minimist 安全漏洞

minimist is a command-line parameter parsing tool. minimist suffers from a security vulnerability that stems from vulnerability to prototype contamination via the file index.js, function setKey. No details of the vulnerability are currently available...

notevil 注入漏洞

notevil is an open source npm package. notevil suffers from an injection vulnerability that stems from a failure to restrict access to the main context, which allows an attacker to add or modify the prototype of an object. It is susceptible to sandbox escapes, which can lead to prototype...

jQuery 代码问题漏洞

jQuery is the United States John Resig individual developers of a set of open source , cross-browser JavaScript library . The library simplifies operations between HTML and JavaScript and features modularity, plug-in extensions, and more. A code issue vulnerability exists in Jquery Cookie, which...

Prototype JavaScript framework 代码注入漏洞

Prototype JavaScript framework prototypejs is a JavaScript development framework. A code injection vulnerability exists in Prototype JavaScript framework, which stems from the vulnerability of object-extend to prototype contamination from version 0.0.0 onwards...

cached-path-relative 安全漏洞

cached-path-relative is an open source npm package. A security vulnerability exists in cached-path-relative prior to version 1.1.0, which stems from a problematic implementation of cache variable settings. The software is susceptible to prototype contamination...

min-dash 安全漏洞

min-dash is a minimal utility belt for use with bpmn.io related libraries. A security vulnerability exists in versions prior to min-dash 3.8.1, which stems from the lack of critical type enforcement and makes the software susceptible to prototype contamination via the set method...

Realm Shim 代码注入漏洞

Realm Shim is This folder contains the shim implementation of the Realm API Proposal. Realm Shim has a code injection vulnerability that stems from. All versions of the package domain shim are prone to sandbox bypass via prototype contamination attack vectors...

Realm Shim 安全漏洞

Realm Shim is the shim implementation of this folder containing the Realm API Proposal. A security vulnerability exists in Realm Shim that allows attackers to sandbox bypass via prototype contamination attack vectors...

OroPlatform 注入漏洞

OroPlatform is a PHP Business Application Platform BAP designed to make the development of custom business applications easier and faster. OroPlatform suffers from a security vulnerability that stems from the software's lack of effective filtering and escaping of JavaScript attributes. By sending...

js-data 安全漏洞

js-data is a framework-agnostic, datastore-agnostic ORM for Node.js and browsers. A security vulnerability exists in js-data that stems from packages being susceptible to prototype contamination via the deepFillIn and set functions...

dojo 安全漏洞

dojo is a JavaScript toolkit that contains utilities, UI components, and more. A security vulnerability exists in dojo that stems from the software's susceptibility to Prototype contamination via the setObject function...

Eserozvataf Sey 代码问题漏洞

Eserozvataf Sey is a simple JavaScript bundler with declarative and simple configuration. A code issue vulnerability exists in Eserozvataf Sey, which arises from the product's susceptibility to prototype contamination by the deepmerge function. The following products and versions are affected:...

comb 代码问题漏洞

comb is a node framework that provides a one-stop shop for frequently needed utilities. A code issue exists in Comb where the product is susceptible to prototype contamination from the mergeDeep function. The following products and versions are affected:...

merge-deep 代码问题漏洞

merge-deep is an open source tool . It is used to recursively merge values in JavaScript objects. A code issue vulnerability exists in Nerge-deep2 that stems from the product's susceptibility to prototype contamination by the mergeDeep function. The following products and versions are affected:...

Fortinet FortiWLM SQL注入漏洞

Fortinet FortiWLM is a wireless manager from Fortinet, Inc. An SQL injection vulnerability exists in Fortinet FortiWLM versions 8.6.1 and below, which can be exploited by attackers to contaminate database data and extract sensitive information via crafted HTTP requests to be sent to alarms and...

algoliasearch-helper 安全漏洞

algoliasearch-helper is an open source JavaScript module that helps you keep track of search parameters and provides a higher level API. A security vulnerability exists in algoliasearch-helper, which stems from the package algoliassearch -helper prior to 3.6.2, as parseNumbers has no protection f...

CVE-2021-35225

Each authenticated Orion Platform user in a MSP Managed Service Provider environment can view and browse all NetPath Services from all that MSP's customers. This can lead to any user having a limited insight into other customer's infrastructure and potential data cross-contamination...

Cross site scripting

Each authenticated Orion Platform user in a MSP Managed Service Provider environment can view and browse all NetPath Services from all that MSP's customers. This can lead to any user having a limited insight into other customer's infrastructure and potential data cross-contamination...

CVE-2021-35225 Netpath Horizontal Privilege Escalation Vulnerability: NPM 2020.2.5

Each authenticated Orion Platform user in a MSP Managed Service Provider environment can view and browse all NetPath Services from all that MSP's customers. This can lead to any user having a limited insight into other customer's infrastructure and potential data cross-contamination...

CVE-2021-35225

CVE-2021-35225 affects SolarWinds Orion Platform in MSP environments. The issue allows an authenticated MSP user to view NetPath Services across multiple customers, enabling cross-tenant visibility and potential data exposure. Exploitation details are not provided in the sources. Remediation is c...