PT-2020-21299

Name of the Vulnerable Software and Affected Versions flat-wrap versions affected versions not specified Description The issue concerns prototype pollution. The unflatten function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing...

Prototype Pollution

flat is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

Prototype Pollution

Overview flat is a Take a nested Javascript object and flatten it, or unflatten an object with delimited keys Affected versions of this package are vulnerable to Prototype Pollution. PoC var unflatten = require'flat'.unflatten; unflatten 'proto.polluted': true ; console.logpolluted; // true Detai...

@diogoabu/adminjs (>=6.8.7-1, <=6.8.7-19), @emartech/angular-translate (>=2.0.0, <=2.3.0) +52 more potentially affected by CVE-2020-36632 via flat (>=5.0.0, <=5.0.1)

flat NPM version =5.0.0, =6.8.7-1, =2.0.0, =1.2.0, =0.0.1, =0.0.1-prerelease.8, =0.0.2, =0.5.2, =3.34.3, =2.3.0, =2.7.0, =0.1.2, =6.7.6, =1.0.0, =0.2.2, =1.1.0 and more Source cves: CVE-2020-36632 Source advisory: SNYK:JS-FLAT-596927...

@arve.knudsen/bankai (>=9.6.0, <=9.10.14), @citation-js/browserify-disc (1.3.4) +63 more potentially affected by CVE-2020-36632 via flat (>=1.0.0, <=1.6.0)

flat NPM version =1.0.0, =9.6.0, =2.6.0, =1.0.0, =1.0.0-1, =0.0.1, =0.0.1, =0.0.10, =1.0.0, =7.3.0, =9.10.4, =0.0.1, =0.0.3, =0.0.4 and more Source cves: CVE-2020-36632 Source advisory: SNYK:JS-FLAT-596927...

@biesbjerg/ng2-translate-extract (>=0.5.0, <=0.6.0), @biesbjerg/ngx-translate-extract (>=1.0.0, <=2.3.4) +67 more potentially affected by CVE-2020-36632 via flat (>=2.0.0, <=2.0.1)

flat NPM version =2.0.0, =0.5.0, =1.0.0, =9.16.1-rc.0, =0.0.1, =0.0.2-beta1, =1.2.7, =2.1.27, =2.0.7, =1.1.9, =2.3.4-atknatk.1, =0.0.1, =1.0.0, =1.0.0, =2.3.4, =2.3.5, =2.3.6 and more Source cves: CVE-2020-36632 Source advisory: SNYK:JS-FLAT-596927...

@albalyu/npm-scripts (>=2.0.1, <=2.0.40), @opuscapita/eslint-config-opuscapita-bnapp (>=1.0.1-next.0, <=1.0.6) +7 more potentially affected by CVE-2020-36632 via flat (3.0.0)

flat NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on flat and may be impacted: - @albalyu/npm-scripts =2.0.1, =1.0.1-next.0, =2.2.1, =2.0.0-beta.3, =0.0.1-beta.2, =4.0.1, =0.3.0-beta.16, =0.3.0-beta.83 Source cves: CVE-2020-36632 Sour...

@abstract.tech/brad-cli (>=0.0.4, <=1.0.1), @bandwidth/shared-components (>=6.0.2, <=6.2.2) +106 more potentially affected by CVE-2020-36632 via flat (>=4.0.0, <=4.1.0)

flat NPM version =4.0.0, =0.0.4, =6.0.2, =1.0.7, =4.2.2, =1.2.10, =2.1.31, =1.0.11, =2.0.11, =1.1.11, =1.0.27, =2.0.8, =1.0.0, =0.0.6, =0.0.1, =0.0.2, =0.0.8 and more Source cves: CVE-2020-36632 Source advisory: SNYK:JS-FLAT-596927...

Low: Red Hat Security Advisory: Red Hat Virtualization Engine security, bug fix 4.3.9

An update is now available for Red Hat Virtualization Engine 4.3. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Prototype Pollution

Overview All versions of flat-wrap are vulnerable to prototype pollution. The function unflatten does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects. Recommendation No fix is currently...

Flat Assembler Local Buffer Overflow Vulnerability

Flat assembler is a fast, compilable assembly language compiler for x86 and x86-64 architecture processors. Flat assembler suffers from a local buffer overflow vulnerability. An attacker can exploit the vulnerability to execute arbitrary code in the context of an affected application, and a faile...

WonderCMS HTTP Host Header Injection Vulnerability

WonderCMS is an open source, fast, small and simple flat file cms. WonderCMS 2.3.1 suffers from an HTTP host header injection vulnerability. An attacker can exploit the vulnerability to redirect pages...

melbourneflatpackkitchens.com.au XSS vulnerability

Vulnerable URL: http://www.melbourneflatpackkitchens.com.au/!prettyPhoto/0,%3Ca%20onclick=%22alert%27OPENBUGBOUNTY%27;%22%3E/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 10.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown...

callahan-roach.com XSS vulnerability

Vulnerable URL: http://www.callahan-roach.com/flat-rate-detail.asp?industry=1"...

Flat Assembler 1.7.21 - Local Buffer Overflow

Flat Assembler 1.7.21 - Local Buffer Overflow !/usr/bin/python Developed using Exploit Pack - http://exploitpack.com - Exploit Author: Juan Sacco at KPN Red Team - http://www.kpn.com Tested on: GNU/Linux - Kali 2017.1 Release What is FASM? Flat assembler is a fast, self-compilable assembly langua...

Flat Assembler 1.7.21 - Local Buffer Overflow

!/usr/bin/python Developed using Exploit Pack - http://exploitpack.com - Exploit Author: Juan Sacco at KPN Red Team - http://www.kpn.com Tested on: GNU/Linux - Kali 2017.1 Release What is FASM? Flat assembler is a fast, self-compilable assembly language compiler for the x86 and x86-64 architectur...

Grimbb 1.3 Hash Disclosure Vulnerability

Exploit for php platform in category web applications Grimbb V1.3 User and Password Hash Disclosure ============================================== Discovered by NA, NAattutanota.com ======================================= Description ============ A PHP 4 Open Source Flat File Based Bulletin Board...

phpATM 1.32 Remote Command Execution / Shell Upload

?php / Exploit Title : "phpATM = 1.32 Remote Command Execution Shell Upload on Windows Servers" Date : 17/06/2016 Author : Paolo Massenio - pmassenioATgmail Vendor : phpATM - http://phpatm.org/ Version : = 1.32 Tested on : Windows 10 with XAMPP PoF "phpATM is the acronym for PHP Advanced Transfer...

AjaxExplorer 1.10.3.2 - Multiple Vulnerabilities

Exploit for php platform in category web applications + Credits: hyp3rlinx + ISR: apparitionsec Vendor: ========== sourceforge.net smsid download linx: sourceforge.net/projects/ajax-explorer/files/ Product: ======================= AjaxExplorer v1.10.3.2 Manage server files through simple windows...

Iconset of Flat Card Style - Dangerous filesystem permissions, Runtime command execution, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Iconset of Flat Card Style published at the 'play' market has multiple vulnerabilities...