CVE-2021-42118 Stored XSS in TopEase

Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 via the Structure Component allows an authenticated remote attacker with Object Modification privileges to inject arbitrary HTML and JavaScript code in an object...

CVE-2021-42117 UI Redressing in TopEase

Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 allows an authenticated remote attacker with Object Modification privileges to insert arbitrary HTML without code execution...

CVE-2021-42117

CVE-2021-42117 affects Business-DNA Solutions GmbH TopEase Platform (Web Applications)

CVE-2021-42119: Improper Neutralization of Input During Web Page Generation

Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 via the Search Functionality allows authenticated users with Object Modification privileges to inject arbitrary HTML and JavaScript in object attributes, which is then...

PT-2021-23543

Name of the Vulnerable Software and Affected Versions TopEase Platform versions prior to 7.1.28 Description The issue allows authenticated users with Object Modification privileges to inject arbitrary HTML and JavaScript in object attributes via the Search Functionality. This can alter the intend...

PT-2021-23541

Name of the Vulnerable Software and Affected Versions TopEase Platform versions prior to 7.1.28 Description The issue is related to insufficient input validation in web applications, allowing an authenticated remote attacker with Object Modification privileges to insert arbitrary HTML. This can b...

PT-2021-23544

Name of the Vulnerable Software and Affected Versions TopEase Platform versions prior to 7.1.28 Description The issue is related to insufficient input validation in web applications, allowing an authenticated remote attacker with object modification privileges to insert arbitrarily long strings...

PT-2021-23542

Name of the Vulnerable Software and Affected Versions TopEase Platform versions prior to 7.1.28 Description The issue allows an authenticated remote attacker with Object Modification privileges to inject arbitrary HTML and JavaScript code in an object attribute via the Structure Component. This c...

CVE-2021-42118: Improper Neutralization of Input During Web Page Generation

Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 via the Structure Component allows an authenticated remote attacker with Object Modification privileges to inject arbitrary HTML and JavaScript code in an object...

CVE-2021-42122: Improper Input Validation

Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 on an object’s attributes with numeric format allows an authenticated remote attacker with Object Modification privileges to insert an unexpected format, which makes the...

CVE-2021-3645

merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

CVE-2021-24501: Unverified Ownership

The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations such as modifying or deleting objects. This allowed a logged in user to modify or delete objects belonging to other users on the site...

PT-2021-16022 · WordPress · Workreap

Name of the Vulnerable Software and Affected Versions: Workreap WordPress theme versions prior to 2.2.2 Description: The issue allows an attacker to trick a logged-in user into submitting a POST request to the vulnerable site, potentially modifying or deleting arbitrary objects on the target site...

Npm mixme has a denial of service vulnerability

Npm mixme is an application from the American company Npm. It is used to recursively merge multiple objects. The last object takes precedence over previous objects. A security vulnerability exists in Npm mixme version v0.5.0, which can be exploited by an attacker to add or modify properties of an...

CVE-2020-24939

Prototype pollution in Stampit supermixer 1.0.3 allows an attacker to modify the prototype of a base object which can vary in severity depending on the implementation...

GHSA-VRR3-5R3V-7XFW Improperly Controlled Modification of Dynamically-Determined Object Attributes in casperjs

Overview casperjs is a navigation scripting & testing utility for PhantomJS and SlimerJS. Affected versions of this package are vulnerable to Prototype Pollution via the mergeObjects utility function. PoC js var payload = JSON.parse'"proto": "a": "pwned"'; mergeObjects, payload; console.log.a; //...

Prototype Pollution

jquery-plugin-query-object is vulnerable to prototype pollution. An attacker is able to inject malicious properties into existing construct prototypes Object.prototype and modify attributes such as proto, constructor and prototype...

CVE-2021-20086

Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' in jquery-bbq 1.2.1 allows a malicious user to inject properties into Object.prototype...

GaussDB Kernel: Enabling the Auditing of Addition Deletion and Modification of Database Objects

The parameter auditsystemobject specifies whether to audit the CREATE, DROP, and ALTER operations on database objects, including DATABASE, USER, SCHEMA, and TABLE. After this parameter is set to on, operations on these database objects are traced. Copyright C 2020 Greenbone Networks GmbH Some tex...

yargs-parser Vulnerable to Prototype Pollution

Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects. Parsing the argument --foo.proto.bar...