95 matches found
GHSA-QPX9-HPMF-5GMW Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack
Impact In simple words, some programs that use .flatten or .isEqual could be made to crash. Someone who wants to do harm may be able to do this on purpose. This can only be done if the program has special properties. It only works in Underscore versions up to 1.13.7. A more detailed explanation...
Uncontrolled Recursion
Overview underscore is a JavaScript's functional programming helper library. Affected versions of this package are vulnerable to Uncontrolled Recursion through the .flatten or .isEqual functions that are used without a depth limit. An attacker can cause the application to crash or become...
Uncontrolled Recursion
Overview org.webjars.npm:underscore is a JavaScript's functional programming helper library. Affected versions of this package are vulnerable to Uncontrolled Recursion through the .flatten or .isEqual functions that are used without a depth limit. An attacker can cause the application to crash or...
Underscore.js 安全漏洞
Underscore.js is a lightweight JavaScript utility library developed by jashkenas. Versions of Underscore.js prior to 1.13.8 contained a security vulnerability. This vulnerability stemmed from the use of unlimited recursion in the .flatten and .isEqual functions, which could allow attackers to cau...
PT-2026-22841
Name of the Vulnerable Software and Affected Versions Underscore.js versions prior to 1.13.8 Description The .flatten and .isEqual functions use recursion without a depth limit, which can lead to a stack overflow and a Denial of Service DoS. This occurs when untrusted input is used to create a...
MAL-2025-191095 Malicious code in flatten-unflatten (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96678bbed20be5d500dc65bda769b41f7d3666a18c8a76262aca5ed79ef584fd The package flatten-unflatten was found to contain malicious code. Source: ghsa-malware...
Malicious code in flatten-unflatten (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96678bbed20be5d500dc65bda769b41f7d3666a18c8a76262aca5ed79ef584fd The package flatten-unflatten was found to contain malicious code. Source: ghsa-malware...
EUVD-2025-199215
Malicious code in flatten-unflatten npm...
EUVD-2021-1215
Malware in sbrugna...
EUVD-2022-3906
Malicious code in bioql PyPI...
Malicious code in just-array-flatten (npm)
The package just-array-flatten was found to contain malicious code...
MAL-2025-24110 Malicious code in just-array-flatten (npm)
The package just-array-flatten was found to contain malicious code...
DEBIAN-CVE-2022-50170
In the Linux kernel, the following vulnerability has been resolved: kunit: executor: Fix a memory leak on failure in kunitfiltertests It's possible that memory allocation for 'filtered' will fail, but for the copy of the suite to succeed. In this case, the copy could be leaked. Properly free 'cop...
CVE-2024-36574
A Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON flatten-json/index.js:42...
CVE-2019-10794
All versions of component-flatten are vulnerable to Prototype Pollution. The a function could be tricked into adding or modifying properties of Object.prototype using a proto payload...
SUSE SLED15: jctools / jctools-channels / jctools-experimental / jctools-javadoc / etc (SUSE-SU-2024:4407-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:4407-1 advisory. - CVE-2024-47535: Fixed unsafe reading of large environment files when Netty is loaded by a java...
Security update for aalto-xml, flatten-maven-plugin, jctools, moditect, netty, netty-tcnative
This update for aalto-xml, flatten-maven-plugin, jctools, moditect, netty, netty-tcnative fixes the following issues: CVE-2024-47535: Fixed unsafe reading of large environment files when Netty is loaded by a java application can lead to a crash due to the JVM memory limit being exceeded in netty...
flatten-json Prototype Pollution
A Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON flatten-json/index.js:42...
