nis-model (>=0.6.0, <=0.6.22), nis-view (>=0.1.1, <=0.1.8) potentially affected by CVE-2020-7703 via nis-utils (0.6.10)

nis-utils NPM version 0.6.10 is affected by a known vulnerability. The following packages have a transitive dependency on nis-utils and may be impacted: - nis-model =0.6.0, =0.1.1, =0.1.8 Source cves: CVE-2020-7703 Source advisory: OSV:GHSA-GR58-J5WH-M333...

CVE-2021-28860

In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via 'proto' through the mutate and merge functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential...

Design/Logic Flaw

In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via 'proto' through the mutate and merge functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential...

CVE-2021-28860

In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via 'proto' through the mutate and merge functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential...

CVE-2021-20084

Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' in jquery-sparkle 1.5.2-beta allows a malicious user to inject properties into Object.prototype...

Arbitrary file deletion

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on...

XStream Code Execution Vulnerability (CNVD-2021-28332)

XStream is a simple Java-based library , Java objects serialized to xml and vice versa i.e. : Java objects and xml documents can easily be converted to each other . A code execution vulnerability exists in XStream, which can be exploited by an attacker to manipulate the processed input stream and...

6xs (>=0.1.0, <=0.1.3), 7ghost (>=4.11.0, <=4.11.46) +2400 more potentially affected by CVE-2020-28472 via aws-sdk (>=2.0.0-rc1, <=2.813.0)

aws-sdk NPM version =2.0.0-rc1, =0.1.0, =4.11.0, =3.10.1, =2.0.0, =1.0.0, =0.1.0, =1.16.0, =2.0.0, =3.7.0 and more Source cves: CVE-2020-28472 Source advisory: SNYK:JS-AWSSDK-1059424...

Design/Logic Flaw

This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands...

@gearedminds/tsed-api-support (2.0.0), @kabuce/api (0.0.1-alpha.42) +18 more potentially affected by CVE-2020-7748 via @tsed/core (>=5.0.1, <=5.65.6)

@tsed/core NPM version =5.0.1, =5.0.4, =5.0.4, =5.0.4, =5.34.2, =5.60.0, =5.0.4, =5.0.4, =5.34.2, =5.45.0, =5.60.0, =5.34.2, =5.0.4, =5.0.4, =5.47.0 and more Source cves: CVE-2020-7748 Source advisory: SNYK:JS-TSEDCORE-1019382...

Prototype Pollution in lodash.defaultsdeep

Versions of lodash.defaultsdeep before 4.6.1 are vulnerable to Prototype Pollution. The function 'defaultsDeep' may allow a malicious user to modify the prototype of Object via proto causing the addition or modification of an existing property that will exist on all objects. Recommendation Update...

@arve.knudsen/bankai (>=9.6.0, <=9.10.14), @citation-js/browserify-disc (1.3.4) +63 more potentially affected by CVE-2020-36632 via flat (>=1.0.0, <=1.6.0)

flat NPM version =1.0.0, =9.6.0, =2.6.0, =1.0.0, =1.0.0-1, =0.0.1, =0.0.1, =0.0.10, =1.0.0, =7.3.0, =9.10.4, =0.0.1, =0.0.3, =0.0.4 and more Source cves: CVE-2020-36632 Source advisory: SNYK:JS-FLAT-596927...

Mozilla: Information disclosure due to manipulated URL object

The Mozilla Foundation Security Advisory describes this flaw as: Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript...

Node.js third-party modules: [plain-object-merge] Prototype pollution

I would like to report a prototype pollution vulnerability in plain-object-merge module. It allows an attacker to inject properties on Object.prototype. Module module name: plain-object-merge version: 1.0.1 npm page: https://www.npmjs.com/package/plain-object-merge Module Description Extremely fa...

@appirio/salesforce (>=0.5.9, <=2.0.1), @artemis-prime/facebook-messenger-bot (1.0.1) +205 more potentially affected by CVE-2017-1000048 via qs (>=6.1.0, <=6.1.1)

qs NPM version =6.1.0, =0.5.9, =1.1.25, =1.0.88, =1.1.7, =1.3.20, =16.1.4, =0.0.1, =2.0.1, =1.0.0, =1.1.7, =1.1.18 and more Source cves: CVE-2017-1000048 Source advisory: OSV:GHSA-GQGV-6JQ5-JJJ9...

CVE-2020-7643

paypal-adaptive through 0.4.2 manipulation of JavaScript objects resulting in Prototype Pollution. The PayPal function could be tricked into adding or modifying properties of Object.prototype using a proto payload...

Design/Logic Flaw

paypal-adaptive through 0.4.2 manipulation of JavaScript objects resulting in Prototype Pollution. The PayPal function could be tricked into adding or modifying properties of Object.prototype using a proto payload...

CVE-2020-7643

CVE-2020-7643 affects the npm package paypal-adaptive (pre-0.4.3 up to 0.4.2) where the PayPal function can be tricked into adding or modifying properties of Object.prototype via a proto payload, causing prototype pollution. Multiple sources (Red Hat, Snyk, CVE, GitHub advisories, Veracode, CNVD)...

CVE-2020-7598

A flaw was found in nodejs-minimist, where it was tricked into adding or modifying properties of the Object.prototype using a "constructor" or "proto" payload. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability...

CVE-2019-10805

valib through 2.0.0 allows Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions provided by valib. Valib uses a built-in function hasOwnProperty from the unsafe user-input to examine an object. It is possible for a crafted payload to overwri...