CVE-2020-7713 Prototype Pollution

All versions of package arr-flatten-unflatten are vulnerable to Prototype Pollution via the constructor...

PT-2020-19735 · Npm · Arr-Flatten-Unflatten

Name of the Vulnerable Software and Affected Versions: arr-flatten-unflatten versions up to and including 1.1.4 Description: The issue concerns Prototype Pollution via the constructor. This means that an attacker could potentially manipulate the prototype of an object, leading to unintended...

Prototype Pollution

Overview arr-flatten-unflatten is a non-recursive method of flattening an array or arrays and unflattening the result Affected versions of this package are vulnerable to Prototype Pollution via the constructor. POC: const unflatten = require'arr-flatten-unflatten'; unflatten'proto.polluted':true;...

Prototype Pollution

component-flatten causes prototype pollution. The prototype can be polluted since it does not restrict a proto payload, allowing the attacker to add or modify properties of Object.prototype using the payload...

Design/Logic Flaw

All versions of component-flatten are vulnerable to Prototype Pollution. The a function could be tricked into adding or modifying properties of Object.prototype using a proto payload...

CVE-2019-10794

CVE-2019-10794 affects component-flatten, where all versions are vulnerable to prototype pollution via a proto payload. The flaw enables an attacker to trick the program into adding or modifying properties on Object.prototype, with consequences including potential arbitrary code execution as desc...

CVE-2019-10794

All versions of component-flatten are vulnerable to Prototype Pollution. The a function could be tricked into adding or modifying properties of Object.prototype using a proto payload...

Prototype Pollution

Overview component-flatten is a module that flattens a resolved component tree. Note: This package is deprecated. Affected versions of this package are vulnerable to Prototype Pollution. The a function could be tricked into adding or modifying properties of Object.prototype using a proto payload...

byways (>=1.2.0, <=1.5.2), component-build (>=1.0.0, <=1.2.2) +17 more potentially affected by CVE-2019-10794 via component-flatten (>=0.0.1, <=1.0.1)

component-flatten NPM version =0.0.1, =1.2.0, =1.0.0, =1.0.0, =1.3.0, =0.0.3, =0.1.0, =1.0.0, =1.0.0, =0.2.0, =1.0.0, =1.2.0, =0.0.1, =0.0.1, =0.0.4 - faiton-builder 1.1.10 and more Source cves: CVE-2019-10794 Source advisory: SNYK:JS-COMPONENTFLATTEN-548907...

sqlite: mishandling of certain uses of SELECT DISTINCT involving a LEFT JOIN in flattenSubquery in select.c leads to a NULL pointer dereference

flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference or incorrect results...

SQLite Code Issue Vulnerability

SQLite is the United States D. Richard Hipp software developers of a set of C-based open source embedded relational database management system. The system is characterized by independence, isolation, cross-platform and so on. SQLite 3.30.1 version of the select.c file of the flattenSubquery there...

Apache apr_brigade_flatten() block header parsing vulnerability

Apache is an open source HTTPD service program. A security vulnerability exists in Apache aprbrigadeflatten parsing block headers due to the program failing to properly parse data block headers. A remote attacker exploiting this vulnerability could perform an attack by sending a specially crafted...

VulnCheck KEV: CVE-2013-3660

The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 does not properly initialize a pointer for the next...

DEBIAN-CVE-2009-4016

Integer underflow in the cleanstring function in ircstring.c in 1 IRCD-hybrid 7.2.2 and 7.2.3, 2 ircd-ratbox before 2.2.9, and 3 oftc-hybrid before 1.6.8, when flattenlinks is disabled, allows remote attackers to execute arbitrary code or cause a denial of service daemon crash via a LINKS command...

UBUNTU-CVE-2009-4016

Integer underflow in the cleanstring function in ircstring.c in 1 IRCD-hybrid 7.2.2 and 7.2.3, 2 ircd-ratbox before 2.2.9, and 3 oftc-hybrid before 1.6.8, when flattenlinks is disabled, allows remote attackers to execute arbitrary code or cause a denial of service daemon crash via a LINKS command...