dot-lens 安全漏洞

dot-lens is a JavaScript library. A security vulnerability exists in dot-lens that stems from prototype contamination of the set function in the index.js file...

mde utilities 安全漏洞

mde utilities is a classic collection of JavaScript utilities. A security vulnerability exists in mde utilities that stems from the presence of a prototype contamination vulnerability...

rangy 安全漏洞

rangy is a cross-browser JavaScript selection library. A security vulnerability exists in timdown rangy that stems from the presence of a prototype contamination vulnerability...

Rocket.Chat 安全漏洞

Rocket.Chat is an open source team chat software. A security vulnerability exists in Rocket.Chat versions prior to 5.2.0, which stems from the presence of a prototype contamination vulnerability that can be exploited by an attacker to perform an RCE under the administrator account...

Visioweb.js 安全漏洞

Visioglobe Visioweb.js is used by Visioglobe to load and explore 3D maps built from VisioMapEditor. A security vulnerability exists in Visioweb.js version 1.10.6, which stems from the presence of prototype contamination that can be exploited by an attacker to execute XSS on a client system...

Json-Pointer 安全漏洞

Json-Pointer is an open source, Rfc 6901 described Json pointer some utility program by the individual developer Manuel Stofer in Switzerland. A security vulnerability exists in Json-Pointer. An attacker could exploit this vulnerability to cause prototype contamination...

Tree Kit 安全漏洞

Tree Kit is a toolkit for Cedric Ronvel's personal developers that provides functions that operate with nested object structures. A security vulnerability exists in Tree Kit versions prior to 0.7.0, which stems from a vulnerability that can lead to improperly controlled modification of an object'...

flat 安全漏洞

flat is a library from Hugh Kennedy's personal developer. It is used to take a nested Javascript object and flatten it, or to unflatten the object using the separator key. A security vulnerability exists in versions prior to flat 5.0.1, which stems from a problem with the unflatten function in th...

JSON-Patch 安全漏洞

JSON-Patch is a streamlined and averaged Javascript implementation of the JSON Patch standard RFC 6902 by the individual developer Joachim Wester. A security vulnerability exists in JSON-Patch versions prior to 3.1.1, which stems from a prototype contamination that can lead to improperly controll...

safe-eval 安全漏洞

safe-eval is a safer version of the eval function from the Hage Yaapa Personal Developer. safe-eval suffers from a security vulnerability that stems from susceptibility to prototype contamination, which allows an attacker to add or modify properties of Object.prototype.Consolidate when using the...

Node WHOIS 安全漏洞

Node WHOIS is an open source WHOIS client for Node.js by Furqan Software. Node WHOIS has a security vulnerability that stems from a problem with an unknown function in the file index.coffee, which can lead to improperly controlled modifications of object prototype properties, resulting in prototy...

chbrown rfc6902 安全漏洞

rfc6902 is an implementation of rfc6902 in TypeScript by the individual developer Christopher Brown. A security vulnerability exists in chbrown rfc6902, which stems from the fact that incorrect operation can lead to prototype contamination...

Silverstripe framework cross-site scripting vulnerability

Silverstripe framework is an application from Silverstripe New Zealand. Empowering powerful digital teams by creating a platform for digital change. silverstripe framework 4.10.0 and previous versions contain a cross-site scripting vulnerability that stems from the use of jQuery 1.7.2, which is...

Parse Server 安全漏洞

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A security vulnerability exists in Parse Server versions prior to 4.10.20 or 5.3.3, which stems from an attacker's ability to prototype contamination via a cloud code web hook...

Parse Server 安全漏洞

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A security vulnerability exists in Parse Server versions prior to 4.10.19 or 5.3.2, which stems from an attacker's ability to contaminate prototypes via cloud code web hooks or cloud code...

CVE-2021-26393

Insufficient memory cleanup in the AMD Secure Processor ASP Trusted Execution Environment TEE may allow an authenticated attacker with privileges to generate a valid signed TA and potentially poison the contents of the process memory with attacker controlled data resulting in a loss of...

Prototype Pollution

fastest-json-copy is vulnerable to pollution prototype. The vulnerability exists because of missing validation of keys in v1.js allowing an attacker to add new values to the JavaScript object prototype, overwriting or contaminating the base object...

browserify-shim 品安全漏洞

browserify-shim is the thlorenz personal developer's tool for making CommonJS-incompatible files browsable. A security vulnerability exists in browserify-shim version 3.8.15, which originates from a prototype chain contamination that can be caused by an attacker via the shimPath variable in the...

browserify-shim 安全漏洞

browserify-shim is used by thlorenz individual developers to make CommonJS incompatible files browsable. A security vulnerability exists in browserify-shim version 3.8.15, which stems from a prototype contamination vulnerability in the resolveShims function in resolve-shims.js...

Winter 安全漏洞

Winter is a free, open source, self-hosted CMS platform based on the Laravel PHP framework. A security vulnerability exists in Winter versions 1.1.8, 1.1.9, and 1.2.0, which stems from the Snowboard framework's susceptibility to prototype contamination in Snowboard's main class and its plugin...