Security Bulletin: A security vulnerability in Node.js lodash module affects IBM Cloud Pak for Multicloud Management Infrastructure Management.

Summary Security Bulletin: A security vulnerability in Node.js lodash module affects IBM Cloud Pak for Multicloud Management Infrastructure Management. Vulnerability Details Third Party Entry: 183560 DESCRIPTION: Node.js lodash module denial of service CVSS Base score: 7.5 CVSS Temporal Score: Se...

Security Bulletin: Potential vulnerability with Node.js lodash module

Summary A potential vulnerability has been identified related to Node.js lodash module. Refer to details for additional information. Vulnerability Details Third Party Entry: 183560 DESCRIPTION: Node.js lodash module denial of service CVSS Base score: 7.5 CVSS Temporal Score: See:...

Security Bulletin: Node.js module upgrade for IBM Cloud Pak for Data Streams Flows

Summary A Node.js module has released an update that addresses a security issue. It is recommended to upgrade the module. Vulnerability Details Third Party Entry: 183560 DESCRIPTION: Node.js lodash module denial of service CVSS Base score: 7.5 CVSS Temporal Score: See:...

nodejs-lodash: prototype pollution in zipObjectDeep function

A flaw was found in nodejs-lodash in versions 4.17.15 and earlier. A prototype pollution attack is possible which can lead to arbitrary code execution. The primary threat from this vulnerability is to data integrity and system availability...

Low: Red Hat Security Advisory: Red Hat Virtualization security, bug fix, and enhancement update

An update is now available for Red Hat Virtualization Engine 4.4. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link...

RHEL 8 : Red Hat Virtualization (RHSA-2020:5179)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5179 advisory. The org.ovirt.engine-root is a core component of oVirt. The following packages have been upgraded to a later upstream version: engine-db-que...

@across-ui/example (>=0.0.1-alpha.4, <=0.0.4-alpha.5), @admui/grid (>=0.1.10, <=0.3.1) +806 more potentially affected by CVE-2021-23337 via lodash-es (>=4.0.0, <=4.17.20)

lodash-es NPM version =4.0.0, =0.0.1-alpha.4, =0.1.10, =0.0.1, =0.0.2, =3.2.1, =3.2.1, =3.2.1, =0.0.1, =3.2.1, =3.2.1, =0.1.0, =0.3.14, =0.4.42 and more Source cves: CVE-2021-23337 Source advisory: SNYK:JS-LODASHES-2434284...

Code Injection

Overview lodash is a modern JavaScript utility library delivering modularity, performance, & extras. Affected versions of this package are vulnerable to Code Injection due the improper validation of options.variable key names in .template. An attacker can execute arbitrary code at template...

10by10-react-app (1.2.1), 1508-cli (>=1.0.0, <=1.0.6) +19162 more potentially affected by CVE-2021-23337 via lodash (>=4.0.0, <=4.17.20)

lodash NPM version =4.0.0, =1.0.0, =0.0.1, =1.0.0, =0.0.2, =0.1.1, =1.0.0, =0.2.0, =0.0.2, =0.1.0, =0.1.0, =1.0.23, =4.11.0, =4.11.20 and more Source cves: CVE-2021-23337 Source advisory: SNYK:JS-LODASH-1040724...

Code Injection

Overview Affected versions of this package are vulnerable to Code Injection due the improper validation of options.variable key names in .template. An attacker can execute arbitrary code at template compilation time by injecting malicious expressions. If Object.prototype has been polluted,...

