Prototype Pollution

Overview utilities is an A classic collection of JavaScript utilities Affected versions of this package are vulnerable to Prototype Pollution via the mix function. PoC javascript var utilities = require"utilities" badobjects= test:"123" console.log"Before:"+.test...

Prototype Pollution

Overview progressbar.js is a Responsive and slick progress bars with animated SVG paths Affected versions of this package are vulnerable to Prototype Pollution via the function extend in the file utils.js. PoC js var progressbar = require"progressbar.js" BADJSON = JSON.parse'"proto":"test":123';...

Prototype Pollution

Overview whet.extend is an A sharped version of port of jQuery.extend that actually works on node.js Affected versions of this package are vulnerable to Prototype Pollution due to improper user input sanitization when using the extend and findValue functions. Details Prototype Pollution is a...

Prototype Pollution

Overview rangy is an A cross-browser DOM range and selection library Affected versions of this package are vulnerable to Prototype Pollution when using the extend function in file rangy-core.js.The function uses recursive merge which can lead an attacker to modify properties of the Object.prototy...

WordPress plugin Easy Forms for MailChimp 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

AngularJS: Prototype pollution in merge function could result in code injection

A prototype pollution vulnerability was found in AngularJS. A remote attacker could abuse this flaw by providing malicious input to the merge function by overriding or adding properties of the Object.prototype, allowing possible injection of code...

AngularJS: Prototype pollution in merge function could result in code injection

A prototype pollution vulnerability was found in AngularJS. A remote attacker could abuse this flaw by providing malicious input to the merge function by overriding or adding properties of the Object.prototype, allowing possible injection of code...

CVE-2022-44721

CVE-2022-44721 has been merged into CVE-2022-2841 and is not an active vulnerability entry. The connected records detail a CrowdStrike Falcon uninstall-protection issue (Uninstallation Handler) affecting multiple firmware/builds, with exploitation involving bypassing a one-time token/uninstall pr...

kernel: bfq: Avoid merging queues with different parents

In the Linux kernel, the following vulnerability has been resolved: bfq: Avoid merging queues with different parents It can happen that the parent of a bfqq changes between the moment we decide two queues are worth to merge and set bic-stablemergebfqq and the moment bfqsetupmerge is called. This...

Exploit for CVE-2022-21350

It is an offensive tool for Java-based web applications. The rep...

If the Ethereum Merge Fails, L2s Will Be More Vital Than Ever

By Waqas Ethereum merge is an upgrade to the Ethereum blockchain which will happen in mid-September 2022. This is a post from HackRead.com Read the original post: If the Ethereum Merge Fails, L2s Will Be More Vital Than Ever...

The vulnerabilities of the merge, mergeWith, and defaultsDeep functions in the Lodash library allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the merge, mergeWith, and defaultsDeep functions in the Lodash library is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

Wrong assumption of block time might cause wrong value of votingDelay, votingPeriod

Lines of code Vulnerability details Impact In NounsDAOLogic, there are some constants in the system are estimated with an assumption that block time is 15 second. These constants are used to check value of votingPeriod and votingDelay. Actually, the merge is near and after the merge blocks come...

Prototype Pollution

ts-deepmerge is vulnerable to pollution prototype. The vulnerability exists because of missing sanitization of the merge parameters in 'src/index.test.ts', allowing an attacker to inject malicious characteristics to add new values to a javascript application object prototype,overwriting or...

GHSA-7QQQ-GH2F-WQ76 ts-deepmerge before 2.0.2 vulnerable to Prototype Pollution

The package ts-deepmerge before version 2.0.2 is vulnerable to Prototype Pollution due to missing sanitization of the merge function...

ts-deepmerge before 2.0.2 vulnerable to Prototype Pollution

The package ts-deepmerge before version 2.0.2 is vulnerable to Prototype Pollution due to missing sanitization of the merge function...

CVE-2022-25907

The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function...

deepmerge-ts 安全漏洞

deepmerge-ts is an npm package. It is used to deep merge 2 or more objects with respect to type information. A security vulnerability exists in versions of deepmerge-ts prior to 2.0.2, which stems from the lack of handling of merge functions and is susceptible to prototype contamination...

PT-2022-17598 · Unknown · Ts-Deepmerge

Name of the Vulnerable Software and Affected Versions: ts-deepmerge versions prior to 2.0.2 Description: The issue is related to Prototype Pollution due to missing sanitization of the merge function. This allows for potential manipulation of the prototype, leading to various security issues...

selfdestruct will be banned after "The Purge" phase of ethereum merge. DepositReceiver may be broken. Any interaction between AxelarDepositService may result in the loss of fund.

Lines of code Vulnerability details Impact selfdestruct will be banned after "The Purge" phase of ethereum merge. DepositReceiver may be broken. Any interaction between AxelarDepositService may result in the loss of fund. Since AxelarDepositService that deal with native token is highly associated...