GHSA-CQQH-49MX-FQ63 merge vulnerable to Prototype Pollution

merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

CVE-2021-3666

body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

CVE-2021-3666

body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

CVE-2021-3666 Prototype Pollution in fiznool/body-parser-xml

body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

DAO proposals can be executed by anyone due to vulnerable TimelockController

Handle cmichel Vulnerability details Vulnerability Details The GovernorAlpha inherits from a vulnerable TimelockController. This TimelockController allows an EXECUTOR role to escalate privileges and also gain the proposer role. See details on OZ and the fix here. The bug is that executeBatch chec...

Prototype Pollution in immer

immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

Session fixation

Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protection when they can force a target client to use a controlled cookie...

CVE-2021-3766

objection.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

CVE-2021-3766

objection.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

CVE-2021-3757 Prototype Pollution in immerjs/immer

immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

CVE-2021-3757

immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

GHSA-VWHC-PWW7-72X6 Code Injection in total.js

Total.js framework npm package total.js is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. In total.js framework before version 3.4.9, calling the utils.set function with user-controlled values leads to code-injection. This c...

Cross-site Scripting (XSS) - Stored in zikula-modules/content

✍️ Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites 🕵️‍♂️ Proof of Concept // PoC.js 1- Go to -- https://demo.ziku.la/content/page/edit/PAGEID?slug=pages/content-introduction-page 2- inject this...

total.js 代码注入漏洞

total.js is open source a framework developed using JavaScript for the Node.js platform. It can be used to develop web, desktop, service and IoT platforms. Total.js suffers from a code injection vulnerability that stems from a call to the utils.set function with a user-controlled value in the...

Arbitrary Code Execution

Overview Affected versions of this package are vulnerable to Arbitrary Code Execution. If the command parameter of the Docker.command method can at least be partially controlled by a user, they will be in a position to execute any arbitrary OS commands on the host system. Steps to Reproduce 1...

Code injection

User controlled request.getHeader"Referer", request.getRequestURL and request.getQueryString are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially crafted Referer header programmatically. Since the attacker controls the string and the...

UPchieve: Widespread CSRF on authenticated POST endpoints

Summary: Cross-Site Request Forgery CSRF is possible on most, if not all, authenticated POST endpoints. While CORS is configured such that the Access-Control-Allow-Origin header is set to Access-Control-Allow-Origin: hackers.upchieve.org, CORS does not prevent CSRF - it only prevents the attacker...

DEBIAN-CVE-2021-39242

An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It can lead to a situation with an attacker-controlled HTTP Host header, because a mismatch between Host and authority is mishandled...

CVE-2021-21813

AT&T Labs Xmill 0.7 contains a stack-based buffer overflow in the command-line handle argument path. In HandleFileArg, the filepattern supplied by the user is copied into a fixed-size buffer (400 bytes) via unsafe copy operations (memcpy/strcpy/strlen), without proper length checks. This can over...

apache-commons-compress: Infinite loop in name encoding algorithm

A resource consumption vulnerability was discovered in apache-commons-compress in the way NioZipEncoding encodes filenames. Applications that use Compress to create archives, with one of the filenames within the archive being controlled by the user, may be vulnerable to this flaw. A remote attack...