CVE-2020-7639

eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function 'set' could be tricked into adding or modifying properties of 'Object.prototype' using a 'proto' payload...

CVE-2020-7639: Improperly Controlled Modification of Object Prototype Attributes

eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function 'set' could be tricked into adding or modifying properties of 'Object.prototype' using a 'proto' payload...

PT-2020-19675 · Unknown · Eivindfjeldstad-Dot

Name of the Vulnerable Software and Affected Versions: eivindfjeldstad-dot versions prior to 1.0.3 Description: The issue concerns a Prototype Pollution problem. The set function can be tricked into adding or modifying properties of Object.prototype using a proto payload. This allows for potentia...

bind security and bug fix update

32:9.11.4-16.P2 - Finish dig query when name is too long 1743572 32:9.11.4-15.P2 - Stop listening on IPv6 by default 1753259 32:9.11.4-14.P2 - Limit number of queries per TCP connection CVE-2019-6477 32:9.11.4-13.P2 - Revert not searching names with dot 1743572 32:9.11.4-12.P2 - Fix mkeys test...

@adobe/dc-services-node-sdk (>=0.5.0, <=1.0.0), @adobe/documentservices-pdftools-node-sdk (>=1.1.0, <=1.3.1) +107 more potentially affected by CVE-2020-7639 via eivindfjeldstad-dot (0.0.1)

eivindfjeldstad-dot NPM version 0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on eivindfjeldstad-dot and may be impacted: - @adobe/dc-services-node-sdk =0.5.0, =1.1.0, =2.0.0, =0.5.0-beta, =1.0.1, =0.1.0, =0.0.1, =4.5.1, =1.1.15-160, =0.1.0, =0.1....

Prototype Pollution

Overview @eivifj/dot is a module that gets and sets object properties with dot notation. Affected versions of this package are vulnerable to Prototype Pollution. The function set could be tricked into adding or modifying properties of Object.prototype using a proto payload. PoC var a =...

Prototype Pollution

Overview eivindfjeldstad-dot is a module that Gets and sets object properties with dot notation. Note: this package has been deprecated and moved into @eivifj/dot. Affected versions of this package are vulnerable to Prototype Pollution. The function set could be tricked into adding or modifying...

ImageMagick: memory leak in coders/dot.c

A memory leak was discovered in ImageMagick in function ReadDOTImage. An application that uses ImageMagick to parse DOT images may be vulnerable to this flaw and crash due to some memory that is never freed...

ImageMagick: memory leak in coders/dot.c

A memory leak was discovered in ImageMagick in function ReadDOTImage. An application that uses ImageMagick to parse DOT images may be vulnerable to this flaw and crash due to some memory that is never freed...

CVE-2020-10825

A stack-based buffer overflow in /cgi-bin/activate.cgi while base64 decoding ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request issue 3 of 3...

CVE-2020-10964

Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed file may end with a dot. This file may then be renamed to have a .php filename...

CVE-2020-10964

CVE-2020-10964 affects Serendipity prior to 2.3.4 on Windows. The vulnerability arises because the filename of a renamed file may end with a dot, enabling the file to be renamed to have a .php filename, which can allow remote attackers to execute arbitrary code. The provided documents do not incl...

Directory Traversal

Overview sapper is a framework for building high-performance universal web apps. Affected versions of this package are vulnerable to Directory Traversal. when serving /client/... files. PoC by Daniel Thompson: curl...

Simplifying the ISP Transition to DNS Encryption

New protocols to encrypt DNS traffic, DNS over HTTPS DoH and DNS over TLS DoT, have been a visible Internet topic for the past two years. Akamai participated in the definition of DoH/DoT standards and recently released support in the high-performance CacheServe resolver. Major features include:...

CVE-2020-10668

The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in /home.jsp. The vulnerable parameter is openSI. NOTE: this is fixed in the latest version...

dot package code injection vulnerability

dot package is a JavaScript template engine . A code injection vulnerability exists in dot package v1.1.2. The vulnerability stems from the failure of a network system or product to properly filter specific elements of externally input data during the construction of code snippets. An attacker...

CVE-2020-8141

The dot package v1.1.2 uses Function to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype...

DEBIAN-CVE-2020-8141

The dot package v1.1.2 uses Function to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype...

CVE-2020-8141

The dot package v1.1.2 uses Function to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype...

Design/Logic Flaw

The dot package v1.1.2 uses Function to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype...