Defending Elections from Foreign Adversaries: Election Buster

Election Buster is an open source tool created in 2014 to identify malicious domains masquerading as candidate webpages and voter registration systems. During 2016, fake domains were used to compromise credentials of a Democratic National Committee DNC IT services company, and foreign adversaries...

Friday Squid Blogging: New Tool for Grabbing Squid and other Fragile Sea Creatures

Interesting video of a robot grabber that's delicate enough to capture squid and even jellyfish in the ocean. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

GHSA-CQP5-M4PQ-GFGP Prototype Pollution in defaults-deep

Versions of default-deep before 0.2.4 are vulnerable to prototype pollution Recommendation Update to version 0.2.4 or later...

@risingstack/trace (2.0.1), democracyos-notifier (>=1.3.0, <=2.1.3) +1 more potentially affected by CVE-2018-3723 via defaults-deep (0.2.3)

defaults-deep NPM version 0.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on defaults-deep and may be impacted: - @risingstack/trace 2.0.1 - democracyos-notifier =1.3.0, =2.1.3 - oddvoter-notifier 1.1.1 Source cves: CVE-2018-3723 Source advisory:...

GHSA-9G9W-HMVJ-5H57 Prototype Pollution in merge-deep

Versions of merge-deep before 3.0.1 are vulnerable to prototype pollution via merging functions. Recommendation Update to version 3.0.1 or later...

eslint-config-vascular (>=0.0.1, <=0.0.3), udger-updater-nodejs (>=1.0.0, <=1.0.2) potentially affected by CVE-2018-3722 via merge-deep (3.0.0)

merge-deep NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on merge-deep and may be impacted: - eslint-config-vascular =0.0.1, =1.0.0, =1.0.2 Source cves: CVE-2018-3722 Source advisory: OSV:GHSA-9G9W-HMVJ-5H57...

Prototype Pollution in merge-deep

Versions of merge-deep before 3.0.1 are vulnerable to prototype pollution via merging functions. Recommendation Update to version 3.0.1 or later...

@careteam/mfe-init (0.0.8), @topfeed/topfeed (>=0.0.30, <=0.0.44) +68 more potentially affected by CVE-2018-3720 via assign-deep (>=0.1.2, <=0.4.6)

assign-deep NPM version =0.1.2, =0.0.30, =0.0.1, =1.0.0, =0.0.1, =0.1.0, =1.0.0, =1.2.0, =0.0.1, =1.0.0-alpha.5, =1.0.0-alpha.5, =0.0.1, =0.0.1, =1.0.0-alpha.5, =2.3.0 and more Source cves: CVE-2018-3720 Source advisory: OSV:GHSA-XCVV-84J5-JW9H...

GHSA-XCVV-84J5-JW9H Prototype Pollution in assign-deep

Versions of assign-deep before 0.4.7 are vulnerable to prototype pollution via merging functions. Recommendation Update to version 0.4.7 or later...

Prototype Pollution in assign-deep

Versions of assign-deep before 0.4.7 are vulnerable to prototype pollution via merging functions. Recommendation Update to version 0.4.7 or later...

GHSA-3MPR-HQ3P-49H9 Prototype Pollution in mixin-deep

Versions of mixin-deep before 1.3.1 are vulnerable to prototype pollution via merging functions. Recommendation Update to version 1.3.1 or later...

clam-util (>=0.0.5, <=0.1.20), generator-clam (>=0.1.68, <=0.1.86) +2 more potentially affected by CVE-2018-3719 via mixin-deep (1.0.1)

mixin-deep NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on mixin-deep and may be impacted: - clam-util =0.0.5, =0.1.68, =0.3.0-alpha.2, =0.4.12 - grunt-formatdata 0.1.1 Source cves: CVE-2018-3719 Source advisory: OSV:GHSA-3MPR-HQ3P-49...

Prototype Pollution in mixin-deep

Versions of mixin-deep before 1.3.1 are vulnerable to prototype pollution via merging functions. Recommendation Update to version 1.3.1 or later...

Node.js third-party modules: Prototype pollution attack (defaults-deep / constructor.prototype)

I would like to report a prototype pollution vulnerability in defaults-deep. It allows an attacker to inject properties on Object.prototype. Module module name: defaults-deep version: 0.2.4 npm page: https://www.npmjs.com/package/defaults-deep Module Description Like extend but recursively copies...

Code injection

The utilities function in all versions = 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all object...

CVE-2018-3750

The utilities function in all versions = 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all object...

CVE-2018-3750

The utilities function in all versions = 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all object...

CVE-2018-3750

The utilities function in all versions = 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all object...

DEBIAN-CVE-2018-3750

The utilities function in all versions = 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all object...

UBUNTU-CVE-2018-3750

The utilities function in all versions = 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all object...