Prototype Pollution

Overview x-assign is an Object.assign that will merge nested objects and concatenate arrays. Affected versions of this package are vulnerable to Prototype Pollution. The global proto object can be polluted using the proto object. PoC const XAssign = require"[email protected]";...

access-token (0.1.1), assign (>=0.1.0, <=0.1.4) +25 more potentially affected by CVE-2020-28280 via predefine (>=0.0.1, <=0.0.6)

predefine NPM version =0.0.1, =0.1.0, =0.0.1, =0.2.1, =0.1.0, =0.0.1, =0.0.0, =0.0.0, =0.0.0, =0.0.1, =0.0.2, =0.0.2, =0.0.2, =0.0.4 and more Source cves: CVE-2020-28280 Source advisory: OSV:GHSA-MX3X-GHQM-R43H...

ROS-2-2240

2.2240 Multiple vulnerabilities in libwebp 1. Vulnerability description: CVE-2020-36332 A vulnerability in the libwebp library for encoding and decoding WebP images, is related to improper control of internal resource consumption. Exploitation of the vulnerability could allow an attacker acting...

record-like-deep-assign code issue vulnerability

record-like-deep-assign is a package. A code issue vulnerability exists in record-like-deep-assign that stems from a prototype contamination affecting key functionality within the plugin. No details of the vulnerability are provided at this time...

CVE-2021-23402

All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality...

Design/Logic Flaw

All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality...

CVE-2021-23402

CVE-2021-23402 affects the npm package record-like-deep-assign. All versions are vulnerable to prototype pollution via the main functionality, as shown in public advisories. The root cause involves unsafe handling of object merges or path-based assignments that can pollute Object.prototype, enabl...

CVE-2021-23402

All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality...

record-like-deep-assign 代码问题漏洞

record-like-deep-assign is a package. A code issue vulnerability exists in record-like-deep-assign that stems from a prototype contamination affecting key functionality within the plugin. No details of the vulnerability are provided at this time...

Authentication flaw

There is an Assertion in 'contextp-token.type == LEXERRIGHTBRACE || contextp-token.type == LEXERASSIGN || contextp-token.type == LEXERCOMMA' in parserparseobjectinitializer in JerryScript 2.2.0...

PT-2024-11273 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a null pointer dereference in the Linux kernel when a gadget driver calls usb assign descriptors with a NULL descriptor for super-speed-plus and is then used on...

UBUNTU-CVE-2021-29279

There is a integer overflow in function filtercore/filterprops.c:gfpropsassignvalue in GPAC 1.0.1. In which, the arg const GFPropertyValue value,maybe value-value.data.size is a negative number. In result, memcpy in gfpropsassignvalue failed...

Prototype Pollution in borderlesslabs/assign

Description @borderlesslabs/assign is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: // poc.js var a = require"@borderlesslabs/assign" const payload = JSON.parse'"proto":"polluted":"Yes! Its Polluted"'; var obj = console.log"Before : " + .polluted;...

Prototype pollution in nested-object-assign

The package nested-object-assign before 1.0.4 is vulnerable to Prototype Pollution via the default function...

GHSA-C497-V8PV-CH6X Prototype pollution in nested-object-assign

The package nested-object-assign before 1.0.4 is vulnerable to Prototype Pollution via the default function...

Prototype Pollution

nested-object-assign is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

CVE-2021-23329

CVE-2021-23329 affects the npm package nested-object-assign, specifically versions prior to 1.0.4. The vulnerability is Prototype Pollution via the default function, allowing an attacker to inject properties into Object.prototype. Exploitation details are not provided in the provided documents, b...

CVE-2021-23329

The package nested-object-assign before 1.0.4 are vulnerable to Prototype Pollution via the default function, as demonstrated by running the PoC below...

PT-2021-15438 · Unknown · Nested-Object-Assign

Name of the Vulnerable Software and Affected Versions: nested-object-assign versions prior to 1.0.4 Description: The issue concerns Prototype Pollution via the default function. Recommendations: For versions prior to 1.0.4, update to version 1.0.4 or later to resolve the issue...

Prototype Pollution in geta/nestedobjectassign

Description nested-object-assign is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: javascript // poc.js const assign = require'nested-object-assign' console.log'Before: ' + .polluted assign, JSON.parse'"proto": "polluted": true' console.log'After: ' +...