MAL-2025-59549 Malicious code in xaver-asinan10-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 314ef411a25ab5993284cdacbf95f7ebc6330c9bbf6650ab9ab395b4326d1d2d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in indah-tomat53-devapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c79257de326a35afd4b195293268aeafc17bb00a455e07b4cf005e077264387 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-53355 Malicious code in maya-mangut87-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87c4d0063b96190cbdaa9c16784057e0e11515805e9c8984e1b1b48f7cff0c3f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Keystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fields

Summary field.isFilterable access control can be bypassed in update and delete mutations by adding additional unique filters. These filters can be used as an oracle to probe the existence or value of otherwise unreadable fields. Specifically, when a mutation includes a where clause with multiple...

Design/Logic Flaw

Kyverno is a policy engine designed for Kubernetes. In versions of Kyverno prior to 1.10.0, resources which have the deletionTimestamp field defined can bypass validate, generate, or mutate-existing policies, even in cases where the validationFailureAction field is set to Enforce. This situation...

CVE-2017-20163

A vulnerability has been found in Red Snapper NView and classified as critical. This vulnerability affects the function mutate of the file src/Session.php. The manipulation of the argument session leads to sql injection. The name of the patch is cbd255f55d476b29e5680f66f48c73ddb3d416a8. It is...

NView SQL注入漏洞

NView is a php class for natural view management. NView suffers from a SQL injection vulnerability that stems from a problem with the function mutate in the file src/Session.php, where manipulation of the parameter session can lead to sql injection...

CVE-2017-20163: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in Red Snapper NView and classified as critical. This vulnerability affects the function mutate of the file src/Session.php. The manipulation of the argument session leads to sql injection. The name of the patch is cbd255f55d476b29e5680f66f48c73ddb3d416a8. It is...

PT-2023-10615 · Unknown · Red Snapper Nview

Name of the Vulnerable Software and Affected Versions: Red Snapper NView affected versions not specified Description: A critical vulnerability has been found in Red Snapper NView. This issue affects the mutate function of the file src/Session.php. The manipulation of the session argument leads to...

Prototype Pollution

mixme is vulnerable to prototype pollution. The function mutate and merge allows an attacker to get control of value of “path” and modify attributes such as proto, constructor and prototype...

Use of Potentially Dangerous Function in mixme

Impact In Node.js mixme v0.5.0, an attacker can add or alter properties of an object via 'proto' through the mutate and merge functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denia...

PT-2021-18252

Name of the Vulnerable Software and Affected Versions: mixme version 0.5.0 Description: The issue allows an attacker to add or alter properties of an object via proto through the mutate and merge functions, potentially causing a denial of service DoS and putting the program's availability at risk...

CVE-2021-28860

In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via 'proto' through the mutate and merge functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential...

CVE-2021-28860

In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via 'proto' through the mutate and merge functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential...

CVE-2021-28860

In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via 'proto' through the mutate and merge functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential...

PT-2021-17969

Name of the Vulnerable Software and Affected Versions: Node.js mixme versions prior to 0.5.1 Description: The issue allows an attacker to add or alter properties of an object via proto through the mutate and merge functions. The polluted attribute will be directly assigned to every object in the...

CVE-2021-28860: Improperly Controlled Modification of Object Prototype Attributes

In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via 'proto' through the mutate and merge functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential...

CVE-2021-25907

An issue was discovered in the containers crate before 0.9.11 for Rust. When a panic occurs, a util::mutate,mutate2 double drop can be performed...

CVE-2021-25907: Double Free

An issue was discovered in the containers crate before 0.9.11 for Rust. When a panic occurs, a util::mutate,mutate2 double drop can be performed...

RUSTSEC-2021-0010 panic safety: double drop may happen within `util::{mutate, mutate2}`

Upon panic in a user-provided function f, fn mutate & fn mutate2 drops twice a same object. Affected versions of this crate did not guard against double drop while temporarily duplicating an object's ownership with ptr::read. Dropping a same object can result in memory corruption. The flaw was...