set-deep-prop 安全漏洞

set-deep-prop is a tool for setting the values of deeply nested objects and arrays. A security vulnerability exists in set-deep-prop, which stems from the vulnerability of this package to prototype contamination...

merge 安全漏洞

merge is a tool for recursively merging JavaScript objects. A security vulnerability exists in @ianwalter/merge, which stems from the package's susceptibility to prototype contamination via the main merge function...

conf-cfg-ini 安全漏洞

conf-cfg-ini is a package from the individual developer Rolf Loges in Germany. It uses Node.js to encode and decode conf/cfg/ini-Files. A security vulnerability exists in conf-cfg-ini versions prior to 1.2.2, which stems from the fact that this package is susceptible to prototype contamination; i...

grunt-util-property 安全漏洞

grunt-util-property is a package by mikaelkaron personal developer. A security vulnerability exists in grunt-util-property that stems from susceptibility to prototype contamination, where the function call may be tricked into adding or modifying properties of Object.prototype using the proto...

IBM App Connect Enterprise 资源管理错误漏洞

IBM Integration Bus IBM WebSphere Message Broker and IBM App Connect Enterprise are both products of IBM Corporation, USA.IBM Integration Bus is an Enterprise Service Bus ESB product that provides connectivity and common data transformation for Service Oriented Architecture SOA environments and...

deep-assign 安全漏洞

deep-assign is an npm package. A security vulnerability exists in the npm package deep.assign version 0.0.0-alpha.0, which is vulnerable to "prototype contamination"...

Underscore.deep 安全漏洞

Underscore.deep is an open source utility program for manipulating nested objects from Clever USA. A security vulnerability exists in versions of Underscore.deep prior to 0.5.3, which stems from vulnerability to a prototype contamination vulnerability that can be exploited by an attacker to craft...

querymen 安全漏洞

querymen is an individual developer's query string parser middleware for MongoDB, Express, and Nodejs. A security vulnerability exists in querymen that stems from the middleware's susceptibility to prototype contamination...

GHSA-P332-FW36-4HQX Caucho Quercus, as distributed in Resin, does not properly handle unspecified characters in the names of variables

Caucho Quercus, as distributed in Resin before 4.0.29, does not properly handle unspecified characters in the names of variables, which has unknown impact and remote attack vectors, related to an "HTTP Parameter Contamination" issue...

Caucho Quercus, as distributed in Resin, does not properly handle unspecified characters in the names of variables

Caucho Quercus, as distributed in Resin before 4.0.29, does not properly handle unspecified characters in the names of variables, which has unknown impact and remote attack vectors, related to an "HTTP Parameter Contamination" issue...

convict 安全漏洞

convict is a featured configuration management library for Node.js. A security vulnerability exists in versions prior to convict 6.2.2, which stems from the lack of parentKey validation and is susceptible to prototype contamination of the convict function...

Lukeed Dset 安全漏洞

Lukeed Dset is a codebase by the individual developer of Lukeed that can assign values to objects of dictionary type based on the Javascript language. A security vulnerability exists in all versions of Lukeed Dset, which can be exploited by an attacker to implement a prototype contamination attac...

nconf has unspecified vulnerabilities

nconf is a TOML-formatted plugin. nconf versions prior to 0.11.4 have a security vulnerability that stems from the .set function, which is responsible for setting configuration properties, being vulnerable to prototype contamination, which can be exploited by attackers to override JavaScript...

nconf 安全漏洞

nconf is a TOML-formatted plugin. nconf versions prior to 0.11.4 have a security vulnerability that stems from the .set function, which is responsible for setting configuration properties, being vulnerable to prototype contamination, which can be exploited by attackers to override JavaScript...

fullpage.js 安全漏洞

fullPage.js is an easy-to-use library for creating full-screen scrolling websites also known as single-page websites or mono-page websites and adding horizontal sliders to various parts of the website. A security vulnerability previously existed in fullpage.js version 4.0.2, which stemmed from...

deepmerge-ts 安全漏洞

deepmerge-ts is an npm package. It is used to deep merge 2 or more objects with respect to type information. A security vulnerability exists in deepmerge-ts that stems from prototype contamination in the defaultMergeRecords function of the deepmerge.ts file...

Simple-Plist 安全漏洞

Simple-Plist is a simple API for interacting with binary and plain text Plist data from Joe Wollard, a personal developer in the US. A security vulnerability exists in wollardj Simple-Plist v1.3.0, which stems from a prototype contamination vulnerability in .parse...

Minimist has an unspecified vulnerability

minimist is a command-line parameter parsing tool. minimist suffers from a security vulnerability that stems from vulnerability to prototype contamination via the file index.js, function setKey. No details of the vulnerability are currently available...

bodymen 安全漏洞

bodymen is a body parser middleware for MongoDB, Express and Nodejs MEN. bodymen suffers from a security vulnerability that stems from the susceptibility of handler functions to prototype contamination. An attacker can exploit the vulnerability to add or modify properties of Object.prototype usin...

Sails.js 注入漏洞

Sails.js is a Node.js-based web application framework from Sails, Inc. Sails.js suffers from an injection vulnerability that originates in the loadActionModules function in controller/load-action-modules.js, which is susceptible to a prototype contamination vulnerability. The vulnerability affect...