EUVD-2020-1478

Malware in sbrugna...

Prototype Pollution in aheckmann/mquery

✍️ Description mquery is aware of the risk of prototype pollution in its exported functions cloneObject and merge and readily present protection by checking the key in var specialProperties = 'proto', 'constructor', 'prototype'. However, the current protection misses to protect another exported...

Prototype Pollution

Overview In mquery before version 3.2.3 there is a prototype pollution vulnerability because a special property e.g., proto can be copied during a merge or clone operation. Recommendation Upgrade to version 3.2.3 or later References - CVE - GitHub Advisory...

CVE-2020-35149

A flaw was found in mquery that allows a prototype pollution attack. This flaw allows an attacker to alter the code behavior by modifying the object prototype. A flaw in the lib/utils.js function allows cloning and merging objects without sanitizing their special properties, such as prototype...

1405-authtokens (>=1.0.1 <=1.0.5), 1405_logging (=1.0.0) +3899 more potentially affected by CVE-2020-35149 via mquery (>=0.2.4 <=3.2.2)

mquery NPM version =0.2.4, =1.0.1, =1.0.7, =0.0.1, =0.0.2, =0.3.0, =0.0.1, =0.2.0, =0.0.1, =1.0.16, =1.0.30, =1.0.95 and more Source cves: CVE-2020-35149 Source advisory: OSV:GHSA-45Q2-34RF-MR94...

Code Injection in mquery

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property e.g., proto can be copied during a merge or clone operation...

GHSA-45Q2-34RF-MR94 Code Injection in mquery

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property e.g., proto can be copied during a merge or clone operation...

Prototype Pollution

mquery is vulnerable to prototype pollution. The vulnerability exists as it does not prevent proto, constructor, prototype to be added in a merge or clone operation...

3nit-utils (>=0.24.0 <=1.0.2), @36node/template-service (=0.3.5) +577 more potentially affected by CVE-2020-35149 via mquery (>=3.0.0-rc0 <=3.2.2)

mquery NPM version =3.0.0-rc0, =0.24.0, =0.2.0, =3.7.0, =0.1.17, =1.0.0, =0.0.1, =0.0.2, =5.9.7, =0.7.0, =1.0.33, =2.1.3 and more Source cves: CVE-2020-35149 Source advisory: SNYK:JS-MQUERY-1050858...

Prototype Pollution

Overview mquery is an Expressive query building for MongoDB Affected versions of this package are vulnerable to Prototype Pollution via the merge function within lib/utils.js. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program. PoC...

CVE-2020-35149

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property e.g., proto can be copied during a merge or clone operation...

CVE-2020-35149

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property e.g., proto can be copied during a merge or clone operation...

Information disclosure

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property e.g., proto can be copied during a merge or clone operation...

CVE-2020-35149

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property e.g., proto can be copied during a merge or clone operation...

CVE-2020-35149

CVE-2020-35149 affects mquery before 3.2.3 via prototype pollution in lib/utils.js, where a special property (e.g., proto ) can be copied during merge or clone, altering object prototypes. Exploitation is described across sources (NVD, Red Hat advisory, Snyk) as a prototype pollution risk that ca...

Mquery Security Vulnerability

Aheckmann Mquery is a Javascript-based codebase for efficiently generating Mongdb query statements from the individual developer Aheckmann. A security vulnerability exists in mquery lib/utils.js versions prior to 3.2.3, which allows contamination attacks because a special attribute e.g. proto can...

Mquery - YARA Malware Query Accelerator (Web Frontend)

Ever had trouble searching for particular malware samples? This project is an analyst-friendly web GUI to look through your digital warehouse. mquery can be used to search through terabytes of malware in a blink of an eye: Thanks to the UrsaDB database, queries on large datasets can be extremely...