441 matches found
GHSA-7QM6-9V49-38M9 Prototype Pollution in record-like-deep-assign
All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality. PoC js const deepAssign = require'record-like-deep-assign'; let obj = ; console.log"Before being polluted: " + obj.polluted; EVILJSON = JSON.parse'"proto":"polluted":true'; deepAssign...
Prototype Pollution in record-like-deep-assign
All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality. PoC js const deepAssign = require'record-like-deep-assign'; let obj = ; console.log"Before being polluted: " + obj.polluted; EVILJSON = JSON.parse'"proto":"polluted":true'; deepAssign...
CVE-2021-28709
issues with partially successful P2M updates on x86 This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. x86 HVM and PVH guests may be started in populate-on-demand PoD mode, to provide a way for them to later easily have...
libwebp: out-of-bounds read in ChunkAssignData() in mux/muxinternal.c
A flaw was found in libwebp. An out-of-bounds read was found in function ChunkAssignData. The highest threat from this vulnerability is to data confidentiality and to the service availability...
Prototype Pollution in x-assign
This vulnerability affects all versions of package x-assign. The global proto object can be polluted using the proto object...
GHSA-4MVJ-RQ4V-2FXW Prototype Pollution in x-assign
This vulnerability affects all versions of package x-assign. The global proto object can be polluted using the proto object...
Prototype Pollution
x-assign is vulnerable to prototype pollution. An attacker is able to inject malicious properties into existing construct prototypes and modify attributes using the proto object...
CVE-2021-23452
This affects all versions of package x-assign. The global proto object can be polluted using the proto object...
Code injection
This affects all versions of package x-assign. The global proto object can be polluted using the proto object...
CVE-2021-23452 Prototype Pollution
This affects all versions of package x-assign. The global proto object can be polluted using the proto object...
CVE-2021-23452
CVE-2021-23452 affects all versions of the package x-assign . The flaw is a prototype pollution vulnerability: an attacker can pollute the global proto object via the proto property, enabling manipulation of object prototypes and potentially leading to DoS or remote code execution as discussed in...
x-assign 安全漏洞
X-assign is an Object.assign package. It is used to merge nested objects and concatenate arrays. A security vulnerability exists in x-assign, which stems from the fact that the software's global prototype object can be contaminated by the proto prototype object...
Prototype Pollution
Overview x-assign is an Object.assign that will merge nested objects and concatenate arrays. Affected versions of this package are vulnerable to Prototype Pollution. The global proto object can be polluted using the proto object. PoC const XAssign = require"[email protected]";...
access-token (0.1.1), assign (>=0.1.0, <=0.1.4) +25 more potentially affected by CVE-2020-28280 via predefine (>=0.0.1, <=0.0.6)
predefine NPM version =0.0.1, =0.1.0, =0.0.1, =0.2.1, =0.1.0, =0.0.1, =0.0.0, =0.0.0, =0.0.0, =0.0.1, =0.0.2, =0.0.2, =0.0.2, =0.0.4 and more Source cves: CVE-2020-28280 Source advisory: OSV:GHSA-MX3X-GHQM-R43H...
ROS-2-2240
2.2240 Multiple vulnerabilities in libwebp 1. Vulnerability description: CVE-2020-36332 A vulnerability in the libwebp library for encoding and decoding WebP images, is related to improper control of internal resource consumption. Exploitation of the vulnerability could allow an attacker acting...
record-like-deep-assign code issue vulnerability
record-like-deep-assign is a package. A code issue vulnerability exists in record-like-deep-assign that stems from a prototype contamination affecting key functionality within the plugin. No details of the vulnerability are provided at this time...
CVE-2021-23402
All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality...
Design/Logic Flaw
All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality...
CVE-2021-23402
CVE-2021-23402 affects the npm package record-like-deep-assign. All versions are vulnerable to prototype pollution via the main functionality, as shown in public advisories. The root cause involves unsafe handling of object merges or path-based assignments that can pollute Object.prototype, enabl...
