The vulnerability of the `defaults` function in the Lodash library allows a attacker to trigger a service failure, execute arbitrary JavaScript code, or increase their privileges.

The vulnerability of the defaults function in the Lodash library is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service failures, execute arbitrary JavaScript code, or enhance their privileges...

Elastic Kibana < 6.8.2, 7.x < 7.2.1 Multiple Vulnerabilities (ESA-2019-09, ESA-2019-10) - Windows

Kibana is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Node.js third-party modules: Lodash "difference" (possibly others) Function Denial of Service Through Unvalidated Input

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! I would like to report a denial of...

Elastic Stack 6.8.2 and 7.2.1 security update

Elasticsearch race condition flaw ESA-2019-07 A race condition flaw was found in the response headers Elasticsearch returns to a request. On a system with multiple users submitting requests, it could be possible for an attacker to gain access to response header containing sensitive data from...

CVE-2019-10744

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload...

AZL-44634 CVE-2019-10744 affecting package js-jquery 3.5.0-4

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload...

DEBIAN-CVE-2019-10744

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload...

CVE-2019-10744

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload...

CVE-2019-10744

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload...

UBUNTU-CVE-2019-10744

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload...

Design/Logic Flaw

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload...

CVE-2019-10744

CVE-2019-10744 affects lodash versions lower than 4.17.12 and enables Prototype Pollution via defaultsDeep, by injecting a constructor payload to modify Object.prototype. IBM X-Force lists a base3.1 score of 9.1 (CRITICAL) and confirms the prototype pollution impact. Remediation: upgrade lodash t...

CVE-2019-10744

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload...

CVE-2019-10744

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload...

lodash prototype contamination vulnerability

lodash is an open source JavaScript utility library . A prototype contamination vulnerability exists in lodash versions prior to 4.17.12. An attacker can exploit the vulnerability to add or modify objects of Object.prototype with the help of the 'defaultsDeep' parameter...

1508-cli (>=1.0.0, <=1.0.6), 1k (>=0.0.1, <=0.0.11) +9565 more potentially affected by CVE-2019-1010266 via lodash (>=4.7.0, <=4.17.10)

lodash NPM version =4.7.0, =1.0.0, =0.0.1, =0.0.2, =0.1.1, =1.0.0, =0.1.0, =0.0.1, =0.2.1, =0.0.2, =0.0.7, =0.4.20, =1.0.0-beta.1, =1.0.6 - @36node/template-service 0.3.5 and more Source cves: CVE-2019-1010266 Source advisory: OSV:GHSA-X5RQ-J2XG-H7QM...

Regular Expression Denial of Service (ReDoS) in lodash

lodash prior to 4.7.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is:...

@dojo/cli-test-intern (>=0.1.0, <=2.0.0-beta3.1), express_mvc (>=4.1.1, <=4.3.10) +7 more potentially affected by CVE-2019-1010266 via lodash-amd (4.16.4)

lodash-amd NPM version 4.16.4 is affected by a known vulnerability. The following packages have a transitive dependency on lodash-amd and may be impacted: - @dojo/cli-test-intern =0.1.0, =4.1.1, =3.4.0, =0.0.1, =1.0.14, =0.0.7, =0.0.1, =0.1.5 - xirtam--matrix-operations 0.1.3 Source cves:...

@admui/grid (>=0.1.10, <=0.3.1), @atlantis-lab/grid (>=0.1.0, <=0.1.2) +99 more potentially affected by CVE-2019-1010266 via lodash-es (>=4.13.1, <=4.17.10)

lodash-es NPM version =4.13.1, =0.1.10, =0.1.0, =0.1.0-alpha.1, =3.2.3, =0.0.18-vojty-doc-split-components-2017-06-06T13-48-34-024Z, =57.1.8-pbenes-pb-jquery-2018-11-07T06-24-59-378Z, =3.1.5-pbenes-pb-jquery-2018-11-07T06-21-47-886Z, =1.0.0, =0.8.0-beta.1, =10.0.0-beta.1, =0.2.3, =0.0.7-beta.34,...

GHSA-X5RQ-J2XG-H7QM Regular Expression Denial of Service (ReDoS) in lodash

lodash prior to 4.7.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is:...