CVE-2024-23339

CVE-2024-23339 漏洞概述 CVE-2024-23339 CVSS : 6.5 2024年1月23日 Node.js 包中的原型污染 作为 rebob 项目的一部分 漏洞描述 github advisories hoolock 是一套轻量级实用工具，旨在打包时保持较小的体积。从 2.0.0 版本开始到 2.2.1 版本之前，与对象路径相关的工具函数（get、set 和 update）未能阻止对对象原型进行访问或修改的尝试。从 2.2.1 版本开始，当用户尝试访问或修改继承属性时，get、set 和 update 函数会抛出 TypeError。 影响...

CLSA-2026-1774830277 TuxCare security update for object-path (3 CVEs)

TuxCare rebuilt object-path to address 3 CVEs. Fixed in 0.11.4-tuxcare.1...

PT-2026-74214

TuxCare rebuilt object-path to address 3 CVEs. Fixed in 0.11.4-tuxcare.1...

Plone < 2.5.3 XSS

The version of Plone installed on the remote host is prior to 2.5.3. It is, therefore, affected by a cross-site scripting XSS vulnerability, in the skins/plonetemplates/defaulterrormessage.pt due to improper validation of the typename parameter to Members/ipa/createObject before returning it to...

Security update for sssd

This update for sssd fixes the following issues CVE-2026-14474: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation bsc1270709. CVE-2026-14476: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypas...

CVE-2026-31216

The nexent v1.7.5.2 backend service contains an unauthorized arbitrary storage file deletion vulnerability in its file management API. The DELETE /storage/objectname:path endpoint lacks authentication, authorization, and input validation mechanisms. Unauthenticated remote attackers can send craft...

EUVD-2021-2112

Malware in sbrugna...

EUVD-2020-1425

Malware in sbrugna...

EUVD-2022-1036

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2021-23434

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the...

Linux Distros Unpatched Vulnerability : CVE-2021-3805

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' CVE-2021-3805 Note that Nessus relies on th...

Malicious code in set-object-path (npm)

The package set-object-path was found to contain malicious code...

change-object (0.0.0) potentially affected by unknown CVE via change-object-path (0.0.1)

change-object-path NPM version 0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on change-object-path and may be impacted: - change-object 0.0.0 Source cves: unknown CVE Source advisory: OSV:MAL-2025-16781...

@xizhouh/former (>=0.0.1, <=1.1.1), @xizhouh/formless (>=0.0.1, <=0.0.6) +1 more potentially affected by unknown CVE via set-object-path (2.0.1)

set-object-path NPM version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on set-object-path and may be impacted: - @xizhouh/former =0.0.1, =0.0.1, =0.3.0, =0.3.3 Source cves: unknown CVE Source advisory: OSV:MAL-2025-33017...

MAL-2025-16781 Malicious code in change-object-path (npm)

The package change-object-path was found to contain malicious code...

MAL-2025-33017 Malicious code in set-object-path (npm)

The package set-object-path was found to contain malicious code...

Malicious code in change-object-path (npm)

The package change-object-path was found to contain malicious code...

Security Bulletin: There is a vulnerablity in the object-path library affecting IBM watsonx Code Assistant IDE Extensions

Summary There is a vulnerablity in the object-path library affecting IBM watsonx Code Assistant IDE Extensions. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2021-23434 DESCRIPTION: Node.js object-path module could allow a remote attack...

UIOMatic 注入漏洞

UIOMatic is a tool by Tim Geyssens personal developer. It automatically generates an integrated crud UI for npoco poco based db tables. An injection vulnerability exists in UIOMatic version 5, which stems from the file /src/UIOMatic/wwwroot/backoffice/resources/uioMaticObject.r that can lead to S...

CVE-2021-3805

A flaw was found in the object-path nodejs library when the del function is called to validate object properties. An attacker can manipulate or alter the prototype of an object causing the modification of default properties on all objects. This could lead into a service disruption or a denial of...