AZL-45309 CVE-2022-37602 affecting package js-jquery 3.5.0-4

Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js...

Code injection

Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js...

CVE-2022-37602

Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js...

CVE-2022-37602

Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js...

grunt-karma 安全漏洞

grunt-karma is a grunt plugin for Karma by karma-runner individual developers. A security vulnerability exists in karma-runner grunt-karma version 4.0.1, which stems from a prototype contamination vulnerability via the key variable in grunt-karma.js...

CVE-2022-37602

Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js...

CVE-2022-37602

Summary : CVE-2022-37602 is a prototype pollution vulnerability in the npm package grunt-karma 4.0.1 (karma-runner integration), reported across multiple sources. The issue arises via the key variable in grunt-karma.js, enabling an attacker to contaminate object prototypes. CVSSv3.1 base metrics ...

PT-2022-24023 · Unknown · Grunt-Karma +1

Name of the Vulnerable Software and Affected Versions: karma-runner grunt-karma version 4.0.1 Description: The issue is related to a prototype pollution vulnerability in the karma-runner grunt-karma. It occurs via the key variable in grunt-karma.js. Recommendations: For version 4.0.1, consider...

GHSA-56X4-J7P9-FCF9 Command Injection in moment-timezone

Impact All versions of moment-timezone from 0.1.0 contain build tasks vulnerable to command injection. if Alice uses tzdata pipeline to package moment-timezone on her own for example via grunt data:2014d, where 2014d stands for the version of the tzdata to be used from IANA's website, and Alice...

GHSA-V78C-4P63-2J6C Cleartext Transmission of Sensitive Information in moment-timezone

Impact if Alice uses grunt data or grunt release to prepare a custom-build, moment-timezone with the latest tzdata from IANA's website and Mallory intercepts the request to IANA's unencrypted ftp server, Mallory can serve data which might exploit further stages of the moment-timezone tzdata...

PT-2022-28198 · Unknown · Moment-Timezone

Name of the Vulnerable Software and Affected Versions: moment-timezone versions 0.1.0 through 0.5.34 Description: The issue concerns command injection vulnerabilities in moment-timezone. An attacker can execute arbitrary commands on the system running the grunt task with the same privileges as th...

Malicious code in grunt-contrib-ugliyf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4dee610f58dcdea004a68d2bbb239c6ffdab3d08270390b335f4ad371d383f59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3474 Malicious code in grunt-contrib-ugliyf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4dee610f58dcdea004a68d2bbb239c6ffdab3d08270390b335f4ad371d383f59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3475 Malicious code in grunt-contrib5-cop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcaed4f8e5074c4986a639e08d41128df82425a2ecf9086e67025287e52d1564 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in grunt-contrib5-cop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcaed4f8e5074c4986a639e08d41128df82425a2ecf9086e67025287e52d1564 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Prototype Pollution

grunt-util-property is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

grunt-util-property 0.0.2 function call can add/modify properties of Object.prototype using a __proto__ payload

This affects all versions of package grunt-util-property. The function call could be tricked into adding or modifying properties of Object.prototype using a proto payload...

GHSA-4HQ8-JGR8-MW9J grunt-util-property 0.0.2 function call can add/modify properties of Object.prototype using a __proto__ payload

This affects all versions of package grunt-util-property. The function call could be tricked into adding or modifying properties of Object.prototype using a proto payload...

CVE-2020-7641

This affects all versions of package grunt-util-property. The function call could be tricked into adding or modifying properties of Object.prototype using a proto payload...

CVE-2020-7641 Prototype Pollution

This affects all versions of package grunt-util-property. The function call could be tricked into adding or modifying properties of Object.prototype using a proto payload...