Weak Password Vulnerability in Deep Integrity Gateway MIG

All-in-one gateway MIG can provide an integrated solution for SME customers, meet the diversified needs of large enterprise branches, and realize a full range of cost-effective solutions from flexible networking to business control. A weak password vulnerability exists in DeepTrust Integrated...

Prototype Pollution

Overview set-deep-prop is a Set the value of a deeply nested object or array Affected versions of this package are vulnerable to Prototype Pollution via the main functionality. PoC const setDeepProp = require'set-deep-prop'; setDeepProp,'proto', 'x', 'polluted'; console.log.a; // polluted Details...

bedrock (0.1.0.dev10), dbcollection (>=0.2.2, <=0.2.6) +19 more potentially affected by CVE-2021-27923 via pillow (5.1.0)

pillow PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - bedrock 0.1.0.dev10 - dbcollection =0.2.2, =0.0.6, =1.0.0, =0.0.0a1, =0.1.0, =4.0.0, =4.0.0, =4.0.0, =4.1.1 and more Source cves: CVE-2021-27923...

bedrock (0.1.0.dev10), dbcollection (>=0.2.2, <=0.2.6) +19 more potentially affected by CVE-2021-27921 via pillow (5.1.0)

pillow PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - bedrock 0.1.0.dev10 - dbcollection =0.2.2, =0.0.6, =1.0.0, =0.0.0a1, =0.1.0, =4.0.0, =4.0.0, =4.0.0, =4.1.1 and more Source cves: CVE-2021-27921...

Google Android Input Verification Vulnerability

Google Android is a Linux-based open source operating system from Google and the Open Handset Alliance OHA. Google Android suffers from an elevation of privilege vulnerability. The vulnerability stems from an input validation error in DeltaPerformer :: Write in deltaperformer.cc. An attacker can...

Weak Password Vulnerability in DeepSync IPSec VPNs

DeepTrust IPSec VPN provides an all-in-one networking solution for small and medium-sized branches. There is a weak password vulnerability in the DeepSync IPSec VPN. Attackers utilize the vulnerability to log into the system background and obtain sensitive information...

Code Injection in jeikeilim/kindle

Description Kindle is an easy model build package for PyTorch. Building a deep learning model became so simple that almost all model can be made by copy and paste from other existing model codes, which is vulnerable to Arbitary Code Execution. Vulnerability Vulnerable to YAML deserialization atta...

nodejs-mixin-deep: prototype pollution in function mixin-deep

A flaw was found in Nodejs's mixin-deep prior to versions 1.3.2 and 2.0.0. The mixin-deep function could be used to add or modify properties of the Object.prototype. The highest threat from this vulnerability is to system availability...

nodejs-deep-extend: Prototype pollution can allow attackers to modify object properties

The utilities function in all versions = 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all object...

nodejs-set-value: prototype pollution in function set-value

A flaw was found in nodejs-set-value. The function mixin-deep can be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or proto payloads. The highest threat from this vulnerability is to data confidentiality and integrity...

Unpatched ShareIT Android App Flaw Could Let Hackers Inject Malware

Multiple unpatched vulnerabilities have been discovered in SHAREit, a popular app with over one billion downloads, that could be abused to leak a user's sensitive data, execute arbitrary code, and possibly lead to remote code execution. The findings come from cybersecurity firm Trend Micro's...

Unpatched ShareIT Android App Flaw Could Let Hackers Inject Malware

Multiple unpatched vulnerabilities have been discovered in SHAREit, a popular app with over one billion downloads, that could be abused to leak a user's sensitive data, execute arbitrary code, and possibly lead to remote code execution. The findings come from cybersecurity firm Trend Micro's...

Darkdump - Search The Deep Web Straight From Your Terminal

Darkdump is a simple script written in Python3.9 in which it allows users to enter a search term query in the command line and darkdump will pull all the deep web sites relating to that query. Darkdump wraps up the darksearch.io API. Installation 1. git clone https://github.com/josh0xA/darkdump 2...

nodejs-deep-extend: Prototype pollution can allow attackers to modify object properties

The utilities function in all versions = 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all object...

nodejs-mixin-deep: prototype pollution in function mixin-deep

A flaw was found in Nodejs's mixin-deep prior to versions 1.3.2 and 2.0.0. The mixin-deep function could be used to add or modify properties of the Object.prototype. The highest threat from this vulnerability is to system availability...

nodejs-set-value: prototype pollution in function set-value

A flaw was found in nodejs-set-value. The function mixin-deep can be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or proto payloads. The highest threat from this vulnerability is to data confidentiality and integrity...

CVE-2021-26707

The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library...

Prototype Pollution in sttk/fav-prop.set-deep

Description @fav/prop.set-deep is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: javascript // poc.js var setDeep = require"@fav/prop.set-deep" var obj = ; console.log"Before: " + .polluted; setDeepobj, "proto", "polluted", "Yes, its polluted"...

Prototype Pollution

Overview merge-deep is a recursively merges values in a javascript object. Affected versions of this package are vulnerable to Prototype Pollution. Merge-deep actively attempts to prevent prototype pollution by blocking object property merges into proto, however it still allows for prototype...

@glossgenius/eslint-config (>=1.0.2, <=1.0.7), @halonext/nestjs-express-cassandra (>=7.0.0, <=7.1.0) +7 more potentially affected by CVE-2021-26707 via merge-deep (>=3.0.0, <=3.0.2)

merge-deep NPM version =3.0.0, =1.0.2, =7.0.0, =5.2.0, =6.0.1, =0.0.1, =0.1.0-rc0, =0.0.11, =1.0.0, =1.2.4 Source cves: CVE-2021-26707 Source advisory: SNYK:JS-MERGEDEEP-1070277...