Astra Linux – Vulnerability in Zabbix

The implementation of atob in "Zabbix JS" allows for creating a string with arbitrary content and using it to access internal properties of objects...

Prototype Pollution

@tanstack/form-core is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of object properties in the lib.mutateMergeDeep function, allowing attackers to inject properties into JavaScript prototypes by supplying a crafted payload...

The vulnerability of the Drupal CMS system’s kernel lies in the insufficient control over the modification of dynamically defined object properties, allowing attackers to execute arbitrary code.

The vulnerability of the Drupal CMS system’s kernel is related to insufficient control over the modification of dynamically defined object properties. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2024-36463

The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects...

DEBIAN-CVE-2024-36463

The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects...

CVE-2024-36463

The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects...

Prototype Pollution

Mermaid is vulnerable to prototype pollution.The vulnerability is due to prototype pollution in its bundled version of DOMPurify, which allows attackers to manipulate object properties in JavaScript, potentially causing unintended behavior in applications...

CVE-2024-6783

A vulnerability has been discovered in Vue, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript code...

CVE-2024-6783

CVE-2024-6783 affects Vue and is described in multiple sources as a prototype-pollution–driven XSS vulnerability that could allow an attacker to modify Object.prototype properties (e.g., staticClass/staticStyle) and execute arbitrary JavaScript. The available connected documents confirm the issue...

Arbitrary Code Execution

@thi.ng/paths is vulnerable to arbitrary code execution. The vulnerability is due to improper control of dynamically-managed code resources due to the handling of object properties in the mutIn and mutInManyUnsafe methods...

CVE-2024-28859 Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependency

Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer...

BIT-NODE-2022-21824

Due to the formatting logic of the "console.table" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "proto". The prototype pollution has...

CrushFTP Security Vulnerability

CrushFTP is a file transfer server. A security vulnerability exists in CrushFTP versions prior to 10.5.1 that stems from improper control of object properties, which can be exploited by an attacker to gain partial control over Java properties and allow arbitrary file reads and deletion of...

Type Confusion

hermes-engine is vulnerable to Type Confusion. When Hermes allows execution of untrusted JavaScript, an attacker is able to inject and execute malicious code on the system due to a type confusion bug which occurs as a result of copying objects properties...

CVE-2023-23557

An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malicious attacker to execute arbitrary code via type confusion. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScrip...

Type confusion

An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malicious attacker to execute arbitrary code via type confusion. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScrip...

CVE-2023-0842

xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited...

Prototype Pollution

rangy is vulnerable to Prototype Pollution. The vulnerability exists in the extend function of rangy-core.js, due to the usage of a recursive merge which allows an attacker to modify Object.prototype properties, resulting in Prototype Pollution...

Prototype Pollution

safe-eval is vulnerable to prototype pollution. The vulnerability exists in the safeEval function in index.js, because it allows an attacker to add or modify Object.prototype.Consolidate properties...

Prototype Pollution

deep-object-diff is vulnerable to prototype pollution. The library improperly validates the incoming JSON keys, which allows a remote attacker to edit or add new properties to an object through proto attribute...