3118 matches found
Prototype Pollution
Overview set-in is a set value of nested associative structure given array of keys Affected versions of this package are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix of...
Sandbox Bypass
Overview Affected versions of this package are vulnerable to Sandbox Bypass. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an object's prototype. Note: This vulnerability derives...
Prototype Pollution
Overview Affected versions of this package are vulnerable to Prototype Pollution. It allows an attacker to cause a denial of service and may lead to remote code execution. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-STRIKEENTCOSET-1038821 PoC: ...
Prototype Pollution
Overview sds is a structured data search package. Affected versions of this package are vulnerable to Prototype Pollution. The library could be tricked into adding or modifying properties of the Object.prototype by abusing the set function located in js/set.js. Note: This vulnerability derives fr...
Prototype Pollution
Overview deep-get-set is a Set and get values on objects via dot-notation strings. Affected versions of this package are vulnerable to Prototype Pollution via the 'deep' function. Note: This vulnerability derives from an incomplete fix of CVE-2020-7715 POC: js let deep = require'deep-get-set';...
Prototype Pollution
Overview cached-path-relative is a memoize the results of the path.relative function. Affected versions of this package are vulnerable to Prototype Pollution via the cache variable that is set as instead of Object.createnull in the cachedPathRelative function, which allows access to the parent...
CVE-2022-0172
An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP restriction for public projects through GraphQL allowing unauthorised users to read titles of issues, merge requests and milestones...
UBUNTU-CVE-2022-0172
An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP restriction for public projects through GraphQL allowing unauthorised users to read titles of issues, merge requests and milestones...
Prototype Pollution
Overview keyget is an Is nested object manipulation kit. It can find, get, set, push or call nested properties. Note: The package is deprecated due to prototype pollution vulnerability. Affected versions of this package are vulnerable to Prototype Pollution via the methods set, push, and at which...
PT-2022-13008 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.3 and later Description: An issue has been discovered in GitLab CE/EE, where under certain conditions, it was possible to bypass the IP restriction for public projects through GraphQL. This allowed unauthorized users ...
Prototype Pollution
Overview libnested is a package with basic functions map, each, get, set, keys for nested objects. Affected versions of this package are vulnerable to Prototype Pollution via the set function in index.js. Note: This vulnerability derives from an incomplete fix for CVE-2020-28283 PoC: js const...
The vulnerability of the `ntfs_runlists_merge_i` function in the NTFS file system driver for the FUSE NTFS-3G module arises from the reading beyond the buffer’s allowed limits. This allows an attacker to access confidential data, compromise its integrity, and cause service failures.
The vulnerability of the ntfsrunlistsmergei function in the NTFS file system driver for the FUSE NTFS-3G module relates to reading data from beyond the allowed buffer limits. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause servi...
GitLab 安全漏洞
GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. Gitlab has a security vulnerability that stems from the software's lack of...
GHSA-GJM5-83CW-P3P2 Prototype Pollution in extend2
The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge...
Prototype Pollution in extend2
The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge...
CVE-2021-23568
The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge...
CVE-2021-23568
The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge...
Code injection
The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge...
CVE-2021-23568
CVE-2021-23568 affects the JavaScript package extend2 (versions before 1.0.1). The vulnerability is a Prototype Pollution in the extend function caused by unsafe recursive merge, enabling an attacker to inject properties (such as proto ) into Object.prototype, potentially leading to DoS or remote...