@copart/ops-tool-kit (>=0.0.37, <=0.0.53), @openfin/multer-s3 (>=2.0.0, <=2.2.0) +4 more potentially affected by CVE-2019-20149 via kind-of (6.0.2)

kind-of NPM version 6.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on kind-of and may be impacted: - @copart/ops-tool-kit =0.0.37, =2.0.0, =0.0.1, =0.0.3, =0.1.0, =1.2.6 Source cves: CVE-2019-20149 Source advisory: GHSA-6C8F-QPHG-QJGP...

Validation Bypass in kind-of

Versions of kind-of 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check, allowing attackers to bypass the type checking validation. Recommendation Upgrade to versions 6.0.3 or later...

Validation Bypass

Overview Versions of kind-of 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check, allowing attackers to bypass the type checking validation. Recommendation Upgrade to versions 6.0.3 or later. References - GitHub issue -...

kind-of injection vulnerability

kind-of is a JavaScript type checking package. An injection vulnerability exists in the 'ctorName' function of the index.js file in kind-of version v6.0.2, which can be exploited by an attacker to override internal attributes and manipulate the results of type checking...

CVE-2019-20149

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...

AZL-44298 CVE-2019-20149 affecting package js-jquery for versions less than 3.5.0-4

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...

AZL-47271 CVE-2019-20149 affecting package js-jquery for versions less than 3.5.0-4

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...

CVE-2019-20149

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...

DEBIAN-CVE-2019-20149

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...

Design/Logic Flaw

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...

CVE-2019-20149

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...

UBUNTU-CVE-2019-20149

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...

CVE-2019-20149

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...

CVE-2019-20149

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...

CVE-2019-20149

CVE-2019-20149 pertains to kind-of v6.0.2 where ctorName in index.js can be overwritten via a crafted payload to alter type-detection results by exploiting a conflicting name (e.g., 'constructor': {'name':'Symbol'}). The IBM QRadar Use Case Manager bulletin (connected doc) aggregates this CVE amo...

@copart/ops-tool-kit (>=0.0.37, <=0.0.53), @openfin/multer-s3 (>=2.0.0, <=2.2.0) +4 more potentially affected by CVE-2019-20149 via kind-of (6.0.2)

kind-of NPM version 6.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on kind-of and may be impacted: - @copart/ops-tool-kit =0.0.37, =2.0.0, =0.0.1, =0.0.3, =0.1.0, =1.2.6 Source cves: CVE-2019-20149 Source advisory: MEND:CVE-2019-20149...

CVE-2019-20149

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...

CVE-2019-20149: Exposure of Resource to Wrong Sphere

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...

PT-2019-5802

Name of the Vulnerable Software and Affected Versions kind-of versions 6.0.0 through 6.0.2 Description The issue is related to insufficient input validation in the kind-of library, which can be exploited by a remote attacker to cause a denial of service. Specifically, the ctorName in index.js of...

PT-2018-14723

Name of the Vulnerable Software and Affected Versions AbiSoft Ticketly version 1.0 Description The issue affects AbiSoft Ticketly through multiple SQL Injection vulnerabilities. These vulnerabilities are found in the parameters name, category id, and description in the "action/addproject.php"...