GHSA-H726-X36V-RX45 Prototype Pollution in lodash.merge

Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via constructor: prototype: ... causing the addition or modification of an existing property that will exist on all objects. Recommendation...

PT-2020-21333

Name of the Vulnerable Software and Affected Versions lodash.merge versions prior to 4.6.2 Description The issue allows a malicious user to modify the prototype of Object via constructor: prototype: ... using the merge function, potentially causing the addition or modification of an existing...

PT-2020-20961

Name of the Vulnerable Software and Affected Versions lodash.merge versions prior to 4.6.1 Description The issue allows a malicious user to modify the prototype of Object via proto , causing the addition or modification of an existing property that will exist on all objects. This is due to the...

Prototype Pollution in merge-objects

All versions of merge-objects are vulnerable to Prototype Pollution. Recommendation No fix is available for this vulnerability at this time. It is our recommendation to use an alternative package...

basic-read-config (>=1.0.2, <=1.0.3), blockchain-profile (>=0.1.0, <=0.3.2) +8 more potentially affected by unknown CVE via merge-objects (1.0.5)

merge-objects NPM version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on merge-objects and may be impacted: - basic-read-config =1.0.2, =0.1.0, =0.0.5, =0.3.0, =0.0.1, =1.1.4, =1.4.0, =0.1.0, =0.0.1, =0.5.3 Source cves: unknown CVE Source...

GHSA-992F-WF4W-X36V Prototype Pollution in merge-objects

All versions of merge-objects are vulnerable to Prototype Pollution. Recommendation No fix is available for this vulnerability at this time. It is our recommendation to use an alternative package...

PT-2020-21190

Name of the Vulnerable Software and Affected Versions merge-objects versions affected versions not specified Description The issue concerns Prototype Pollution. There is no information provided about the estimated number of potentially affected devices or real-world incidents where this issue was...

GitLab: Revoked User can still view the Merge Request created by him via API

Summary In Gitlab when a user is demoted to Guest role, the Guest user will not be able to view and edit the Merge requests in a project even if the merge request is created by him. But this check is not implemented in API so the Guest user will be able to the following actions for the Merge...

Prototype Pollution

Overview datatables.net is a DataTables for jQuery Affected versions of this package are vulnerable to Prototype Pollution. POC The following two files are required to be served by an HTTP server. poc.html: $.fn.dataTable.ext.internal.fnSetObjectDataFn'proto.foo','polluted'; document.write'foo : ...

Prototype Pollution

Overview jsonpointer is a Simple JSON Addressing. Affected versions of this package are vulnerable to Prototype Pollution via the set function. POC by NerdJS const jsonpointer = require'jsonpointer'; jsonpointer.set, '/proto/polluted', true; console.logpolluted; Details Prototype Pollution is a...

Prototype Pollution

Overview gedi is an An evented data API Affected versions of this package are vulnerable to Prototype Pollution via the set function. POC const gedi = require'gedi'; try gedi.set'proto/polluted', true; catche console.logpolluted; Details Prototype Pollution is a vulnerability affecting JavaScript...

Prototype Pollution

Overview connie-lang is a the configuration language for connie. Affected versions of this package are vulnerable to Prototype Pollution in the configuration language library used by connie. POC const connie = require'connie'; const fs = require'fs'; fs.writeFileSync'test.json', "proto":...

Prototype Pollution

Overview property-expr is a tiny util for getting and setting deep object props safely Affected versions of this package are vulnerable to Prototype Pollution via the setter function. POC var expr = require'property-expr'; expr.setter'proto.polluted', true; console.logpolluted; // true Details...

Prototype Pollution

Overview Templ8 is a JavaScript Client/ Server Template Engine Affected versions of this package are vulnerable to Prototype Pollution via the parse function. POC const Templ8 = require'Templ8'; var tpl = new Templ8 'proto.polluted=true' ; tpl.parse; console.logpolluted //true Details Prototype...

Prototype Pollution

Overview safetydance is an Exception safety in node.js Affected versions of this package are vulnerable to Prototype Pollution via the set function. POC: const safetydance = require'safetydance'; safetydance.set, 'proto.polluted', true; console.logpolluted; //true Details Prototype Pollution is a...

Prototype Pollution

Overview promisehelpers is a Promise helper functions Affected versions of this package are vulnerable to Prototype Pollution via the insert function. POC: const promisehelpers = require'promisehelpers'; var obj = ; promisehelpers.insert'proto', 'polluted', trueobj; console.logpolluted; // true...

Prototype Pollution

Overview nodee-utils is a set of useful helpers Affected versions of this package are vulnerable to Prototype Pollution via the deepSet function. POC: const object = require'nodee-utils'; object.deepSet, 'proto.polluted', true; console.logpolluted; Details Prototype Pollution is a vulnerability...

Prototype Pollution

Overview node-oojs is an Object Oriented JavaScript Affected versions of this package are vulnerable to Prototype Pollution via the setPath function. POC: require'node-oojs'; oojs.setPath'proto.polluted':true; console.logpolluted; Details Prototype Pollution is a vulnerability affecting JavaScrip...

Prototype Pollution

Overview node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities. Affected versions of this package are vulnerable to Prototype Pollution via the util.setPath function. Note: version 0.10.0 is a breaking change removing...

Prototype Pollution

Overview linux-cmdline is a Parser for the Linux kernel command line arguments Affected versions of this package are vulnerable to Prototype Pollution via the constructor. POC: const linuxCmdline = require'linux-cmdline'; linuxCmdline'proto.polluted=true'; console.logpolluted; Details Prototype...