Code Injection

Overview lodash-rails is a lodash for the Rails asset pipeline. Affected versions of this package are vulnerable to Code Injection due the improper validation of options.variable key names in .template. An attacker can execute arbitrary code at template compilation time by injecting malicious...

scratch-paint (>=0.2.0-prerelease.20180531225024, <=0.2.0-prerelease.20180607153112), scratch-render (>=0.1.0-prerelease.20180531210700, <=0.1.0-prerelease.20180605145739) potentially affected by CVE-2020-7750 via scratch-svg-renderer (>=0.1.0-prerelease.20180524210316, <=0.1.0-prerelease.20180605140533)

scratch-svg-renderer NPM version =0.1.0-prerelease.20180524210316, =0.2.0-prerelease.20180531225024, =0.1.0-prerelease.20180531210700, =0.1.0-prerelease.20180605145739 Source cves: CVE-2020-7750 Source advisory: OSV:GHSA-J977-G5VJ-J27G...

@koj/strapi (>=0.0.0, <=1.4.0), strapi-editorjs (0.0.1) +1 more potentially affected by CVE-2020-27666 via strapi-plugin-content-manager (>=3.0.0-beta.18.7, <=3.1.6)

strapi-plugin-content-manager NPM version =3.0.0-beta.18.7, =0.0.0, =0.0.1-alpha.1, =0.0.1-alpha.2 Source cves: CVE-2020-27666 Source advisory: OSV:GHSA-QVP5-MM7V-4F36...

@across-ui/example (>=0.0.1-alpha.4, <=0.0.4-alpha.5), @admui/grid (>=0.1.10, <=0.3.1) +806 more potentially affected by CVE-2020-28500 via lodash-es (>=4.0.0, <=4.17.20)

lodash-es NPM version =4.0.0, =0.0.1-alpha.4, =0.1.10, =0.0.1, =0.0.2, =3.2.1, =3.2.1, =3.2.1, =0.0.1, =3.2.1, =3.2.1, =0.1.0, =0.3.14, =0.4.42 and more Source cves: CVE-2020-28500 Source advisory: SNYK:JS-LODASHES-2434289...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the toNumber, trim and trimEnd functions. POC var lo = require'lodash'; function buildblank n var ret = "1" for var i = 0; i n; i++ ret += " " return ret + "1"; var s = buildblank50000 var...

10by10-react-app (1.2.1), 1508-cli (>=1.0.0, <=1.0.6) +19162 more potentially affected by CVE-2020-28500 via lodash (>=4.0.0, <=4.17.20)

lodash NPM version =4.0.0, =1.0.0, =0.0.1, =1.0.0, =0.0.2, =0.1.1, =1.0.0, =0.2.0, =0.0.2, =0.1.0, =0.1.0, =1.0.23, =4.11.0, =4.11.20 and more Source cves: CVE-2020-28500 Source advisory: SNYK:JS-LODASH-1018905...

Regular Expression Denial of Service (ReDoS)

Overview lodash is a modern JavaScript utility library delivering modularity, performance, & extras. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the toNumber, trim and trimEnd functions. POC var lo = require'lodash'; function buildblank n var...

Security Bulletin: Vulnerabilities in Node.js affect IBM Integration Bus & IBM App Connect Enterprise V11

Summary IBM Integration Bus & IBM App Connect Enterprise V11 ship with Node.js for which vulnerabilities were reported and have been addressed. Vulnerability details are listed below Vulnerability Details Third Party Entry: 183560 DESCRIPTION: Node.js lodash module denial of service CVSS Base...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Pak for Data - Node.js (CVE-2020-8203)

Summary Security Vulnerabilities affect IBM Cloud Pak for Data - Node.js CVE-2020-8203 Vulnerability Details Third Party Entry: 183560 DESCRIPTION: Node.js lodash module denial of service CVSS Base score: 7.5 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/183560 fo...

Security Bulletin: Version 4.17.15 of Node.js module lodash included in IBM Netcool Operations Insight 1.6.1.x has a security vulnerability

Summary Security Bulletin: Version 4.17.15 of Node.js module lodash included in IBM Netcool Operations Insight 1.6.1.x has a security vulnerability Vulnerability Details Third Party Entry: 183560 DESCRIPTION: Node.js lodash module denial of service CVSS Base score: 7.5 CVSS Temporal Score: See:...