735 matches found
Security Bulletin: A security vulnerability in Node.js lodash module affects IBM Cloud Pak for Multicloud Management Managed Service
Summary A security vulnerability in Node.js lodash module affects IBM Cloud Pak for Multicloud Management Managed Service. Vulnerability Details CVEID: CVE-2021-23337 DESCRIPTION: Node.js lodash module could allow a remote authenticated attacker to execute arbitrary commands on the system, caused...
Security Bulletin: A security vulnerability in Node.js lodash module affects IBM Cloud Pak for Multicloud Management Managed Service
Summary A security vulnerability in Node.js lodash module affects IBM Cloud Pak for Multicloud Management Managed Service. Vulnerability Details CVEID: CVE-2020-28500 DESCRIPTION: Node.js lodash module is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS in...
Security Bulletin: A security vulnerability in Node.js Lodash module affects IBM Cloud Automation Manager.
Summary A security vulnerability in Node.js Lodash module affects IBM Cloud Automation Manager. Vulnerability Details CVEID: CVE-2021-23337 DESCRIPTION: Node.js lodash module could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by a command injection fla...
The vulnerability of the _zipObjectDeep() method implementation in the Lodash library allows a attacker to cause a service failure or execute arbitrary code.
The vulnerability of the zipObjectDeep method implementation in the Lodash library is related to the allocation of unlimited memory. Exploiting this vulnerability could allow an attacker to cause service failures or execute arbitrary code...
Command Injection
Overview lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. Recommendation Upgrade to version 4.17.21 or later References - CVE - GitHub Advisory - Snyk Advisory...
10by10-react-app (1.2.1), 1508-cli (>=1.0.0, <=1.0.6) +19162 more potentially affected by CVE-2021-23337 +1 more via lodash (>=4.0.0, <=4.17.20)
lodash NPM version =4.0.0, =1.0.0, =0.0.1, =1.0.0, =0.0.2, =0.1.1, =1.0.0, =0.2.0, =0.0.2, =0.1.0, =0.1.0, =1.0.23, =4.11.0, =4.11.20 and more Source cves: CVE-2021-23337, CVE-2026-4800 Source advisory: OSV:GHSA-35JH-R3H4-6JHM...
Command Injection in lodash
lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function...
@across-ui/example (>=0.0.1-alpha.4, <=0.0.4-alpha.5), @admui/grid (>=0.1.10, <=0.3.1) +806 more potentially affected by CVE-2021-23337 +1 more via lodash-es (>=4.0.0, <=4.17.20)
lodash-es NPM version =4.0.0, =0.0.1-alpha.4, =0.1.10, =0.0.1, =0.0.2, =3.2.1, =3.2.1, =3.2.1, =0.0.1, =3.2.1, =3.2.1, =0.1.0, =0.3.14, =0.4.42 and more Source cves: CVE-2021-23337, CVE-2026-4800 Source advisory: OSV:GHSA-35JH-R3H4-6JHM...
GHSA-35JH-R3H4-6JHM Command Injection in lodash
lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function...
Command Injection in lodash
lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function...
Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to a command injection vulnerability (CVE-2021-23337)
Summary App Connect Enterprise may be vulnerable to a command injection vulnerability due to Node.js module lodash Vulnerability Details CVEID: CVE-2021-23337 DESCRIPTION: Node.js lodash module could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by a...
Vulnerability fixed in NetApp products
Several NetApp products include Lodash. Lodash versions up to and including 4.17.15 are susceptible to a vulnerability that, when successfully exploited, can lead to the disclosure of sensitive information, the addition or modification of data, or Denial of Service DoS. NetApp has released update...
jsreport-keycloak-auth (>=0.0.1, <=0.0.2) potentially affected by CVE-2020-8128 via jsreport (2.0.0)
jsreport NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on jsreport and may be impacted: - jsreport-keycloak-auth =0.0.1, =0.0.2 Source cves: CVE-2020-8128 Source advisory: OSV:GHSA-5FJJ-CFH2-GHC5...
Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.2.2 security and bug fix update
Red Hat Advanced Cluster Management for Kubernetes 2.2.2 General Availability release images, which fix several bugs and security issues. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...
Security Bulletin: IBM Cloud Private is vulnerable to a Node.js lodash vulnerability (CVEID: 183560)
Summary IBM Cloud Private is vulnerable to a Node.js lodash vulnerability Vulnerability Details Third Party Entry: 183560 DESCRIPTION: Node.js lodash module denial of service CVSS Base score: 7.5 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/183560 for the current...
Regular Expression Denial Of Service (ReDoS)
lodash is vulnerable to Regular Expression Denial Of Service ReDoS. The usage of the insecure regex /\s+$/ allows an attacker to cause exponential processing time which could eventually lead to a denial of service condition...
Command Injection
lodash is vulnerable to Command Injection. The vulnerability exists through the unsanitized values of template...
CVE-2020-28500
A flaw was found in nodejs-lodash. A Regular Expression Denial of Service ReDoS via the toNumber, trim and trimEnd functions is possible...