jbossweb: Incomplete fix of CVE-2020-13935 for WebSocket in JBossWeb could lead to DoS

A flaw was found in jbossweb. The fix for CVE-2020-13935 was incomplete in JBossWeb, leaving it vulnerable to a denial of service attack when sending multiple requests with invalid payload length in a WebSocket frame. The highest threat from this vulnerability is to system availability...

MELAG FTP Server Authentication Error Vulnerability

MELAG FTP Server is an FTP server from the German company MELAG. version 2.2.0.4 of MELAG FTP Server is vulnerable to an authentication error, which stems from incomplete authentication checks. A remote attacker could exploit the vulnerability to access local files with a valid username...

CVE-2022-33879 Incomplete fix and new regex DoS in StandardsExtractingContentHandler

The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1...

Prototype Pollution

deep-get-set is vulnerable to prototype pollution. The vulnerability exists due to an incomplete fix of CVE-2020-7715, allowing an attacker to get control of value of “deep” and modify attributes such as proto, constructor and prototype...

GHSA-MJJJ-6P43-VHHV Prototype Pollution in deep-get-set

All versions of package deep-get-set are vulnerable to Prototype Pollution via the 'deep' function. Note: This vulnerability derives from an incomplete fix of CVE-2020-7715...

CVE-2022-21231

All versions of package deep-get-set are vulnerable to Prototype Pollution via the 'deep' function. Note: This vulnerability derives from an incomplete fix of CVE-2020-7715...

Design/Logic Flaw

All versions of package deep-get-set are vulnerable to Prototype Pollution via the 'deep' function. Note: This vulnerability derives from an incomplete fix of CVE-2020-7715...

CVE-2022-21231 Prototype Pollution

All versions of package deep-get-set are vulnerable to Prototype Pollution via the 'deep' function. Note: This vulnerability derives from an incomplete fix of CVE-2020-7715...

CVE-2021-41638

The authentication checks of the MELAG FTP Server in version 2.2.0.4 are incomplete, which allows a remote attacker to access local files only by using a valid username...

CVE-2021-41638

The authentication checks of the MELAG FTP Server in version 2.2.0.4 are incomplete, which allows a remote attacker to access local files only by using a valid username...

Malicious code in usaa-performance (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1f74974b841768a8f7cc9be0179b03462de9e741bff43976bfcc8ddfc25e6e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in privateinternal-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b03068dec828a0dd824fb47f1021f7546cc2780923c45a006f5b9ad615f30f5e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in merlin-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acbec8231459b734564c16533b3248cc88adefb4f32cf4a06fc6d3e42e8dfb45 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in action-create-release-pr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1f9c096fa3bf9d38477488398a8d49d517f96c85896b4312ef8e8771336c43a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in epam-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5fde824f3d16819175b7781da6c196f7ad067667235e2c8663a656a8debecb58 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Chrome CVE-2022-1096 Incomplete Fix

Chrome: Incomplete fix for CVE-2022-1096 VULNERABILITY DETAILS The fix for https://crbug.com/1309225 has modified SetPropertyInternal to fall back to SetSuperProperty whenever a property access interceptor is encountered because SetSuperProperty is robust against possible side effects caused by...

GHSA-VVV8-XW5F-3F88 Prototype Pollution in mout

This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn mixes objects into the target object, recursively mixing existing child objects as well. In both cases, the key used to access the target object recursively...

Prototype Pollution in mout

This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn mixes objects into the target object, recursively mixing existing child objects as well. In both cases, the key used to access the target object recursively...

GHSA-P23C-P8W2-WW5V Prototype Pollution in querymen

All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handlertype, name, fn can be controlled by users without any sanitization. Note: This vulnerability derives from an incomplete fix of CVE-2020-7600...

CVE-2022-21213

This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn mixes objects into the target object, recursively mixing existing child objects as well. In both cases, the key used to access the target object recursively...