PT-2019-12025

Name of the Vulnerable Software and Affected Versions deeply versions prior to 3.1.0 deeply versions prior to 1.0.1 Description The issue concerns Prototype Pollution. The assign-deep function in deeply can be tricked into adding or modifying properties of Object.prototype using a proto payload...

PT-2019-12022 · Npm +4 · Mixin-Deep +4

Name of the Vulnerable Software and Affected Versions: mixin-deep versions prior to 1.3.2 mixin-deep versions prior to 2.0.1 Description: The issue concerns Prototype Pollution, where the mixin-deep function can be tricked into adding or modifying properties of Object.prototype using a constructo...

CVE-2019-10750: Uncontrolled Resource Consumption

deeply is vulnerable to Prototype Pollution in versions before 3.1.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using using a proto payload...

@peak-stone/vue-admin (>=1.0.1, <=2.1.1) potentially affected by CVE-2019-10745 via assign-deep (1.0.0)

assign-deep NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on assign-deep and may be impacted: - @peak-stone/vue-admin =1.0.1, =2.1.1 Source cves: CVE-2019-10745 Source advisory: OSV:GHSA-66RH-8FW6-59Q6...

@careteam/mfe-init (0.0.8), @topfeed/topfeed (>=0.0.30, <=0.0.44) +69 more potentially affected by CVE-2019-10745 via assign-deep (>=0.1.2, <=0.4.7)

assign-deep NPM version =0.1.2, =0.0.30, =0.0.1, =1.0.0, =0.0.1, =0.1.0, =1.0.0, =1.2.0, =0.0.1, =1.0.0-alpha.5, =1.0.0-alpha.5, =0.0.1, =0.0.1, =1.0.0-alpha.5, =2.3.0 and more Source cves: CVE-2019-10745 Source advisory: OSV:GHSA-66RH-8FW6-59Q6...

GHSA-66RH-8FW6-59Q6 assign-deep Vulnerable to Prototype Pollution

Versions of assign-deep prior to 1.0.1 and 0.4.8 are vulnerable to Prototype Pollution. The assign function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects...

assign-deep Vulnerable to Prototype Pollution

Versions of assign-deep prior to 1.0.1 and 0.4.8 are vulnerable to Prototype Pollution. The assign function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects...

@careteam/mfe-init (0.0.8), @topfeed/topfeed (>=0.0.30, <=0.0.44) +69 more potentially affected by CVE-2019-10745 via assign-deep (>=0.1.2, <=0.4.7)

assign-deep NPM version =0.1.2, =0.0.30, =0.0.1, =1.0.0, =0.0.1, =0.1.0, =1.0.0, =1.2.0, =0.0.1, =1.0.0-alpha.5, =1.0.0-alpha.5, =0.0.1, =0.0.1, =1.0.0-alpha.5, =2.3.0 and more Source cves: CVE-2019-10745 Source advisory: GHSA-66RH-8FW6-59Q6...

@peak-stone/vue-admin (>=1.0.1, <=2.1.1) potentially affected by CVE-2019-10745 via assign-deep (1.0.0)

assign-deep NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on assign-deep and may be impacted: - @peak-stone/vue-admin =1.0.1, =2.1.1 Source cves: CVE-2019-10745 Source advisory: GHSA-66RH-8FW6-59Q6...

CVE-2019-10745

assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a proto payload...

CVE-2019-10745

assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a proto payload...

Design/Logic Flaw

assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a proto payload...

CVE-2019-10745

assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a proto payload...

@careteam/mfe-init (0.0.8), @topfeed/topfeed (>=0.0.30, <=0.0.44) +69 more potentially affected by CVE-2019-10745 via assign-deep (>=0.1.2, <=0.4.7)

assign-deep NPM version =0.1.2, =0.0.30, =0.0.1, =1.0.0, =0.0.1, =0.1.0, =1.0.0, =1.2.0, =0.0.1, =1.0.0-alpha.5, =1.0.0-alpha.5, =0.0.1, =0.0.1, =1.0.0-alpha.5, =2.3.0 and more Source cves: CVE-2019-10745 Source advisory: MEND:CVE-2019-10745...

@peak-stone/vue-admin (>=1.0.1, <=2.1.1) potentially affected by CVE-2019-10745 via assign-deep (1.0.0)

assign-deep NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on assign-deep and may be impacted: - @peak-stone/vue-admin =1.0.1, =2.1.1 Source cves: CVE-2019-10745 Source advisory: MEND:CVE-2019-10745...

CVE-2019-10745

The CVE-2019-10745 entry concerns the assign-deep module, which is vulnerable to Prototype Pollution. Affected versions are before 0.4.8 and version 1.0.0, where the assign-deep function could be tricked into adding or modifying properties of Object.prototype via a constructor or proto payload. T...

CVE-2019-10745

assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a proto payload...

CVE-2019-10745: Improperly Controlled Modification of Object Prototype Attributes

assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a proto payload...

Trend Micro Deep Discovery Inspector Percent Encoding IDS Bypass

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/TREND-MICRO-DEEP-DISCOVERY-INSPECTOR-PERCENT-ENCODING-IDS-BYPASS.txt + ISR: Apparition Security Vendor www.trendmicro.com Product Deep Discovery Inspector Deep Discovery...

Neo-Nazi SWATters Target Dozens of Journalists

Nearly three dozen journalists at a broad range of major publications have been targeted by a far-right group that maintains a Deep Web database listing the personal information of people who threaten their views. This group specializes in encouraging others to harass those targeted by their ire,...