Security Bulletin: CVE-2020-8203

Summary Node.js lodash module is vulnerable to a denial of service, caused by a prototype pollution attack. A remote attacker could exploit this vulnerability using the merge, mergeWith, and defaultsDeep functions to inject properties onto Object.prototype to crash the server and possibly execute...

Security Bulletin: Vulnerabilities in lodash library affect Tivoli Netcool/OMNIbus WebGUI (CVE-2019-1010266, CVE-2020-28500, CVE-2018-16487, CVE-2018-3721, CVE-2020-8203, CVE-2021-23337, CVE-2019-10744)

Summary lodash is used by Tivoli Netcool/OMNIbus WebGUI as part of its web client component. The fix includes lodash v4.17.21. Vulnerability Details CVEID:CVE-2019-1010266 DESCRIPTION: Lodash is vulnerable to a denial of service, caused by uncontrolled resource consumption in Date handler. By...

Malicious code in hs-lodash (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f11abb41997036fa9a5655dc4cc1f1783db72169e03b63246d8c93964bd1b3b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3687 Malicious code in hs-lodash (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f11abb41997036fa9a5655dc4cc1f1783db72169e03b63246d8c93964bd1b3b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in get-lodash-template-vars (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7916d6bceee662db12088e55ab01e3ad32487d802c99bf7dc60e63c156d5bf0e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties

A Prototype Pollution vulnerability was found in lodash. Calling certain methods with untrusted JSON could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with...

@zambezi/ez-doc (1.0.0-prepare-for-open-source.1), apigeeks-devdocs (1.0.5) +4 more potentially affected by CVE-2019-19596 via gitbook (>=2.5.2, <=2.6.6)

gitbook NPM version =2.5.2, =1.0.3, =1.0.4 - gitbook-plugin-plasma 1.0.0 - lab-devdocs 0.0.1 Source cves: CVE-2019-19596 Source advisory: OSV:GHSA-HWGP-C653-6684...

Security Bulletin: IBM Robotic Process Automation is vulnerable to a denial of service through node.js lodash

Summary Security Bulletin: IBM Robotic Process Automation is vulnerable to a denial of service through node.js lodash Vulnerability Details CVEID:CVE-2019-10744 DESCRIPTION: Node.js lodash module is vulnerable to a denial of service, caused by a prototype pollution flaw. By sending a...

Security Bulletin: Lodash versions prior to 4.17.21 vulnerability in PowerHA System Mirror for AIX

Summary Lodash versions prior to 4.17.21 caused vulnerability in PowerHA System Mirror for AIX releases in service. Vulnerability Details CVEID: CVE-2021-23337 DESCRIPTION: Node.js lodash module could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by a...

Security Bulletin: Node.js lodash vulnerability affects IBM Spectrum Control (formerly Tivoli Storage Productivity Center) ( CVE-2019-10744)

Summary Node.js lodash denial of service vulnerability affects IBM Spectrum Control formerly Tivoli Storage Productivity Center. Vulnerability Details CVEID: CVE-2019-10744 DESCRIPTION: Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be...

10by10-react-app (1.2.1), 1508-cli (>=1.0.0, <=1.0.6) +19162 more potentially affected by CVE-2020-28500 via lodash (>=4.0.0, <=4.17.20)

lodash NPM version =4.0.0, =1.0.0, =0.0.1, =1.0.0, =0.0.2, =0.1.1, =1.0.0, =0.2.0, =0.0.2, =0.1.0, =0.1.0, =1.0.23, =4.11.0, =4.11.20 and more Source cves: CVE-2020-28500 Source advisory: OSV:GHSA-29MW-WPGM-HMR9...

GHSA-29MW-WPGM-HMR9 Regular Expression Denial of Service (ReDoS) in lodash

All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service ReDoS via the toNumber, trim and trimEnd functions. Steps to reproduce provided by reporter Liyuan Chen: js var lo = require'lodash'; function buildblankn var ret = "1" for var i = 0; i n; i++ r...

Regular Expression Denial of Service (ReDoS) in lodash

All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service ReDoS via the toNumber, trim and trimEnd functions. Steps to reproduce provided by reporter Liyuan Chen: js var lo = require'lodash'; function buildblankn var ret = "1" for var i = 0; i n; i++ r...

@across-ui/example (>=0.0.1-alpha.4, <=0.0.4-alpha.5), @admui/grid (>=0.1.10, <=0.3.1) +806 more potentially affected by CVE-2020-28500 via lodash-es (>=4.0.0, <=4.17.20)

lodash-es NPM version =4.0.0, =0.0.1-alpha.4, =0.1.10, =0.0.1, =0.0.2, =3.2.1, =3.2.1, =3.2.1, =0.0.1, =3.2.1, =3.2.1, =0.1.0, =0.3.14, =0.4.42 and more Source cves: CVE-2020-28500 Source advisory: OSV:GHSA-29MW-WPGM-HMR9...

Regular Expression Denial of Service (ReDoS) in lodash

All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service ReDoS via the toNumber, trim and trimEnd functions. Steps to reproduce provided by reporter Liyuan Chen: var lo = require'lodash'; function buildblankn var ret = "1" for var i = 0; i n; i++ ret ...

Critical: Red Hat Security Advisory: Red Hat Fuse 7.10.0 release and security update

A minor version update from 7.9 to 7.10 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring...

nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties

A Prototype Pollution vulnerability was found in lodash. Calling certain methods with untrusted JSON could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with...

Withdrawn: Arbitrary code execution in lodash

Withdrawn GitHub has chosen to publish this CVE as a withdrawn advisory due to it not being a security issue. See this issue for more details. CVE description " DISPUTED A command injection vulnerability in Lodash 4.17.21 allows attackers to achieve arbitrary code execution via the template...

@draadnl/openstad-cms (>=0.12.2, <=0.12.3), apostrophe-personas (>=2.0.0, <=2.2.1) +1 more potentially affected by CVE-2021-25979 via apostrophe (>=2.107.2, <=2.227.12)

apostrophe NPM version =2.107.2, =0.12.2, =2.0.0, =2.2.1 - apostrophe-selective-permissions 2.0.0 Source cves: CVE-2021-25979 Source advisory: OSV:GHSA-9J9M-8WJC-FF96...

@draadnl/openstad-cms (>=0.12.2, <=0.12.3), apostrophe-personas (>=2.0.0, <=2.2.1) +1 more potentially affected by CVE-2021-25978 via apostrophe (>=2.107.2, <=2.227.12)

apostrophe NPM version =2.107.2, =0.12.2, =2.0.0, =2.2.1 - apostrophe-selective-permissions 2.0.0 Source cves: CVE-2021-25978 Source advisory: OSV:GHSA-4R9C-JGHC-CX5M...