Kibana 6.5.4 Timelion Prototype Pollution

Kibana version 6.5.4 contains a Timelion prototype pollution flaw that may allow command execution. This proof of concept provides a vulnerable Docker environment and reproduction details. https://packetstorm.news/download/235002...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via the map decoding process. An attacker can modify the prototype of all objects by supplying a crafted map key during deserialization, potentially leading to arbitrary property injection or alteration of applicatio...

Supsystic Popup < 1.10.19 - Prototype Pollution

The plugin has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into Object.prototype. PoC 1 Create a pop-up that is set to load on any page 2 Go to http://example.com/?protopoc=polluted 3 Open browser console 4 Type poc and see polluted as the resul...

@airyrooms/nerve (0.1.1), @akeating-redhat/fh-mbaas-api (7.0.1) +869 more potentially affected by CVE-2022-24999 via qs (6.4.0)

qs NPM version 6.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on qs and may be impacted: - @airyrooms/nerve 0.1.1 - @akeating-redhat/fh-mbaas-api 7.0.1 - @allenbrowntech/lemon =1.0.0, =1.0.1, =1.0.0, =0.0.1, =0.17.5, =0.0.3, =1.10.0, =1.10.1,...

@2bad/bitrix (2.4.0), @6qiongtao/catalyst-node-commons (>=0.1.0, <=1.0.4) +257 more potentially affected by CVE-2022-24999 via qs (>=6.10.0, <=6.10.2)

qs NPM version =6.10.0, =0.1.0, =3.7.0, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =1.5.2, =1.3.5-beta, =2.6.0-xiaomi, =1.1.0, =1.0.2, =1.1.4 - @byteluck-fe/runtime-mobile-controls 1.1.0 and more Source cves: CVE-2022-24999 Source advisory: GHSA-HRPP-H998-J3PP...

Prototype Pollution

objection is vulnerable to prototype pollution. An attacker is able to exploit the vulnerability to inject arbitrary properties into existing construct prototypes and modify attributes such as proto, constructor and prototype via the set and zipObject function...

3gtel-frontend-platform (1.0.0), @achieve-all/v-element (1.0.0) +406 more potentially affected by CVE-2018-16486 via defaults-deep (>=0.2.3, <=0.2.4)

defaults-deep NPM version =0.2.3, =0.1.1, =1.0.0, =1.0.0, =2.0.0, =2.0.7, =0.1.0, =1.0.0, =1.0.8, =0.1.2, =1.0.3, =1.0.0, =6.0.0-rc1, =7.4.3 and more Source cves: CVE-2018-16486 Source advisory: GHSA-PJXW-22XF-6PWC...

CVE-2018-16491

CVE-2018-16491 describes a prototype pollution vulnerability in node.extend before 1.1.7 and before 2.0.1, enabling an attacker to inject arbitrary properties onto Object.prototype. Affected versions are node.extend &lt;1.1.7, ~