2783 matches found
GHSA-9G9W-HMVJ-5H57 Prototype Pollution in merge-deep
Versions of merge-deep before 3.0.1 are vulnerable to prototype pollution via merging functions. Recommendation Update to version 3.0.1 or later...
eslint-config-vascular (>=0.0.1, <=0.0.3), udger-updater-nodejs (>=1.0.0, <=1.0.2) potentially affected by CVE-2018-3722 via merge-deep (3.0.0)
merge-deep NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on merge-deep and may be impacted: - eslint-config-vascular =0.0.1, =1.0.0, =1.0.2 Source cves: CVE-2018-3722 Source advisory: OSV:GHSA-9G9W-HMVJ-5H57...
Prototype Pollution in merge-deep
Versions of merge-deep before 3.0.1 are vulnerable to prototype pollution via merging functions. Recommendation Update to version 3.0.1 or later...
Prototype Pollution in assign-deep
Versions of assign-deep before 0.4.7 are vulnerable to prototype pollution via merging functions. Recommendation Update to version 0.4.7 or later...
@careteam/mfe-init (0.0.8), @topfeed/topfeed (>=0.0.30, <=0.0.44) +68 more potentially affected by CVE-2018-3720 via assign-deep (>=0.1.2, <=0.4.6)
assign-deep NPM version =0.1.2, =0.0.30, =0.0.1, =1.0.0, =0.0.1, =0.1.0, =1.0.0, =1.2.0, =0.0.1, =1.0.0-alpha.5, =1.0.0-alpha.5, =0.0.1, =0.0.1, =1.0.0-alpha.5, =2.3.0 and more Source cves: CVE-2018-3720 Source advisory: OSV:GHSA-XCVV-84J5-JW9H...
GHSA-XCVV-84J5-JW9H Prototype Pollution in assign-deep
Versions of assign-deep before 0.4.7 are vulnerable to prototype pollution via merging functions. Recommendation Update to version 0.4.7 or later...
Prototype Pollution in mixin-deep
Versions of mixin-deep before 1.3.1 are vulnerable to prototype pollution via merging functions. Recommendation Update to version 1.3.1 or later...
clam-util (>=0.0.5, <=0.1.20), generator-clam (>=0.1.68, <=0.1.86) +2 more potentially affected by CVE-2018-3719 via mixin-deep (1.0.1)
mixin-deep NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on mixin-deep and may be impacted: - clam-util =0.0.5, =0.1.68, =0.3.0-alpha.2, =0.4.12 - grunt-formatdata 0.1.1 Source cves: CVE-2018-3719 Source advisory: OSV:GHSA-3MPR-HQ3P-49...
GHSA-3MPR-HQ3P-49H9 Prototype Pollution in mixin-deep
Versions of mixin-deep before 1.3.1 are vulnerable to prototype pollution via merging functions. Recommendation Update to version 1.3.1 or later...
Node.js third-party modules: Prototype pollution attack (defaults-deep / constructor.prototype)
I would like to report a prototype pollution vulnerability in defaults-deep. It allows an attacker to inject properties on Object.prototype. Module module name: defaults-deep version: 0.2.4 npm page: https://www.npmjs.com/package/defaults-deep Module Description Like extend but recursively copies...
CVE-2018-3750
The utilities function in all versions = 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all object...
CVE-2018-3750
The utilities function in all versions = 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all object...
Code injection
The utilities function in all versions = 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all object...
DEBIAN-CVE-2018-3750
The utilities function in all versions = 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all object...
UBUNTU-CVE-2018-3750
The utilities function in all versions = 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all object...
CVE-2018-3750
The utilities function in all versions = 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all object...
CVE-2018-3750
The utilities function in all versions = 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all object...
CVE-2018-3750
CVE-2018-3750 - mode C (concrete details provided) Affected software: the deep-extend Node.js module, specifically all versions
CVE-2018-3750
The utilities function in all versions = 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all object...
CVE-2018-3750
The utilities function in all versions = 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all object...