1030 matches found
Prototype Pollution
libnested is vulnerable to prototype pollution. An attacker can inject properties into existing construct prototypes via the set function in the index.js and modify attributes such as proto, constructor, and prototype...
Code injection in accesslog
All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If attacker-controlled user input is given to the format option of the package's exported constructor function, it is possible for an attacker to...
GHSA-8M2F-74R2-X3F2 Code injection in accesslog
All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If attacker-controlled user input is given to the format option of the package's exported constructor function, it is possible for an attacker to...
CVE-2022-25760
All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If attacker-controlled user input is given to the format option of the package's exported constructor function, it is possible for an attacker to...
CVE-2022-25760
All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If attacker-controlled user input is given to the format option of the package's exported constructor function, it is possible for an attacker to...
Code injection
All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If attacker-controlled user input is given to the format option of the package's exported constructor function, it is possible for an attacker to...
CVE-2022-25760
All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If attacker-controlled user input is given to the format option of the package's exported constructor function, it is possible for an attacker to...
accesslog 代码注入漏洞
accesslog is a simple generic/combined accesslog middleware from the individual developers at Starbuck Starfish in the United States. A security vulnerability exists in accesslog, which stems from a lack of filtering and escaping in the constructor. The vulnerability can be exploited to execute...
Anyone can be _owner
Lines of code Vulnerability details Impact Anyone can be owner by calling initialize Proof of Concept initialize can called multiple times as the name 'initialize' should intended to be called one time when the contract deployed. Nothing prevent it to be called multiple times, and claim the...
CVE-2021-23597
This affects the package fastify-multipart before 5.3.1. By providing a name=constructor property it is still possible to crash the application. Note: This is a bypass of CVE-2020-8136 https://security.snyk.io/vuln/SNYK-JS-FASTIFYMULTIPART-1290382...
Denial of Service (DoS)
Overview fastify-multipart is a Multipart plugin for Fastify Affected versions of this package are vulnerable to Denial of Service DoS. By providing a name=constructor property it is still possible to crash the application. Note: This is a bypass of CVE-2020-8136...
PYSEC-2022-91
Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a SavedModel such that TensorByteSize would trigger CHECK failures. TensorShape constructor throws a CHECK-fail if shape is partial or has a number of elements that would overflow t...
PYSEC-2022-97
Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a SavedModel such that Grappler optimizer would attempt to build a tensor using a reference dtype. This would result in a crash due to a CHECK-fail in the Tensor constructor as...
CVE-2022-23588
Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a SavedModel such that Grappler optimizer would attempt to build a tensor using a reference dtype. This would result in a crash due to a CHECK-fail in the Tensor constructor as...
CVE-2021-23470
This affects the package putil-merge before 3.8.0. The merge function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in...
CVE-2021-23470 Prototype Pollution
This affects the package putil-merge before 3.8.0. The merge function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in...
putil-merge 安全漏洞
putil-merge is an open source solution for merging two or more objects. It supports deep merging, cloning attributes, copying descriptors and filtering. A security vulnerability exists in putil-merge versions prior to 3.8.0, which stems from the merge function not checking the values of incoming...
Prototype Pollution
Overview putil-merge is a Lightweight solution for merging multiple objects into one. Also it supports deep merge. Affected versions of this package are vulnerable to Prototype Pollution. The merge function does not check the values passed into the argument. An attacker can supply a malicious val...
GHSA-W4HP-PCP8-QHF3 Cross-site Scripting in livehelperchat
Stored XSS is found in SettingsLive help configurationDepartments-Departments groups-edit When a user creates a new webhook under the NAME field and puts a payload constructor.constructor'alert1', the input gets stored, at user edit groupname , the payload gets executed...