mquery

mquery: Blazingly fast Yara queries for malware analysts Ever had trouble searching for malware samples? Mquery is an analyst-friendly web GUI to look through your digital warehouse. It can be used to search through terabytes of malware in a blink of an eye: Under the hood we use our UrsaDB, to...

EUVD-2020-1478

Malware in sbrugna...

Prototype Pollution in aheckmann/mquery

✍️ Description mquery is aware of the risk of prototype pollution in its exported functions cloneObject and merge and readily present protection by checking the key in var specialProperties = 'proto', 'constructor', 'prototype'. However, the current protection misses to protect another exported...

Prototype Pollution

Overview In mquery before version 3.2.3 there is a prototype pollution vulnerability because a special property e.g., proto can be copied during a merge or clone operation. Recommendation Upgrade to version 3.2.3 or later References - CVE - GitHub Advisory...

CVE-2020-35149

A flaw was found in mquery that allows a prototype pollution attack. This flaw allows an attacker to alter the code behavior by modifying the object prototype. A flaw in the lib/utils.js function allows cloning and merging objects without sanitizing their special properties, such as prototype...

Code Injection in mquery

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property e.g., proto can be copied during a merge or clone operation...

3nit-utils (>=0.24.0, <=1.0.2), @36node/template-service (0.3.5) +576 more potentially affected by CVE-2020-35149 via mquery (>=3.0.0-rc0, <=3.2.2)

mquery NPM version =3.0.0-rc0, =0.24.0, =0.2.0, =3.7.0, =0.1.17, =1.0.0, =0.0.1, =0.0.2, =5.9.7, =0.7.0, =1.0.33, =2.1.3 and more Source cves: CVE-2020-35149 Source advisory: OSV:GHSA-45Q2-34RF-MR94...

3nit-utils (>=0.24.0, <=1.0.2), @36node/template-service (0.3.5) +576 more potentially affected by CVE-2020-35149 via mquery (>=3.0.0-rc0, <=3.2.2)

mquery NPM version =3.0.0-rc0, =0.24.0, =0.2.0, =3.7.0, =0.1.17, =1.0.0, =0.0.1, =0.0.2, =5.9.7, =0.7.0, =1.0.33, =2.1.3 and more Source cves: CVE-2020-35149 Source advisory: GHSA-45Q2-34RF-MR94...

GHSA-45Q2-34RF-MR94 Code Injection in mquery

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property e.g., proto can be copied during a merge or clone operation...

Prototype Pollution

mquery is vulnerable to prototype pollution. The vulnerability exists as it does not prevent proto, constructor, prototype to be added in a merge or clone operation...

Prototype Pollution

Overview mquery is an Expressive query building for MongoDB Affected versions of this package are vulnerable to Prototype Pollution via the merge function within lib/utils.js. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program. PoC...

3nit-utils (>=0.24.0, <=1.0.2), @36node/template-service (0.3.5) +576 more potentially affected by CVE-2020-35149 via mquery (>=3.0.0-rc0, <=3.2.2)

mquery NPM version =3.0.0-rc0, =0.24.0, =0.2.0, =3.7.0, =0.1.17, =1.0.0, =0.0.1, =0.0.2, =5.9.7, =0.7.0, =1.0.33, =2.1.3 and more Source cves: CVE-2020-35149 Source advisory: SNYK:JS-MQUERY-1050858...

CVE-2020-35149

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property e.g., proto can be copied during a merge or clone operation...

CVE-2020-35149

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property e.g., proto can be copied during a merge or clone operation...

Information disclosure

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property e.g., proto can be copied during a merge or clone operation...

CVE-2020-35149

CVE-2020-35149 affects mquery before 3.2.3 via prototype pollution in lib/utils.js, where a special property (e.g., proto ) can be copied during merge or clone, altering object prototypes. Exploitation is described across sources (NVD, Red Hat advisory, Snyk) as a prototype pollution risk that ca...

CVE-2020-35149

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property e.g., proto can be copied during a merge or clone operation...

CVE-2020-35149

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property e.g., proto can be copied during a merge or clone operation...

1405-authtokens (>=1.0.1, <=1.0.5), 1405_logging (1.0.0) +3896 more potentially affected by CVE-2020-35149 via mquery (>=0.2.4, <=3.2.2)

mquery NPM version =0.2.4, =1.0.1, =1.0.7, =0.0.1, =0.0.2, =0.3.0, =0.0.1, =0.2.0, =0.0.1, =1.0.16, =1.0.30, =1.0.95 and more Source cves: CVE-2020-35149 Source advisory: MEND:CVE-2020-35149...

PT-2020-17268

Name of the Vulnerable Software and Affected Versions mquery versions prior to 3.2.3 Description The issue allows a pollution attack because a special property, such as proto , can be copied during a merge or clone operation. This occurs in the lib/utils.js file. Recommendations For versions prio...