268 entry relates to the json8-merge-patch npm package. Affected software: json8-merge-patch prior to version 1.0.3. Root cause: the apply function fails to restrict access to object prototypes, enabling prototype pollution. Potential impact: modification of for-prototype behavior w...

PT-2020-20072

Name of the Vulnerable Software and Affected Versions json8-merge-patch versions prior to 1.0.3 Description The issue allows attackers to inject or modify methods and properties of the global object constructor due to a prototype pollution vulnerability in the json8-merge-patch npm package...