44 matches found
dset vulnerable to prototype pollution
Overview Prototype pollution vulnerability in 'dset' versions 1.0.0 through 2.0.1 allows attacker to cause a denial of service and may lead to remote code execution. Details The NPM module 'dset' can be abused by Prototype Pollution vulnerability since the function ‘export ' did not check for the...
Prototype Pollution
dset is vulnerable to prototype pollution. An attacker can inject properties into existing construct prototypes via the merge function in the merge.js and modify attributes such as proto, constructor, and prototype...
@danitt/analytics-next (1.33.4), @danitt/tsub (>=0.1.10, <=0.1.11) +4 more potentially affected by CVE-2022-25645 via dset (>=3.1.0, <=3.1.1)
dset NPM version =3.1.0, =0.1.10, =0.1.10, =0.8.0, =1.0.0, =1.3.0, =1.3.3 Source cves: CVE-2022-25645 Source advisory: OSV:GHSA-23WX-CGXQ-VPWX...
GHSA-23WX-CGXQ-VPWX Prototype Pollution in dset
All versions of dset prior to 3.1.2 are vulnerable to Prototype Pollution via dset/merge mode, as the dset function checks for prototype pollution by validating if the top-level path contains proto, constructor or prototype. By crafting a malicious object, it is possible to bypass this check and...
Prototype Pollution in dset
All versions of dset prior to 3.1.2 are vulnerable to Prototype Pollution via dset/merge mode, as the dset function checks for prototype pollution by validating if the top-level path contains proto, constructor or prototype. By crafting a malicious object, it is possible to bypass this check and...
CVE-2022-25645
A flaw was found in the dset package via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains a proto, constructor, or prototype. This flaw allows an attacker to craft a malicious object, bypassing this check and achieving prototype...
CVE-2022-25645
All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains proto, constructor or protorype. By crafting a malicious object, it is possible to bypass this check and achie...
CVE-2022-25645
All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains proto, constructor or protorype. By crafting a malicious object, it is possible to bypass this check and achie...
Design/Logic Flaw
All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains proto, constructor or protorype. By crafting a malicious object, it is possible to bypass this check and achie...
CVE-2022-25645 Prototype Pollution
All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains proto, constructor or protorype. By crafting a malicious object, it is possible to bypass this check and achie...
CVE-2022-25645
The CVE concerns the Node.js npm package and npm module dset. Affected: dset versions prior to 3.1.2. Root cause: a Prototype Pollution flaw in the dset/merge mode, where the code validates top-level paths for proto , constructor, or prototype but can be bypassed by crafting a malicious object. I...
CVE-2022-25645
All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains proto, constructor or protorype. By crafting a malicious object, it is possible to bypass this check and achie...
Lukeed Dset 安全漏洞
Lukeed Dset is a codebase by the individual developer of Lukeed that can assign values to objects of dictionary type based on the Javascript language. A security vulnerability exists in all versions of Lukeed Dset, which can be exploited by an attacker to implement a prototype contamination attac...
PT-2022-17432 · Dset · Dset
Name of the Vulnerable Software and Affected Versions: dset versions prior to 3.1.2 Description: The issue arises from the dset function's validation process in 'dset/merge' mode, where it checks for prototype pollution by looking for proto , constructor, or prototype in the top-level path...
Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands may be vulnerable to arbitrary code execution due to CVE-2022-25645
Summary Node.js module dset is used by IBM App Connect Enterprise Certified Container when managing or creating an API flow. IBM App Connect Enterprise Certified Container DesignerAuthoring operands may be vulnerable to arbitrary code execution. This bulletin provides patch information to address...
@danitt/analytics-next (1.33.4), @danitt/tsub (>=0.1.10, <=0.1.11) +4 more potentially affected by CVE-2022-25645 via dset (>=3.1.0, <=3.1.1)
dset NPM version =3.1.0, =0.1.10, =0.1.10, =0.8.0, =1.0.0, =1.3.0, =1.3.3 Source cves: CVE-2022-25645 Source advisory: SNYK:JS-DSET-2330881...
Prototype Pollution
Overview dset is an A tiny 161B utility for safely writing deep Object values! Affected versions of this package are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains proto, constructor or...
Prototype Pollution in lukeed/dset
Description dset is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: // poc.js var dset = require"dset" var obj = console.log"Before : " + .polluted; dsetobj, 'proto.polluted', 'Yes! Its Polluted'; console.log"After : " + .polluted; 2. Execute the following...
Lukeed dset prototype contamination vulnerability
Lukeed Dset is Lukeed individual developers of a Javascript-based language can be based on the dictionary type object assignment code library . A security vulnerability exists in Lukeed dset versions 1.0.0 through 2.0.1, which is a prototype contamination that can be exploited by an attacker to...