727 matches found
Security Bulletin: IBM Event Streams is affected by a Node.js http-proxy and lodash module vulnerabilities
Summary IBM Event Streams is affected by a Node.js http-proxy and lodash module denial of service vulnerabilities Vulnerability Details Third Party Entry: 183560 DESCRIPTION: Node.js lodash module denial of service CVSS Base score: 7.5 CVSS Temporal Score: See:...
nodejs-lodash: prototype pollution in zipObjectDeep function
A flaw was found in nodejs-lodash in versions 4.17.15 and earlier. A prototype pollution attack is possible which can lead to arbitrary code execution. The primary threat from this vulnerability is to data integrity and system availability...
Security Bulletin: IBM Cloud Transformation Advisor is affected by a Node.js lodash module vulnerability.
Summary IBM Cloud Transformation Advisor has addressed a Node.js lodash module vulnerability. Vulnerability Details Third Party Entry: 183560 DESCRIPTION: Node.js lodash module denial of service CVSS Base score: 7.5 CVSS Temporal Score: See:...
GHSA-779F-WGXG-QR8F Prototype Pollution in lodash.mergewith
Versions of lodash.mergewith before 4.6.2 are vulnerable to prototype pollution. The function mergeWith may allow a malicious user to modify the prototype of Object via constructor: prototype: ... causing the addition or modification of an existing property that will exist on all objects...
Prototype Pollution in lodash.mergewith
Versions of lodash.mergewith before 4.6.2 are vulnerable to prototype pollution. The function mergeWith may allow a malicious user to modify the prototype of Object via constructor: prototype: ... causing the addition or modification of an existing property that will exist on all objects...
GHSA-5947-M4FG-XHQG Prototype Pollution in lodash.mergewith
Versions of lodash.mergewith before 4.6.1 are vulnerable to Prototype Pollution. The function 'mergeWith' may allow a malicious user to modify the prototype of Object via proto causing the addition or modification of an existing property that will exist on all objects. Recommendation Update to...
GHSA-H5MP-5Q4P-GGF5 Prototype Pollution in lodash.defaultsdeep
Versions of lodash.defaultsdeep before 4.6.1 are vulnerable to prototype pollution. The function mergeWith may allow a malicious user to modify the prototype of Object via constructor: prototype: ... causing the addition or modification of an existing property that will exist on all objects...
GHSA-2M96-9W4J-WGV7 Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object via proto causing the addition or modification of an existing property that will exist on all objects. Recommendation Update to version...
GHSA-H726-X36V-RX45 Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via constructor: prototype: ... causing the addition or modification of an existing property that will exist on all objects. Recommendation...
nodejs-lodash: prototype pollution in zipObjectDeep function
A flaw was found in nodejs-lodash in versions 4.17.15 and earlier. A prototype pollution attack is possible which can lead to arbitrary code execution. The primary threat from this vulnerability is to data integrity and system availability...
Security Bulletin: WML CE: TensorBoard: Node.js lodash module is vulnerable to a denial of service, caused by a prototype pollution attack.
Summary Node.js lodash module is vulnerable to a denial of service, caused by a prototype pollution attack. TensorBoard uses lodash. A remote attacker could exploit this vulnerability using the merge, mergeWith, and defaultsDeep functions to inject properties onto Object.prototype to crash the...
CVE-2020-8203
A flaw was found in nodejs-lodash in versions 4.17.15 and earlier. A prototype pollution attack is possible which can lead to arbitrary code execution. The primary threat from this vulnerability is to data integrity and system availability...
@braneframe/plugin-github (>=0.1.53-main.2922731, <=0.6.7), @dxos/plugin-github (>=0.6.8-main.046e6cf, <=0.7.4) +26 more potentially affected by CVE-2020-8203 via lodash.update (4.10.2)
lodash.update NPM version 4.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on lodash.update and may be impacted: - @braneframe/plugin-github =0.1.53-main.2922731, =0.6.8-main.046e6cf, =0.2.19, =0.0.1, =5.5.0, =22.1.0-pre.1, =5.2.0, =4.0.0, =1.0.0,...
Prototype Pollution in lodash
Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions pick, set, setWith, update, updateWith, and zipObjectDeep allow a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires...
@across-ui/example (>=0.0.1-alpha.4, <=0.0.4-alpha.5), @admui/grid (>=0.1.10, <=0.3.1) +809 more potentially affected by CVE-2020-8203 via lodash-es (>=3.10.1, <=4.17.15)
lodash-es NPM version =3.10.1, =0.0.1-alpha.4, =0.1.10, =0.0.1, =0.0.2, =3.2.1, =3.2.1, =3.2.1, =0.0.1, =3.2.1, =3.2.1, =0.3.14, =0.4.63, =0.4.64 and more Source cves: CVE-2020-8203 Source advisory: OSV:GHSA-P6MC-M468-83GW...
GHSA-P6MC-M468-83GW Prototype Pollution in lodash
Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions pick, set, setWith, update, updateWith, and zipObjectDeep allow a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires...
0.workspace (>=0.1.0, <=0.1.1), 00ld8nuivn (2.1.0) +60345 more potentially affected by CVE-2020-8203 via lodash (>=3.7.0, <=4.17.18)
lodash NPM version =3.7.0, =0.1.0, =1.0.0, =1.1.0 - 02rjq8i863 1.1.0 - 02vx8qsp01 2.1.0 - 05y6tjgmws 1.1.0 - 066m7q8o0z 2.1.0 - 06buj9h3su 2.1.0 - 06dre15t8r 2.1.0 - 07fgapmu9l 1.1.0 - 07t2xvu6t4 2.1.0 - 0850u4lkpu 1.1.0 - 08cms 1.0.0 and more Source cves: CVE-2020-8203 Source advisory:...
CVE-2020-8203
Prototype pollution attack when using .zipObjectDeep in lodash before 4.17.20...