637 matches found
steal 安全漏洞
steal is StealJS open source an extensible general-purpose module loader . It can load JavaScript modules defined in ES6, AMD and CommonJS formats. A security vulnerability exists in steal 2.2.4, which stems from prototype contamination of function extend in StealJS via the key variable in babel....
CVE-2022-36086 linked_list_allocator vulnerable to out-of-bound writes on `Heap` initialization and `Heap::extend`
linkedlistallocator is an allocator usable for nostd systems. Prior to version 0.10.2, the heap initialization methods were missing a minimum size check for the given heap size argument. This could lead to out-of-bound writes when a heap was initialized with a size smaller than 3 sizeof:: because...
RUSTSEC-2022-0063 Multiple vulnerabilities resulting in out-of-bounds writes
The heap initialization methods were missing a minimum size check for the given heap size argument. This could lead to out-of-bound writes when a heap was initialized with a size smaller than 3 sizeof:: because of metadata write operations. When calling Heap::extend with a size smaller than two...
CVE-2022-36310
Airspan AirVelocity 1500 software prior to version 15.18.00.2511 had NET-SNMP-EXTEND-MIB enabled on its snmpd service, enabling an attacker with SNMP write abilities to execute commands as root on the eNodeB. This issue may affect other AirVelocity and AirSpeed models...
CVE-2022-36310
Airspan AirVelocity 1500 software prior to version 15.18.00.2511 had NET-SNMP-EXTEND-MIB enabled on its snmpd service, enabling an attacker with SNMP write abilities to execute commands as root on the eNodeB. This issue may affect other AirVelocity and AirSpeed models...
[SECURITY] Fedora 36 Update: powerline-go-1.21.0-4.fc36
A Powerline like prompt for Bash, ZSH and Fish. - Shows some important details about the git/hg branch - Changes color if the last command exited with a failure code - If you're too deep into a directory tree, shortens the displayed path with an ellipsis - Shows the current Python virtualenv...
[SECURITY] Fedora 36 Update: golang-github-oklog-0.3.2-11.20190701gitca7cdf5.fc36
OK Log is a distributed and coordination-free log management system for big o l' clusters. It's an on-prem solution that's designed to be a sort of building block: easy to understand, easy to operate, and easy to extend...
[SECURITY] Fedora 34 Update: golang-github-oklog-0.3.2-9.20190701gitca7cdf5.fc34
OK Log is a distributed and coordination-free log management system for big o l' clusters. It's an on-prem solution that's designed to be a sort of building block: easy to understand, easy to operate, and easy to extend...
WordPress Extend Filter Products By Price Widget plugin <= 1.0 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Extend Filter Products By Price Widget plugin versions = 1.0. Solution No patched version available...
Prototype Pollution
object-extend is vulnerable to prototype pollution. The vulnerability exists in extend function of extend.js which allows an attacker to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...
Prototype Pollution in object-extend
The package object-extend from 0.0.0 through 0.5.0 is vulnerable to Prototype Pollution via object-extend...
GHSA-M639-9WHG-FW97 Prototype Pollution in object-extend
The package object-extend from 0.0.0 through 0.5.0 is vulnerable to Prototype Pollution via object-extend...
CVE-2021-23702
The package object-extend from 0.0.0 are vulnerable to Prototype Pollution via object-extend...
CVE-2021-23702
The package object-extend from 0.0.0 are vulnerable to Prototype Pollution via object-extend...
CVE-2021-23702
CVE-2021-23702 relates to a Prototype Pollution vulnerability in the object-extend package. Public documentation across multiple sources confirms the flaw exists in the extend function of object-extend, enabling an attacker to inject properties into Object.prototype (e.g., via proto ), potentiall...
CVE-2021-23702 Prototype Pollution
The package object-extend from 0.0.0 are vulnerable to Prototype Pollution via object-extend...
CVE-2021-23702
The package object-extend from 0.0.0 are vulnerable to Prototype Pollution via object-extend...
Prototype JavaScript framework 代码注入漏洞
Prototype JavaScript framework prototypejs is a JavaScript development framework. A code injection vulnerability exists in Prototype JavaScript framework, which stems from the vulnerability of object-extend to prototype contamination from version 0.0.0 onwards...
Prototype Pollution
Overview Affected versions of this package are vulnerable to Prototype Pollution via object-extend. PoC js const extend = require"object-extend"; const payload = JSON.parse'"proto":"isAdmin":"yes"'; extend, payload; const obj = "a":1; console.logobj.isAdmin // print yes on arbitrary objects since...