CVE-2020-7717: Improperly Controlled Modification of Object Prototype Attributes

All versions of package dot-notes are vulnerable to Prototype Pollution via the create function...

PT-2020-19739 · Dot-Notes · Dot-Notes

Name of the Vulnerable Software and Affected Versions: dot-notes versions prior to 3.2.1 Description: The issue concerns Prototype Pollution via the create function. This allows for potential manipulation of object properties. Recommendations: For versions prior to 3.2.1, update to version 3.2.1 ...

SQL Injection Vulnerability in the Website Building System of Shenzhen GreatPoint Technology Limited (CNVD-2020-56146)

Shenzhen Big Dot Technology Co., Ltd. was founded in August 2017, the scope of business includes technology development, technical services, technical consulting; software development; website design and so on. Shenzhen Big Dot Technology Co. Ltd. website building system has a SQL injection...

ASP.NET Core DoS

The vulnerability of the ASP.NET Core software platform is related to errors in request processing. Exploiting this vulnerability can allow an attacker, operating remotely, to cause a service failure by sending specially crafted requests to the ASP.NET Core application...

CVE-2020-1476

An elevation of privilege vulnerability exists when ASP.NET or .NET web applications running on IIS improperly allow access to cached files. An attacker who successfully exploited this vulnerability could gain access to restricted files. To exploit this vulnerability, an attacker would need to se...

@decentverse/server (>=0.0.1, <=0.0.148), @swapscanner/truffle-hdwallet-provider-klaytn (1.4.2) +18 more potentially affected by CVE-2020-7717 via dot-notes (3.1.1)

dot-notes NPM version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on dot-notes and may be impacted: - @decentverse/server =0.0.1, =1.0.0, =1.0.0, =1.0.1-rc.4, =1.4.0-rc.1, =1.0.0, =1.6.4, =0.0.1, =1.0.0, =0.0.1, =0.1.1 and more Source cves:...

Prototype Pollution

Overview dot-notes is a Two way conversions between objects and dot/bracket notation Affected versions of this package are vulnerable to Prototype Pollution via the create function. POC: const dots = require'dot-notes'; dots.create, 'proto.polluted', true; console.logpolluted; Details Prototype...

CVE-2019-4582

IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 167288...

ALPINE-CVE-2020-0256

In LoadPartitionTable of gpt.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege when inserting a malicious USB device, with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

PT-2020-3760 · Microsoft · Iis +2

Name of the Vulnerable Software and Affected Versions: ASP.NET or .NET web applications affected versions not specified Description: An elevation of privilege issue exists due to improper access control to cached files in ASP.NET or .NET web applications running on IIS. This could allow an attack...

PT-2020-14784 · Ripe Ncc · Ripe Ncc Rpki Validator

Name of the Vulnerable Software and Affected Versions: RIPE NCC RPKI Validator versions 3.x through 3.1-2020.07.06.14.28 Description: An issue was discovered in the X509-based RPKI certificate-tree validation procedure, where missing validation checks on CRL presence or CRL staleness allow remote...

GHSA-FF7X-QRG7-QGGM dot-prop Prototype Pollution vulnerability

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects...

@bara/barn (>=2.2.0, <=2.5.0), @ezs/istex (1.4.7) +25 more potentially affected by CVE-2020-8116 via dot-prop (>=5.0.0, <=5.1.0)

dot-prop NPM version =5.0.0, =2.2.0, =1.1.3, =2.1.9, =12.0.0, =0.0.0, =1.2.5, =1.0.0-rc.2, =1.0.0, =0.4.2, =0.1.6, =0.0.31, =2.2.0, =1.3.0, =3.1.1 and more Source cves: CVE-2020-8116 Source advisory: OSV:GHSA-FF7X-QRG7-QGGM...

dot-prop Prototype Pollution vulnerability

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects...

@badgeup/badgeup-ionic-client (>=1.0.1, <=1.0.3), @codedungeon/code-assistant (>=0.0.1, <=0.0.4-dev.53) +42 more potentially affected by CVE-2020-8116 via dot-prop (>=4.0.0, <=4.2.0)

dot-prop NPM version =4.0.0, =1.0.1, =0.0.1, =0.0.1-dev.9, =0.0.3, =0.0.4, =1.1.0, =1.0.0-alpha.5, =0.10.1, =3.0.0, =1.0.0-beta.1, =0.1.12, =1.0.0, =1.0.2 - falcor-array 0.0.1 - flipcache 0.0.1 and more Source cves: CVE-2020-8116 Source advisory: OSV:GHSA-FF7X-QRG7-QGGM...

@bara/barn (>=2.2.0, <=2.5.0), @ezs/istex (1.4.7) +25 more potentially affected by CVE-2020-8116 via dot-prop (>=5.0.0, <=5.1.0)

dot-prop NPM version =5.0.0, =2.2.0, =1.1.3, =2.1.9, =12.0.0, =0.0.0, =1.2.5, =1.0.0-rc.2, =1.0.0, =0.4.2, =0.1.6, =0.0.31, =2.2.0, =1.3.0, =3.1.1 and more Source cves: CVE-2020-8116 Source advisory: GHSA-FF7X-QRG7-QGGM...

SQL Injection Vulnerability in Nantong Dot Cool Network Technology Co.

Founded in 2010, Nantong Dot Cool Network Technology Co., Ltd. mainly provides industry website construction and solutions. There is a SQL injection vulnerability in Nantong Dot Cool Network Technology Co., Ltd.'s Beehive website builder system, which can be exploited by attackers to obtain...

SQL Injection Vulnerability in Nantong Dot Cool Network Technology Co.

Nantong Dot Cool Networks Technology Co. Since its inception, the company has provided many groups of enterprises and listed companies with perfect industry website construction solutions. There is a SQL injection vulnerability in Nantong Dot Cool Network Technology Co., Ltd's Beehive website...

July 21, 2020-KB4567327 Cumulative Update Preview for .NET Framework 3.5, 4.7.2 and 4.8 for Windows 10 Version 1809 and Windows Server 2019

None None...

VulnCheck KEV: CVE-2018-20685

In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side...