Prototype Pollution

json-logic-js is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

Servicing stack update for Windows 10, version 2004: September 8, 2020

None None...

Servicing stack update for Windows 10, version 1809: September 8, 2020

None None...

Servicing stack update for Windows 10, version 1903 and 1909: September 8, 2020

None None...

CVE-2020-3629: Buffer Copy without Checking Size of Input

u'Stack out of bound issue occurs when making query to DSP capabilities due to wrong assumption was made on determining the buffer size for the DSP attributes' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music,...

Denial Of Service (DoS)

laravel/laravel is vulnerable to denial of service DoS. It is possible because it allows mass assignment of Eloquent attributes that included the model's table name...

Prototype Pollution

extend-merge is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype through the merge function...

Prototype Pollution

node-forge is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

Prototype Pollution

dot-notes is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

Prototype Pollution

confucious is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

Prototype Pollution

arr-flatten-unflatten is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

Cross-Site Scripting in mrk.js

Versions of mrk.js before 2.0.1 are vulnerable to cross-site scripting XSS when markdown is converted to HTML. Recommendation Update to version 2.0.1 or later and use mark.sanitizeURL for any src and href attributes when extending the markdown...

PT-2020-21395

Name of the Vulnerable Software and Affected Versions react-marked-markdown versions affected versions not specified Description The issue concerns cross-site scripting XSS via href attributes in react-marked-markdown. This can be exploited when a user is provided to react-marked-markdown. There ...

IBM Security Guardium Data Encryption (GDE) Information Disclosure Vulnerability (CNVD-2020-49938)

IBM Security Guardium Data Encryption GDE provides a modular set of encryption solutions that help security teams effectively implement data-at-rest security across the organization. An information disclosure vulnerability exists in IBM Security Guardium Data Encryption GDE 3.0.0.2, which stems...

PT-2020-5513 · Apache +1 · Apache Struts +1

Name of the Vulnerable Software and Affected Versions: Apache Struts versions 2.0.0 through 2.5.20 Description: The issue is related to insufficient control of modification of dynamically determined characteristics of an object in the Apache Struts platform. This can be exploited by a remote...

Exploit for Prototype Pollution in Apache Struts

CVE-2019-0230 CVE-2019-0230 Exploit This is CVE-2019-0...

Prototype Pollution

flat is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

CSS Injection

chartkick is vulnerable to CSS injection. A remote attacker is able to inject arbitrary CSS without attributes...

CVE-2020-15109

In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the...

CVE-2020-15109

In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the...