Lucene search
+L

1032 matches found

Github Security Blog
Github Security Blog
added 2022/04/01 1:39 p.m.25 views

Automatic named constructor discovery in Valinor

Design issue - automatic constructor discovery The issue arises when upgrading from cuyz/valinor:0.3.0 to a newer system on an existing application, which broke due to the wrong constructor being picked. Still, a bigger security concern is problematic, and it is akin to...

7.1AI score
SaveExploits0References4Affected Software1
Code423n4
Code423n4
added 2022/03/31 12:0 a.m.10 views

Denial of services in proxy context by setting immutable privileged addresses in constructor in upgradeable contracts

Lines of code Vulnerability details Impact Privileged immutable addresses in LenderPool such as POOLEDCREDITLINE, SAVINGSACCOUNT and VERIFICATION are set in the constructor in the logic contract. These values are run at the time of deployment and affect only the local storage of the logic contrac...

6.5AI score
SaveExploits0
Veracode
Veracode
added 2022/03/18 2:11 a.m.21 views

Prototype Pollution

libnested is vulnerable to prototype pollution. An attacker can inject properties into existing construct prototypes via the set function in the index.js and modify attributes such as proto, constructor, and prototype...

9.8CVSS4.1AI score0.02029EPSS
SaveExploits1References3Affected Software1
Github Security Blog
Github Security Blog
added 2022/03/18 12:1 a.m.32 views

Code injection in accesslog

All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If attacker-controlled user input is given to the format option of the package's exported constructor function, it is possible for an attacker to...

10CVSS4.6AI score0.01614EPSS
SaveExploits1References4Affected Software1
OSV
OSV
added 2022/03/18 12:1 a.m.40 views

GHSA-8M2F-74R2-X3F2 Code injection in accesslog

All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If attacker-controlled user input is given to the format option of the package's exported constructor function, it is possible for an attacker to...

7.1CVSS7.6AI score0.01614EPSS
SaveExploits1References4
OSV
OSV
added 2022/03/17 12:15 p.m.7 views

CVE-2022-25760

All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If attacker-controlled user input is given to the format option of the package's exported constructor function, it is possible for an attacker to...

9.8CVSS6.1AI score0.01614EPSS
SaveExploits1References2
NVD
NVD
added 2022/03/17 12:15 p.m.50 views

CVE-2022-25760

All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If attacker-controlled user input is given to the format option of the package's exported constructor function, it is possible for an attacker to...

10CVSS0.01614EPSS
SaveExploits1References2
Prion
Prion
added 2022/03/17 12:15 p.m.24 views

Code injection

All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If attacker-controlled user input is given to the format option of the package's exported constructor function, it is possible for an attacker to...

10CVSS9.8AI score0.01614EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2022/03/17 11:16 a.m.4 views

CVE-2022-25760

All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If attacker-controlled user input is given to the format option of the package's exported constructor function, it is possible for an attacker to...

10CVSS6.2AI score0.01614EPSS
SaveExploits1References3
CNNVD
CNNVD
added 2022/03/17 12:0 a.m.8 views

accesslog 代码注入漏洞

accesslog is a simple generic/combined accesslog middleware from the individual developers at Starbuck Starfish in the United States. A security vulnerability exists in accesslog, which stems from a lack of filtering and escaping in the constructor. The vulnerability can be exploited to execute...

10CVSS8.7AI score0.01614EPSS
SaveExploits1References3
Code423n4
Code423n4
added 2022/02/24 12:0 a.m.10 views

Anyone can be _owner

Lines of code Vulnerability details Impact Anyone can be owner by calling initialize Proof of Concept initialize can called multiple times as the name 'initialize' should intended to be called one time when the contract deployed. Nothing prevent it to be called multiple times, and claim the...

7AI score
SaveExploits0
OSV
OSV
added 2022/02/11 5:15 p.m.22 views

CVE-2021-23597

This affects the package fastify-multipart before 5.3.1. By providing a name=constructor property it is still possible to crash the application. Note: This is a bypass of CVE-2020-8136 https://security.snyk.io/vuln/SNYK-JS-FASTIFYMULTIPART-1290382...

7.5CVSS7.5AI score
SaveExploits0References3
Snyk
Snyk
added 2022/02/07 5:44 p.m.10 views

Denial of Service (DoS)

Overview fastify-multipart is a Multipart plugin for Fastify Affected versions of this package are vulnerable to Denial of Service DoS. By providing a name=constructor property it is still possible to crash the application. Note: This is a bypass of CVE-2020-8136...

7.5CVSS6.8AI score0.0203EPSS
SaveExploits2References2
OSV
OSV
added 2022/02/04 11:15 p.m.28 views

PYSEC-2022-91

Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a SavedModel such that TensorByteSize would trigger CHECK failures. TensorShape constructor throws a CHECK-fail if shape is partial or has a number of elements that would overflow t...

6.5CVSS4AI score0.00783EPSS
SaveExploits1References3
OSV
OSV
added 2022/02/04 11:15 p.m.19 views

PYSEC-2022-97

Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a SavedModel such that Grappler optimizer would attempt to build a tensor using a reference dtype. This would result in a crash due to a CHECK-fail in the Tensor constructor as...

6.5CVSS2AI score0.00864EPSS
SaveExploits1References4
Debian CVE
Debian CVE
added 2022/02/04 10:32 p.m.9 views

CVE-2022-23588

Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a SavedModel such that Grappler optimizer would attempt to build a tensor using a reference dtype. This would result in a crash due to a CHECK-fail in the Tensor constructor as...

6.5CVSS6.8AI score0.00864EPSS
SaveExploits1
OSV
OSV
added 2022/02/04 8:15 p.m.17 views

CVE-2021-23470

This affects the package putil-merge before 3.8.0. The merge function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in...

9.8CVSS9.4AI score
SaveExploits0References2
Cvelist
Cvelist
added 2022/02/04 8:5 p.m.44 views

CVE-2021-23470 Prototype Pollution

This affects the package putil-merge before 3.8.0. The merge function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in...

8.2CVSS9.7AI score0.01266EPSS
SaveExploits1References2
CNNVD
CNNVD
added 2022/02/04 12:0 a.m.7 views

putil-merge 安全漏洞

putil-merge is an open source solution for merging two or more objects. It supports deep merging, cloning attributes, copying descriptors and filtering. A security vulnerability exists in putil-merge versions prior to 3.8.0, which stems from the merge function not checking the values of incoming...

9.8CVSS8.3AI score0.01266EPSS
SaveExploits1References3
Snyk
Snyk
added 2022/02/02 1:2 p.m.7 views

Prototype Pollution

Overview putil-merge is a Lightweight solution for merging multiple objects into one. Also it supports deep merge. Affected versions of this package are vulnerable to Prototype Pollution. The merge function does not check the values passed into the argument. An attacker can supply a malicious val...

9.8CVSS9AI score0.01266EPSS
SaveExploits1References2
Rows per page
Query Builder