2784 matches found
CVE-2020-7746
This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options or the defaults options are deeply merged with provided options. However, during this operation, the keys of the object being...
PT-2020-19764 · Tsed · @Tsed/Core
Name of the Vulnerable Software and Affected Versions: @tsed/core versions prior to 5.65.7 Description: This issue relates to the deepExtend function, part of the utils directory. Depending on user input, an attacker can overwrite and pollute the object prototype of a program. Recommendations: Fo...
Security Unlocked—A new podcast exploring the people and AI that power Microsoft Security solutions
It’s hard to keep pace with all the changes happening in the world of cybersecurity. Security experts and leaders must continue learning and unlearning to stay ahead of the ever-evolving threat landscape. In fact, many of us are in this field because of our desire to continuously challenge...
Detecting Deep Fakes with a Heartbeat
Researchers can detect deep fakes because they dont convincingly mimic human blood circulation in the face: In particular, video of a persons face contains subtle shifts in color that result from pulses in blood circulation. You might imagine that these changes would be too minute to detect merel...
The vulnerabilities of Trend Micro Vulnerability Protection and Trend Micro Deep Security Manager, related to authentication deficiencies, allow attackers to enhance their privileges.
The vulnerabilities of Trend Micro Vulnerability Protection and Trend Micro Deep Security Manager are related to authentication deficiencies. Exploiting these vulnerabilities can allow attackers, operating remotely, to increase their privileges...
The vulnerabilities of Trend Micro Vulnerability Protection and Trend Micro Deep Security Manager, related to authentication deficiencies, allow attackers to enhance their privileges.
The vulnerabilities of Trend Micro Vulnerability Protection and Trend Micro Deep Security Manager are related to authentication deficiencies. Exploiting these vulnerabilities can allow attackers, operating remotely, to increase their privileges...
Prototype Pollution in deep-setter
All versions of deep-setter are vulnerable to prototype pollution. The package does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects. Recommendation No fix is currently available. Consider usin...
arupex (>=0.4.0, <=0.4.4), captain-ahab (1.0.0) +11 more potentially affected by unknown CVE via deep-setter (1.0.2)
deep-setter NPM version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on deep-setter and may be impacted: - arupex =0.4.0, =2.3.4, =3.0.0, =1.0.0, =1.0.0, =0.0.1, =1.0.0, =1.0.18, =0.0.7, =0.0.1, =0.0.6 Source cves: unknown CVE Source advisory:...
GHSA-9QRG-H9G8-C65Q Prototype Pollution in deep-setter
All versions of deep-setter are vulnerable to prototype pollution. The package does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects. Recommendation No fix is currently available. Consider usin...
PT-2020-21206
Name of the Vulnerable Software and Affected Versions deep-setter versions affected versions not specified Description The issue concerns prototype pollution, where the package does not restrict the modification of an Object's prototype. This may allow an attacker to add or modify an existing...
GHSA-46FH-8FC5-XCWX Prototype Pollution in lodash.defaultsdeep
Versions of lodash.defaultsdeep before 4.6.1 are vulnerable to Prototype Pollution. The function 'defaultsDeep' may allow a malicious user to modify the prototype of Object via proto causing the addition or modification of an existing property that will exist on all objects. Recommendation Update...
Prototype Pollution in smart-extend
All versions of smart-extend are vulnerable to Prototype Pollution. The deep function allows attackers to modify the prototype of Object causing the addition or modification of an existing property that will exist on all objects. Recommendation No fix is currently available. Consider using an...
GHSA-F8H3-RQRM-47V9 Prototype Pollution in smart-extend
All versions of smart-extend are vulnerable to Prototype Pollution. The deep function allows attackers to modify the prototype of Object causing the addition or modification of an existing property that will exist on all objects. Recommendation No fix is currently available. Consider using an...
Prototype Pollution
deep-get-set is vulnerable to prototype pollution. The vulnerability exists as the main function does not restrict proto, constructor and prototype headers to be set in objects...
PT-2020-21268
Name of the Vulnerable Software and Affected Versions smart-extend versions all Description The issue allows attackers to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects. This is achieved through the deep function...
gfe (1.1.0) potentially affected by CVE-2017-16040 via gfe-sass (1.0.19)
gfe-sass NPM version 1.0.19 is affected by a known vulnerability. The following packages have a transitive dependency on gfe-sass and may be impacted: - gfe 1.1.0 Source cves: CVE-2017-16040 Source advisory: OSV:GHSA-72Q2-5RXX-XFFF...
CVE-2020-7715
All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function...
CVE-2020-7715
CVE-2020-7715 affects the npm package deep-get-set . The vulnerability is a prototype pollution flaw in the main function, arising from an incomplete fix, allowing an attacker to pollute Object.prototype (e.g., via the key path "proto " or related paths). Affected versions are those before the re...
