CVE-2021-3645 Prototype Pollution in viking04/merge

merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

CVE-2021-3645

CVE-2021-3645 concerns the npm package viking04/merge , described across connected documents as vulnerable to Prototype Pollution : Improperly Controlled Modification of Object Prototype Attributes. The Red Hat, Veracode, and OSV entries all reiterate the same issue, highlighting that an attacker...

Github merge 安全漏洞

Github merge is a simple npm package that merges many sources into a target. merge suffers from a security vulnerability that can be exploited by an attacker for remote code execution...

AZL-6758 CVE-2021-39253 affecting package ntfs-3g for versions less than 2021.8.22-1

A crafted NTFS image can cause an out-of-bounds read in ntfsrunlistsmergei in NTFS-3G 2021.8.22...

DEBIAN-CVE-2021-39253

A crafted NTFS image can cause an out-of-bounds read in ntfsrunlistsmergei in NTFS-3G 2021.8.22...

UBUNTU-CVE-2021-39253

A crafted NTFS image can cause an out-of-bounds read in ntfsrunlistsmergei in NTFS-3G 2021.8.22...

CVE-2021-39253

A crafted NTFS image can cause an out-of-bounds read in ntfsrunlistsmergei in NTFS-3G 2021.8.22...

Prototype Pollution

Overview @cookiex/deep is a Tool to assign properties recursively and create recursion features in an easy way. Affected versions of this package are vulnerable to Prototype Pollution. The global proto object can be polluted using the proto object. PoC var deep = require"@cookiex/deep" const targ...

Prototype Pollution in Proto

This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function...

GHSA-58G2-9FQR-36Q2 Prototype Pollution in Proto

This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function...

Prototype Pollution

Proto is vulnerable to prototype pollution. An attacker is able to exploit the vulnerability to inject arbitrary properties into existing construct prototypes and modify attributes such as proto, constructor and prototype via the merge function...

GHSA-F9CV-665R-275H Prototype Pollution in merge-change

All current versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function...

Prototype Pollution in merge-change

All current versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function...

CVE-2021-23426

This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function...

Design/Logic Flaw

This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function...

CVE-2021-23426

Proto is vulnerable to prototype pollution via the merge function across all versions. The root cause is an unsafe recursive merge (and related path-based pollution) that can inject properties into Object.prototype (proto , constructor, prototype). Potential impact includes DoS and possible remot...

CVE-2021-23426 Prototype Pollution

This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function...

CVE-2021-23426

This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function...

Prototype Pollution

Overview dotty is a package that can access properties of nested objects using dot-path notation. Affected versions of this package are vulnerable to Prototype Pollution. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the path parameter a...

Prototype Pollution

Overview jsonpointer is a Simple JSON Addressing. Affected versions of this package are vulnerable to Prototype Pollution. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays. PoC const jsonpointer = require'jsonpointer'...