dojo 安全漏洞

dojo is a JavaScript toolkit that contains utilities, UI components, and more. A security vulnerability exists in dojo that stems from the software's susceptibility to Prototype contamination via the setObject function...

comb 代码问题漏洞

comb is a node framework that provides a one-stop shop for frequently needed utilities. A code issue exists in Comb where the product is susceptible to prototype contamination from the mergeDeep function. The following products and versions are affected:...

merge-deep 代码问题漏洞

merge-deep is an open source tool . It is used to recursively merge values in JavaScript objects. A code issue vulnerability exists in Nerge-deep2 that stems from the product's susceptibility to prototype contamination by the mergeDeep function. The following products and versions are affected:...

Eserozvataf Sey 代码问题漏洞

Eserozvataf Sey is a simple JavaScript bundler with declarative and simple configuration. A code issue vulnerability exists in Eserozvataf Sey, which arises from the product's susceptibility to prototype contamination by the deepmerge function. The following products and versions are affected:...

Fortinet FortiWLM SQL注入漏洞

Fortinet FortiWLM is a wireless manager from Fortinet, Inc. An SQL injection vulnerability exists in Fortinet FortiWLM versions 8.6.1 and below, which can be exploited by attackers to contaminate database data and extract sensitive information via crafted HTTP requests to be sent to alarms and...

algoliasearch-helper 安全漏洞

algoliasearch-helper is an open source JavaScript module that helps you keep track of search parameters and provides a higher level API. A security vulnerability exists in algoliasearch-helper, which stems from the package algoliassearch -helper prior to 3.6.2, as parseNumbers has no protection f...

CVE-2021-35225

Each authenticated Orion Platform user in a MSP Managed Service Provider environment can view and browse all NetPath Services from all that MSP's customers. This can lead to any user having a limited insight into other customer's infrastructure and potential data cross-contamination...

Cross site scripting

Each authenticated Orion Platform user in a MSP Managed Service Provider environment can view and browse all NetPath Services from all that MSP's customers. This can lead to any user having a limited insight into other customer's infrastructure and potential data cross-contamination...

CVE-2021-35225

CVE-2021-35225 affects SolarWinds Orion Platform in MSP environments. The issue allows an authenticated MSP user to view NetPath Services across multiple customers, enabling cross-tenant visibility and potential data exposure. Exploitation details are not provided in the sources. Remediation is c...

CVE-2021-35225 Netpath Horizontal Privilege Escalation Vulnerability: NPM 2020.2.5

Each authenticated Orion Platform user in a MSP Managed Service Provider environment can view and browse all NetPath Services from all that MSP's customers. This can lead to any user having a limited insight into other customer's infrastructure and potential data cross-contamination...

x-assign 安全漏洞

X-assign is an Object.assign package. It is used to merge nested objects and concatenate arrays. A security vulnerability exists in x-assign, which stems from the fact that the software's global prototype object can be contaminated by the proto prototype object...

Config Handler 安全漏洞

Config Handler is an open source package. It is used for loading configurations, deep merging packages, global, and environments. Config Handler has a security vulnerability that stems from the fact that all versions of the package configuration handler are susceptible to prototype contamination...

object-path 安全漏洞

object-path is an Npm library for individual developers to access variables in data structures via paths. A security vulnerability exists in object-path, which stems from the vulnerability of object paths to uncontrolled modification of object prototype attributes prototype contamination...

Cookiex-Deep 安全漏洞

Cookiex-Deep is a library. It is used to add object recursion to a target. Cookiex-Deep has a security vulnerability that can be exploited by an attacker to cause proto objects to contaminate global proto objects...

objection.js 安全漏洞

objection.js is a SQL-friendly ORM for Node.js. A security vulnerability exists in objection.js that stems from the vulnerability of objection.js to "prototype contamination" due to improper control of object prototype properties...

Proto安全漏洞

Proto is an open source, extensible program code template for creating objects. A security vulnerability exists in Proto that stems from the ability to contaminate an application with object property injections...

merge-change 软件包安全漏洞

merge-change is an open source simple library for deep merging of objects and other types, also for patching and immutable new. The merge-change package has a security vulnerability that makes the package susceptible to prototype contamination via the utils.set function...

deepmergefn has unspecified vulnerabilities

deepmergefn is an application. A deepmergefn mixes two data objects. deepmergefn suffers from a security vulnerability that stems from vulnerability to prototype contamination via the deepMerge function, which can be exploited by attackers to cause remote code execution...

deepmergefn 安全漏洞

deepmergefn is an application. A deepmergefn mixes two data objects. deepmergefn suffers from a security vulnerability that stems from vulnerability to prototype contamination via the deepMerge function, which can be exploited by attackers to cause remote code execution...

putil-merge 安全漏洞

putil-merge is an open source solution for merging two or more objects. It supports deep merging, cloning attributes, copying descriptors and filtering. A security vulnerability exists in putil-merge, which stems from a prototype contamination vulnerability in "putil-merge" versions 1.0.0 through...