CVE-2023-25578: Allocation of Resources Without Limits or Throttling

Starlite is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 1.5.2, the request body parsing in starlite allows a potentially unauthenticated attacker to consume a large amount of CPU time and RAM. The multipart body parser processes an unlimited number of file parts and ...

Denial of service due to unlimited number of parts

Impact The multipart body parser accepts an unlimited number of file parts. The multipart body parser accepts an unlimited number of field parts. The multipart body parser accepts an unlimited number of empty parts as field parts. Patches This is fixed in v7.4.1 for Fastify v4.x and v6.0.1 for...

GHSA-HPP2-2CR5-PF6G Denial of service due to unlimited number of parts

Impact The multipart body parser accepts an unlimited number of file parts. The multipart body parser accepts an unlimited number of field parts. The multipart body parser accepts an unlimited number of empty parts as field parts. Patches This is fixed in v7.4.1 for Fastify v4.x and v6.0.1 for...

PT-2023-20174

Name of the Vulnerable Software and Affected Versions @fastify/multipart versions prior to 6.0.1 and 7.4.1 Description The issue is related to the @fastify/multipart plugin, which may experience denial of service due to accepting an unlimited number of parts. This includes the multipart body pars...

Design/Logic Flaw

Play Framework is a web framework for Java and Scala. A denial of service vulnerability has been discovered in verions 2.8.3 through 2.8.15 of Play's forms library, in both the Scala and Java APIs. This can occur when using either the FormbindFromRequest method on a JSON request body or the...

CVE-2022-31018 Denial of service binding form from JSON in Play Framework

Play Framework is a web framework for Java and Scala. A denial of service vulnerability has been discovered in verions 2.8.3 through 2.8.15 of Play's forms library, in both the Scala and Java APIs. This can occur when using either the FormbindFromRequest method on a JSON request body or the...

body-parser-xml code issue vulnerability

body-parser-xml is an XML body parser that converts incoming XML data into a JSON representation. a code issue vulnerability exists in body-parser-xml, which stems from an error in the product's implementation of certain functionality. No details of the vulnerability are currently available...

GHSA-2GHC-6V89-PW9J body-parser-xml vulnerable to Prototype Pollution

body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

@iamkenos/fragile (>=0.1.1, <=0.1.5) potentially affected by CVE-2021-3666 via body-parser-xml (2.0.1)

body-parser-xml NPM version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on body-parser-xml and may be impacted: - @iamkenos/fragile =0.1.1, =0.1.5 Source cves: CVE-2021-3666 Source advisory: OSV:GHSA-2GHC-6V89-PW9J...

body-parser-xml vulnerable to Prototype Pollution

body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

CVE-2021-3666

body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

CVE-2021-3666

body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

CVE-2021-3666

body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

CVE-2021-3666 Prototype Pollution in fiznool/body-parser-xml

body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

CVE-2021-3666

CVE-2021-3666 : Vulnerability in body-parser-xml (prototype pollution via Improperly Controlled Modification of Object Prototype Attributes). Multiple connected sources confirm this CVE; CVSS details (3.1) show a NETWORK attack vector, no privileges required, no user interaction, and high impact ...

CVE-2021-3666

body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

CVE-2021-3666: Improperly Controlled Modification of Object Prototype Attributes

body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

PT-2021-21306

Name of the Vulnerable Software and Affected Versions body-parser-xml affected versions not specified Description The issue concerns Improperly Controlled Modification of Object Prototype Attributes, also known as 'Prototype Pollution'. This means that an attacker could potentially modify the...

@iamkenos/fragile (>=0.1.1, <=0.1.5) potentially affected by CVE-2021-3666 via body-parser-xml (2.0.1)

body-parser-xml NPM version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on body-parser-xml and may be impacted: - @iamkenos/fragile =0.1.1, =0.1.5 Source cves: CVE-2021-3666 Source advisory: SNYK:JS-BODYPARSERXML-1584211...

Prototype Pollution

Overview body-parser-xml is a XML parser middleware for express.js. Affected versions of this package are vulnerable to Prototype Pollution. The prototype of req.body can be polluted. PoC const express = require'express'; const bodyParser = require'body-parser'; require'body-parser-xml'bodyParser...