CVE-2018-3719

CVE-2018-3719 affects the Node.js module mixin-deep (versions before 1.3.1). The vulnerability is a prototype pollution (MAID) flaw that lets an attacker modify Object.prototype via proto , causing addition or modification of properties that exist on all objects. Affected versions are explicitly ...

CVE-2018-3723

CVE-2018-3723 affects defaults-deep prior to 0.2.4, enabling prototype pollution by abusing proto to modify Object.prototype. This can lead to added or altered properties existing on all objects, with potential DoS and, in some cases, remote code execution as described in linked advisories. The i...

CVE-2018-3719

mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data MAID vulnerability, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects...

CVE-2018-3720

assign-deep node module before 0.4.7 suffers from a Modification of Assumed-Immutable Data MAID vulnerability, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects...

CVE-2018-3719

mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data MAID vulnerability, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects...

apidocs-cli (>=0.0.0, <=2.0.1), assemble-init (0.1.0) +80 more potentially affected by CVE-2018-3719 via mixin-deep (>=0.1.0, <=1.0.1)

mixin-deep NPM version =0.1.0, =0.0.0, =0.1.0-beta.2, =0.1.0, =0.1.1, =0.1.2, =0.0.1, =0.0.1, =0.1.0, =1.0.2, =0.0.5, =0.2.2, =0.3.0 - create-component 0.1.1 and more Source cves: CVE-2018-3719 Source advisory: MEND:CVE-2018-3719...

@risingstack/trace (2.0.1), democracyos-notifier (>=1.3.0, <=2.1.3) +1 more potentially affected by CVE-2018-3723 via defaults-deep (0.2.3)

defaults-deep NPM version 0.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on defaults-deep and may be impacted: - @risingstack/trace 2.0.1 - democracyos-notifier =1.3.0, =2.1.3 - oddvoter-notifier 1.1.1 Source cves: CVE-2018-3723 Source advisory:...

CVE-2018-3723

defaults-deep node module before 0.2.4 suffers from a Modification of Assumed-Immutable Data MAID vulnerability, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects...

CVE-2018-3723

defaults-deep node module before 0.2.4 suffers from a Modification of Assumed-Immutable Data MAID vulnerability, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects...

@careteam/mfe-init (0.0.8), @topfeed/topfeed (>=0.0.30, <=0.0.44) +68 more potentially affected by CVE-2018-3720 via assign-deep (>=0.1.2, <=0.4.6)

assign-deep NPM version =0.1.2, =0.0.30, =0.0.1, =1.0.0, =0.0.1, =0.1.0, =1.0.0, =1.2.0, =0.0.1, =1.0.0-alpha.5, =1.0.0-alpha.5, =0.0.1, =0.0.1, =1.0.0-alpha.5, =2.3.0 and more Source cves: CVE-2018-3720 Source advisory: MEND:CVE-2018-3720...

CVE-2018-3722

The CVE-2018-3722 entry concerns the merge-deep npm module, specifically versions before 3.0.1. A MAID/prototype-pollution flaw via proto enables an attacker to modify the prototype of Object, potentially adding or altering properties that exist on all objects. This can lead to server instability...

CVE-2018-3720

The CVE-2018-3720 entry concerns the assign-deep Node.js module. Versions prior to 0.4.7 are affected by a prototype-pollution (MAID) vulnerability that lets an attacker modify Object.prototype via proto , enabling addition or modification of properties that propagate to all objects. Impact is de...

CVE-2018-3723: Modification of Assumed-Immutable Data (MAID)

defaults-deep node module before 0.2.4 suffers from a Modification of Assumed-Immutable Data MAID vulnerability, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects...

CVE-2018-3720: Modification of Assumed-Immutable Data (MAID)

assign-deep node module before 0.4.7 suffers from a Modification of Assumed-Immutable Data MAID vulnerability, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects...

CVE-2018-3722: Modification of Assumed-Immutable Data (MAID)

merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data MAID vulnerability, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects...

PT-2018-16147

Name of the Vulnerable Software and Affected Versions default-deep versions prior to 0.2.4 Description The issue allows a malicious user to modify the prototype of Object via proto , causing the addition or modification of an existing property that will exist on all objects. This is due to a...

CVE-2018-3719: Modification of Assumed-Immutable Data (MAID)

mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data MAID vulnerability, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects...

PT-2018-16143 · Npm · Mixin-Deep

Name of the Vulnerable Software and Affected Versions: mixin-deep versions prior to 1.3.1 Description: The issue allows a malicious user to modify the prototype of Object via proto , causing the addition or modification of an existing property that will exist on all objects. This is achieved...

PT-2018-16146

Name of the Vulnerable Software and Affected Versions merge-deep versions prior to 3.0.1 Description The issue allows a malicious user to modify the prototype of Object via proto , causing the addition or modification of an existing property that will exist on all objects. This is achieved throug...

DEBIAN-CVE-2014-10064

The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example...