CVE-2020-36632

CVE-2020-36632 affects the Node.js module hughsk flat (up to 5.0.0), where the unflatten function in index.js enables prototype pollution. This can be exploited remotely to modify Object.prototype and execute arbitrary code or cause a denial of service. A fixed version is 5.0.1, with patch refere...

CVE-2020-36632 hughsk flat index.js unflatten prototype pollution

A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes 'prototype pollution'. It is possible to initiate the atta...

flat 安全漏洞

flat is a library from Hugh Kennedy's personal developer. It is used to take a nested Javascript object and flatten it, or to unflatten the object using the separator key. A security vulnerability exists in versions prior to flat 5.0.1, which stems from a problem with the unflatten function in th...

CVE-2020-36623

A vulnerability was found in Pengu. It has been declared as problematic. Affected by this vulnerability is the function runApp of the file src/index.js. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The name of the patch is...

Prototype Pollution

safe-eval is vulnerable to prototype pollution. The vulnerability exists in the safeEval function in index.js, because it allows an attacker to add or modify Object.prototype.Consolidate properties...

Directory Traversal

easy-static-server is vulnerable to directory traversal. The vulnerability exists in the easyServer function of index.js due to missing input sanitization which allows an attacker to access files and directories that are stored outside the intended folder via req.url...

CVE-2020-36623 Pengu index.js runApp cross-site request forgery

A vulnerability was found in Pengu. It has been declared as problematic. Affected by this vulnerability is the function runApp of the file src/index.js. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The name of the patch is...

CVE-2020-36623

A vulnerability was found in Pengu. It has been declared as problematic. Affected by this vulnerability is the function runApp of the file src/index.js. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The name of the patch is...

CVE-2020-36623: Incorrect Authorization

A vulnerability was found in Pengu. It has been declared as problematic. Affected by this vulnerability is the function runApp of the file src/index.js. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The name of the patch is...

PT-2022-9018

Name of the Vulnerable Software and Affected Versions Pengu affected versions not specified Description A vulnerability was found in Pengu, affecting the function runApp of the file src/index.js. This issue leads to cross-site request forgery and can be launched remotely. Recommendations Apply a...

Prototype Pollution

whois is vulnerable to prototype pollution. The vulnerability exists in the lookup function of index.js via the addr variable which allows an attacker to modify object prototype attributes, resulting in prototype pollution...

Prototype Pollution

nodebb is vulnerable to prototype pollution. An attacker can inject properties into existing construct prototypes via the Namespaces attribute in the index.js and modify attributes such as proto, constructor, and prototype...

SQL Injection

feathers-sequelize is vulnerable to sql injection attacks. The vulnerability exists in thefind function of index.js because the parameters are not properly filtered which allows an attacker to inject and execute arbitrary sql queries...

Code injection

The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service ReDoS via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function...

CVE-2022-25918

The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service ReDoS via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function...

CVE-2022-25918 Regular Expression Denial of Service (ReDoS)

The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service ReDoS via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function...

CVE-2022-25918 Regular Expression Denial of Service (ReDoS)

The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service ReDoS via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function...

CVE-2022-25918

CVE-2022-25918 affects the npm package shescape (versions 1.5.10 and earlier than 1.6.1). The vulnerability is a Regular Expression Denial of Service (ReDoS) in the escape function (index.js) caused by an insecure regex in escapeArgBash. Exploitation can cause high CPU usage or denial of service ...

CVE-2022-25918: Inefficient Regular Expression Complexity

The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service ReDoS via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function...

Regular Expression Denial Of Service (ReDoS)

css-what is vulnerable to regular expression denial of service. Regular expression used for reattr variable of index.js does not sufficiently include superscript in range, allowing an attacker to pass malicious input via the parse function to cause denial of service...