CVE-2020-8554

Creare un cluster Kubernetes root@kitploit: kind create cluster --config ./kind.yaml Il cluster deve avere certmanager: https://cert-manager.io/docs/installation/kubernetes/ Testare la vulnerabilità root@kitploit: kubectl apply -f - 'EOF' apiVersion: v1 kind: Namespace metadata: name:...

CVE-2026-3030-Prototype-Pollution-in-JSON-Merge-Patch

CVE-2026-3030 – JSON मर्ज पैच में प्रोटोटाइप प्रदूषण प्रोग्राम कोड Node.js root@kitploit: // server.js - Vulnerable REST API with deep merge const express = require'express'; const app = express; app.useexpress.json; let config = role: 'user', settings: ; // Insecure deep merge function pollutabl...

ROOT-APP-NPM-CVE-2020-28499 CVE-2020-28499 in @rootio/merge - Patched by Root

Root has patched CVE-2020-28499 in the @rootio/merge package for Root:npm. Multiple fixed versions available...

EUVD-2021-1022

Malware in sbrugna...

CVE-2020-8268

Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...

PT-2024-3288 · Wikimedia +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions 1.39.6 and earlier, 1.40.x versions prior to 1.40.2, 1.41.x versions prior to 1.41.1 Description: An issue was discovered in WikibaseLexeme, related to inadequate access control. This issue allows an attacker to make an edi...

PT-2023-5557 · Eclipse +3 · Eclipse Jgit +3

Name of the Vulnerable Software and Affected Versions: Eclipse JGit versions prior to 6.6.1.202309021850-r Eclipse JGit versions prior to 6.7.0.202309050840-r Eclipse JGit versions 5.13.3 prior to 5.13.3.202401111512-r Description: The issue is related to the handling of symbolic links in Eclipse...

GHSA-8V9X-9XQG-R8MR Prototype pollution in json8-merge-patch

Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...

Prototype pollution in json8-merge-patch

Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...

Paul Humphreys patchmerge 安全漏洞

Paul Humphreys patchmerge is Paul Humphreys an open source application . Provides an implementation of JSON Merge Patch RFC 7396 with extensions to support merging arrays of objects . A security vulnerability exists in patchmerge versions 1.0.0 through 1.0.1 that can be exploited by an attacker t...

Prototype Pollution

json8-merge-patch is vulnerable to prototype pollution. Failure to sanitize the apply functions allows for injection of arbitrary properties into existing construct prototypes and modification of attributes such as proto, constructor and prototype...

CVE-2020-8268

Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...

CVE-2020-8268

Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...

CVE-2020-8268

Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...

CVE-2020-8268

Prototype pollution vulnerability in json8-merge-patch npm package 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor...

CVE-2020-8268

The CVE-2020-8268 entry relates to the json8-merge-patch npm package. Affected software: json8-merge-patch prior to version 1.0.3. Root cause: the apply function fails to restrict access to object prototypes, enabling prototype pollution. Potential impact: modification of for-prototype behavior w...

Prototype Pollution in pierreinglebert/json-merge-patch

Description json-merge-patch is vulnerable to Prototype Pollution. This package fails to restrict access to prototypes of objects, allowing for modification of prototype behavior using a proto payload, which may result in Information Disclosure/DoS/RCE. Proof of Concept 1. Create the following Po...

Node.js third-party modules: [json8-merge-patch] Prototype Pollution

I would like to report a Prototype Pollution vulnerability in json8-merge-patch The apply function fails to restrict access to prototypes of objects, allowing for modification of prototype behavior. Module module name: json8-merge-patch version: v1.0.1 npm page:...