Express XSS Sanitizer 安全漏洞

Express XSS Sanitizer is a personal development by AhmedAdelFahim to clean user input data in req.body, req.query, req.headers and req.params to prevent cross-site scripting XSS attacks. express XSS Sanitizer A prototype contamination vulnerability exists in versions prior to 1.1.3, which stems...

steal 安全漏洞

steal is StealJS open source an extensible general-purpose module loader . It can load JavaScript modules defined in ES6, AMD and CommonJS formats. A security vulnerability exists in steal version 2.2.4, which stems from prototype contamination via alias variables in babel.js...

steal 安全漏洞

steal is StealJS open source an extensible general-purpose module loader . It can load JavaScript modules defined in ES6, AMD and CommonJS formats. StealJS steal npm-convert.js version 2.2.4 security vulnerability , the vulnerability stems from the function convertLater through the packageName...

steal 安全漏洞

steal is StealJS open source an extensible general-purpose module loader . It can load JavaScript modules defined in ES6, AMD and CommonJS formats. A security vulnerability exists in steal 2.2.4, which stems from prototype contamination of function extend in StealJS via the key variable in babel....

steal 安全漏洞

steal is StealJS open source an extensible general-purpose module loader . It can load JavaScript modules defined in ES6, AMD and CommonJS formats. A security vulnerability exists in steal version 2.2.4 that stems from prototype contamination in the function convertLater in npm-convert.js via the...

deepmerge-ts 安全漏洞

deepmerge-ts is an npm package. It is used to deep merge 2 or more objects with respect to type information. A security vulnerability exists in versions of deepmerge-ts prior to 2.0.2, which stems from the lack of handling of merge functions and is susceptible to prototype contamination...

Automattic Mongoose 安全漏洞

Automattic Mongoose is a MongoDB object modeling tool for asynchronous environments. A security vulnerability exists in Automattic Mongoose versions prior to 6.4.6, which stems from the Schema.path function being susceptible to prototype contamination when setting up schema objects, which can be...

conf-cfg-ini 安全漏洞

conf-cfg-ini is a package from the individual developer Rolf Loges in Germany. It uses Node.js to encode and decode conf/cfg/ini-Files. A security vulnerability exists in conf-cfg-ini versions prior to 1.2.2, which stems from the fact that this package is susceptible to prototype contamination; i...

properties-reader 安全漏洞

properties-reader is a Node.js property reader compatible with ini files by Steve King, a personal developer. A security vulnerability exists in properties-reader prior to version 2.2.0, which stems from the package's susceptibility to prototype contamination, and which can be exploited by an...

set-deep-prop 安全漏洞

set-deep-prop is a tool for setting the values of deeply nested objects and arrays. A security vulnerability exists in set-deep-prop, which stems from the vulnerability of this package to prototype contamination...

js-ini 安全漏洞

js-ini is a Node.js package for encoding/decoding ini-like strings from the Russian individual developer Denis. A security vulnerability exists in versions of js-ini prior to 1.3.0 that stems from the package's susceptibility to prototype contamination, which can be exploited by an attacker to...

ion-parser 安全漏洞

ion-parser is 418sec open source one of the fastest and lightest Javascript parser for TOML and ION files . A security vulnerability exists in ion-parser that stems from the package's susceptibility to prototype contamination, which can be exploited by an attacker to submit malicious INI files to...

merge 安全漏洞

merge is a tool for recursively merging JavaScript objects. A security vulnerability exists in @ianwalter/merge, which stems from the package's susceptibility to prototype contamination via the main merge function...

grunt-util-property 安全漏洞

grunt-util-property is a package by mikaelkaron personal developer. A security vulnerability exists in grunt-util-property that stems from susceptibility to prototype contamination, where the function call may be tricked into adding or modifying properties of Object.prototype using the proto...

IBM App Connect Enterprise 资源管理错误漏洞

IBM Integration Bus IBM WebSphere Message Broker and IBM App Connect Enterprise are both products of IBM Corporation, USA.IBM Integration Bus is an Enterprise Service Bus ESB product that provides connectivity and common data transformation for Service Oriented Architecture SOA environments and...

deep-assign 安全漏洞

deep-assign is an npm package. A security vulnerability exists in the npm package deep.assign version 0.0.0-alpha.0, which is vulnerable to "prototype contamination"...

Underscore.deep 安全漏洞

Underscore.deep is an open source utility program for manipulating nested objects from Clever USA. A security vulnerability exists in versions of Underscore.deep prior to 0.5.3, which stems from vulnerability to a prototype contamination vulnerability that can be exploited by an attacker to craft...

querymen 安全漏洞

querymen is an individual developer's query string parser middleware for MongoDB, Express, and Nodejs. A security vulnerability exists in querymen that stems from the middleware's susceptibility to prototype contamination...

GHSA-P332-FW36-4HQX Caucho Quercus, as distributed in Resin, does not properly handle unspecified characters in the names of variables

Caucho Quercus, as distributed in Resin before 4.0.29, does not properly handle unspecified characters in the names of variables, which has unknown impact and remote attack vectors, related to an "HTTP Parameter Contamination" issue...

Caucho Quercus, as distributed in Resin, does not properly handle unspecified characters in the names of variables

Caucho Quercus, as distributed in Resin before 4.0.29, does not properly handle unspecified characters in the names of variables, which has unknown impact and remote attack vectors, related to an "HTTP Parameter Contamination" issue...