646 matches found
com.splunk.splunkins:splunk-devops-extend (>=1.0 <=1.7.0) potentially affected by CVE-2019-10390 via com.splunk.splunkins:splunk-devops (>=1.0 <=1.7.0)
com.splunk.splunkins:splunk-devops MAVEN version =1.0, =1.0, =1.7.0 Source cves: CVE-2019-10390 Source advisory: OSV:GHSA-CJR8-5RW4-WH65...
[SECURITY] Fedora 34 Update: golang-github-oklog-0.3.2-9.20190701gitca7cdf5.fc34
OK Log is a distributed and coordination-free log management system for big o l' clusters. It's an on-prem solution that's designed to be a sort of building block: easy to understand, easy to operate, and easy to extend...
WordPress Extend Filter Products By Price Widget plugin <= 1.0 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Extend Filter Products By Price Widget plugin versions = 1.0. Solution No patched version available...
Prototype Pollution
object-extend is vulnerable to prototype pollution. The vulnerability exists in extend function of extend.js which allows an attacker to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...
GHSA-M639-9WHG-FW97 Prototype Pollution in object-extend
The package object-extend from 0.0.0 through 0.5.0 is vulnerable to Prototype Pollution via object-extend...
Prototype Pollution in object-extend
The package object-extend from 0.0.0 through 0.5.0 is vulnerable to Prototype Pollution via object-extend...
@acanto/components (>=0.0.2 <=0.0.73), @acanto/components-header-subnav (>=0.0.2 <=0.0.37) +51 more potentially affected by CVE-2021-23702 via object-extend (=0.5.0)
object-extend NPM version =0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on object-extend and may be impacted: - @acanto/components =0.0.2, =0.0.2, =0.0.2, =0.0.3, =0.0.2, =0.0.2, =0.0.17, =0.0.2, =0.0.2, =0.0.65, =0.0.2, =0.0.2, =0.0.2, =0.0.4,...
CVE-2021-23702
The package object-extend from 0.0.0 are vulnerable to Prototype Pollution via object-extend...
CVE-2021-23702
The package object-extend from 0.0.0 are vulnerable to Prototype Pollution via object-extend...
CVE-2021-23702
CVE-2021-23702 relates to a Prototype Pollution vulnerability in the object-extend package. Public documentation across multiple sources confirms the flaw exists in the extend function of object-extend, enabling an attacker to inject properties into Object.prototype (e.g., via proto ), potentiall...
CVE-2021-23702 Prototype Pollution
The package object-extend from 0.0.0 are vulnerable to Prototype Pollution via object-extend...
CVE-2021-23702
The package object-extend from 0.0.0 are vulnerable to Prototype Pollution via object-extend...
Prototype JavaScript framework 代码注入漏洞
Prototype JavaScript framework prototypejs is a JavaScript development framework. A code injection vulnerability exists in Prototype JavaScript framework, which stems from the vulnerability of object-extend to prototype contamination from version 0.0.0 onwards...
com.btc.ep:btc-embeddedplatform (>=1.9.2-beta <=2.5.9), com.logmein:pipeline-bamboo (>=0.0.1 <=0.0.2) +94 more potentially affected by CVE-2022-25173 via org.jenkins-ci.plugins.workflow:workflow-cps (>=0.1-beta-1 <=2.92)
org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version =0.1-beta-1, =1.9.2-beta, =0.0.1, =8.0.12, =0.8, =1.0.14, =1.3.0, =1.0, =0.9.0, =1.0, =1.22, =0.0.8, =y - io.fabric8.pipeline:kubernetes-pipeline-aggregator =1.3 and more Source cves: CVE-2022-25173 Source advisory: OSV:GHSA-4M7P-55JM-3VW...
Prototype Pollution
Overview Affected versions of this package are vulnerable to Prototype Pollution via object-extend. PoC js const extend = require"object-extend"; const payload = JSON.parse'"proto":"isAdmin":"yes"'; extend, payload; const obj = "a":1; console.logobj.isAdmin // print yes on arbitrary objects since...
@acanto/components (>=0.0.2 <=0.0.73), @acanto/components-header-subnav (>=0.0.2 <=0.0.37) +51 more potentially affected by CVE-2021-23702 via object-extend (=0.5.0)
object-extend NPM version =0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on object-extend and may be impacted: - @acanto/components =0.0.2, =0.0.2, =0.0.2, =0.0.3, =0.0.2, =0.0.2, =0.0.17, =0.0.2, =0.0.2, =0.0.65, =0.0.2, =0.0.2, =0.0.2, =0.0.4,...
moleculer-rabbitmq-extend-delay (=1.1.12) potentially affected by CVE-2020-7715 +1 more via deep-get-set (=1.1.1)
deep-get-set NPM version =1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on deep-get-set and may be impacted: - moleculer-rabbitmq-extend-delay =1.1.12 Source cves: CVE-2020-7715, CVE-2022-21231 Source advisory: SNYK:JS-DEEPGETSET-2342655...
GHSA-GJM5-83CW-P3P2 Prototype Pollution in extend2
The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge...
Prototype Pollution
extend2 is vulnerable to prototype pollution. The vulnerability exists in extend function of index.js as it allows an attacker to pass the value proto through the name variable...