GHSA-FM93-FHH2-CG2C Duplicate Advisory: Prototype Pollution in min-dash

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2m53-83f3-562j. This link is maintained to preserve external references. Original Description The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement...

Prototype Pollution

min-dash is vulnerable to prototype pollution. The vulnerability exists due to a lack of sanitization for the key types, allowing an attacker to exploit the vulnerability by injecting arbitrary properties into existing construct prototypes and modify attributes such as proto, constructor and...

CVE-2021-23460

The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types...

CVE-2021-23460

The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types...

CVE-2021-23460

The CVE-2021-23460 entry concerns the min-dash library (versions before 3.8.1) and a prototype pollution flaw in the set method caused by missing enforcement of key types. Affected software: min-dash; vulnerable component: the set method. Impact described across sources as prototype pollution tha...

CVE-2021-23460 Prototype Pollution

The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types...

CVE-2021-23460

The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types...

CVE-2021-23460

The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types...

PT-2022-9399

Name of the Vulnerable Software and Affected Versions min-dash versions prior to 3.8.1 Description The issue concerns Prototype Pollution via the set method due to missing enforcement of key types. Recommendations For versions prior to 3.8.1, update to version 3.8.1 or later to resolve the issue...

min-dash 安全漏洞

min-dash is a minimal utility belt for use with bpmn.io related libraries. A security vulnerability exists in versions prior to min-dash 3.8.1, which stems from the lack of critical type enforcement and makes the software susceptible to prototype contamination via the set method...

CVE-2021-23460: Improperly Controlled Modification of Object Prototype Attributes

The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types...

entfrm-bpmn (>=8.6.2, <=8.6.6), entfrm-flowable-designer (>=1.0.0, <=1.2.6) +4 more potentially affected by CVE-2021-23460 via min-dash (3.5.2)

min-dash NPM version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on min-dash and may be impacted: - entfrm-bpmn =8.6.2, =1.0.0, =2.2.0, =1.0.0, =1.1.3 Source cves: CVE-2021-23460 Source advisory: SNYK:JS-MINDASH-2340605...

Prototype Pollution

Overview min-dash is a Minimal utility tool belt to be used with bpmn.io related libraries. Affected versions of this package are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types. PoC: js let parser = require"min-dash"; parser.set, "proto", "polluted",...

CVE-2022-21684 User can bypass approval when invited to Discourse

Discourse is an open source discussion platform. Versions prior to 2.7.13 in stable, 2.8.0.beta11 in beta, and 2.8.0.beta11 in tests-passed allow some users to log in to a community before they should be able to do so. A user invited via email to a forum with mustapproveusers enabled is going to ...

org.keycloak:keycloak-dependencies-server-all (1.9.5.final), org.keycloak:keycloak-dependencies-server-min (1.9.5.final) +2 more potentially affected by CVE-2021-4133 via org.keycloak:keycloak-services (1.9.5.final)

org.keycloak:keycloak-services MAVEN version 1.9.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.9.5.final -...

org.keycloak:keycloak-dependencies-server-all (1.9.0.final), org.keycloak:keycloak-dependencies-server-min (1.9.0.final) +2 more potentially affected by CVE-2021-4133 via org.keycloak:keycloak-services (1.9.0.final)

org.keycloak:keycloak-services MAVEN version 1.9.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.9.0.final -...

org.keycloak:keycloak-dependencies-server-all (1.9.4.final), org.keycloak:keycloak-dependencies-server-min (1.9.4.final) +2 more potentially affected by CVE-2021-4133 via org.keycloak:keycloak-services (1.9.4.final)

org.keycloak:keycloak-services MAVEN version 1.9.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.9.4.final -...

io.github.johnjcool:keycloak-cas-services (>=4.2.0.final, <=4.2.1.final), org.keycloak:keycloak-dependencies-server-min (4.2.0.final) +3 more potentially affected by CVE-2021-4133 via org.keycloak:keycloak-services (4.2.0.final)

org.keycloak:keycloak-services MAVEN version 4.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.2.0.final, =4.2.1.final -...

org.keycloak:keycloak-authz-policy-drools (2.5.0.final), org.keycloak:keycloak-dependencies-server-all (2.5.0.final) +5 more potentially affected by CVE-2021-4133 via org.keycloak:keycloak-services (2.5.0.final)

org.keycloak:keycloak-services MAVEN version 2.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.5.0.final -...

io.github.johnjcool:keycloak-cas-services (>=4.3.0.final, <=4.3.1.final), org.keycloak:keycloak-dependencies-server-min (4.3.0.final) +3 more potentially affected by CVE-2021-4133 via org.keycloak:keycloak-services (4.3.0.final)

org.keycloak:keycloak-services MAVEN version 4.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.3.0.final, =4.3.1.final -...