58 matches found
CVE-2021-23438
This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOfpartsi !== -1 returns -1 if partsi is 'proto'. This is because the method that has been called if the input is an array is...
Type confusion
This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOfpartsi !== -1 returns -1 if partsi is 'proto'. This is because the method that has been called if the input is an array is...
CVE-2021-23438
CVE-2021-23438 affects the Node.js mpath module prior to 0.8.4. The vulnerability is a type confusion that can bypass CVE-2018-16490 by mishandling array input (using Array.prototype.indexOf instead of String.prototype.indexOf) when processing the path elements, enabling a prototype/polution-styl...
CVE-2021-23438 Prototype Pollution
This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOfpartsi !== -1 returns -1 if partsi is 'proto'. This is because the method that has been called if the input is an array is...
CVE-2021-23438
This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOfpartsi !== -1 returns -1 if partsi is 'proto'. This is because the method that has been called if the input is an array is...
mpath module 安全漏洞
The mpath module is a module for getting/setting the value of a javascript object using a path representation similar to MongoDB. A security vulnerability exists in mpath module before 0.8.4, which stems from type confusion, where if the input is an array, the method called is...
1405-authtokens (>=1.0.1 <=1.0.5), 1405_logging (=1.0.0) +4380 more potentially affected by CVE-2018-16490 +1 more via mpath (>=0.1.1 <=0.8.3)
mpath NPM version =0.1.1, =1.0.1, =1.0.7, =0.0.1, =0.0.2, =0.3.0, =0.0.1, =0.3.5, =1.2.3, =0.2.0, =0.0.1, =0.1.3 and more Source cves: CVE-2018-16490, CVE-2021-23438 Source advisory: SNYK:JS-MPATH-1577289...
Prototype Pollution
Overview mpath is a package that gets/sets javascript object values using MongoDB-like path notation. Affected versions of this package are vulnerable to Prototype Pollution. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition...
fence security update
CentOS Errata and Security Advisory CESA-2020:5003 An update for fence-agents is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
kernel security and bug fix update
4.18.0-193.14.32.OL8 - Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x6...
Mozilla Firefox URL mPath Information Disclosure Vulnerability
Summary An information disclosure vulnerability exists in the URL mPath functionality of Mozilla Firefox Firefox Nightly Version 78.0a1 x64 and Firefox Release Version 76.0.2 x64. A specially crafted URL object can cause an out-of-bounds read. An attacker can visit a webpage to trigger this...
kernel security, bug fix, and enhancement update
4.18.0-80.7.10.OL8 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 4.18.0-80.7.10 - x86 Update stepping values for Whiskey Lake U/Y David Arcari...
47pages-keystone (>=0.0.1 <=0.0.5), @abtnode/mongoose-nedb (=1.0.16) +1543 more potentially affected by CVE-2018-16490 via mpath (>=0.1.1 <=0.5.0)
mpath NPM version =0.1.1, =0.0.1, =0.0.1, =0.7.15, =1.0.7, =0.0.0-alpha.1, =0.0.0, =0.0.1, =2.0.8, =1.2.17, =0.7.6, =0.7.6-8 and more Source cves: CVE-2018-16490 Source advisory: OSV:GHSA-H466-J336-74WX...
GHSA-H466-J336-74WX Prototype Pollution in mpath
Versions of mpath before 0.5.1 are vulnerable to prototype pollution. Provided certain input mpath can add or modify properties of the Object prototype. These properties will be present on all objects. Recommendation Update to version 0.5.1 or later...
Prototype Pollution in mpath
Versions of mpath before 0.5.1 are vulnerable to prototype pollution. Provided certain input mpath can add or modify properties of the Object prototype. These properties will be present on all objects. Recommendation Update to version 0.5.1 or later...
Prototype Pollution
Overview Versions of mpath before 0.5.1 are vulnerable to prototype pollution. Provided certain input mpath can add or modify properties of the Object prototype. These properties will be present on all objects. Recommendation Update to version 0.5.1 or later. References - HackerOne Report - GitHu...
CVE-2018-16490
A prototype pollution vulnerability was found in module mpath 0.5.1 that allows an attacker to inject arbitrary properties onto Object.prototype...
Prototype Pollution
mpath is vulnerable to prototype pollution. An attacker is able to inject arbitrary properties into Object.prototype to add or modify the path values...