129346 matches found
GHSA-W3X5-7C4C-66P9 Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)
Summary An unauthenticated attacker can pollute the internal state restoreFilePath of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files e.g., security.json,...
Prototype Pollution
apidoc-core is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of malformed data structures in the preProcess functions, which allows an attacker to manipulate JavaScript object prototypes via crafted properties such as define, leading to denial of service or...
CVE-2025-66398 Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state restoreFilePath of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restor...
CVE-2025-66398
Summary (CVE-2025-66398) : Signal K Server (signalk-server) before version 2.19.0 is vulnerable to unauthenticated state pollution via the /skServer/validateBackup endpoint. An attacker can pollute the global restoreFilePath, hijack the administrator’s Restore workflow, and overwrite critical con...
CVE-2025-66398 Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state restoreFilePath of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restor...
Security Bulletin: IBM Edge Data Collector uses min-document-2.19.0.tgz which is vulnerable to CVE-2025-57352.
Summary IBM Edge Data Collector uses min-document-2.19.0.tgz which is vulnerable to CVE-2025-57352. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2025-57352 DESCRIPTION: A vulnerability exists in the 'min-document' package prior to version 2.19.0...
CVE-2025-13158
Prototype pollution vulnerability in apidoc-core versions 0.2.0 and all subsequent versions allows remote attackers to modify JavaScript object prototypes via malformed data structures, including the “define” property processed by the application, potentially leading to denial of service or...
Prototype Pollution
Overview apidoc-core is a Core parser library to generate apidoc result following the apidoc-spec Affected versions of this package are vulnerable to Prototype Pollution via the preProcess function in apigroup.js, apiparamtitle.js, apiuse.js, and apipermission.js. An attacker can alter object...
GHSA-6VJ3-P34W-XXJP apidoc-core has a prototype pollution vulnerability
Prototype pollution vulnerability in apidoc-core versions 0.2.0 and all subsequent versions allows remote attackers to modify JavaScript object prototypes via malformed data structures, including the “define” property processed by the application, potentially leading to denial of service or...
apidoc-core has a prototype pollution vulnerability
Prototype pollution vulnerability in apidoc-core versions 0.2.0 and all subsequent versions allows remote attackers to modify JavaScript object prototypes via malformed data structures, including the “define” property processed by the application, potentially leading to denial of service or...
CVE-2025-13158
Prototype pollution vulnerability in apidoc-core versions 0.2.0 and all subsequent versions allows remote attackers to modify JavaScript object prototypes via malformed data structures, including the “define” property processed by the application, potentially leading to denial of service or...
hacker-man
Hacker Man - Vulnerable Web Applications Lab A collection of...
CVE-2025-13158
apidoc-core is affected by a prototype pollution vulnerability affecting versions 0.2.0 and later. The issue stems from the preProcess() logic in worker modules (api_group.js, api_param_title.js, api_use.js, api_permission.js), which can be exploited by malformed data structures (notably via the ...
EUVD-2025-205451
Prototype pollution vulnerability in apidoc-core versions 0.2.0 and all subsequent versions allows remote attackers to modify JavaScript object prototypes via malformed data structures, including the “define” property processed by the application, potentially leading to denial of service or...
CVE-2025-13158 apidoc-core - prototype pollution in api_group.js, api_param_title.js, api_use.js, and api_permission.js worker
Prototype pollution vulnerability in apidoc-core versions 0.2.0 and all subsequent versions allows remote attackers to modify JavaScript object prototypes via malformed data structures, including the “define” property processed by the application, potentially leading to denial of service or...
CVE-2025-13158 apidoc-core - prototype pollution in api_group.js, api_param_title.js, api_use.js, and api_permission.js worker
Prototype pollution vulnerability in apidoc-core versions 0.2.0 and all subsequent versions allows remote attackers to modify JavaScript object prototypes via malformed data structures, including the “define” property processed by the application, potentially leading to denial of service or...
PT-2025-53598
Name of the Vulnerable Software and Affected Versions apidoc-core versions 0.2.0 and subsequent versions Description A prototype pollution issue exists in apidoc-core. This allows remote attackers to modify JavaScript object prototypes through malformed data structures, specifically the “define”...
Prototype Pollution
js-yaml is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of special object properties such as proto during YAML parsing, which allows an attacker to modify object prototypes and manipulate application behavior when untrusted YAML input is processed...
RSEC-2025-1 Risk of __proto__ pollution Vulnerability
The plotly R package up through the latest 4.11.0 includes plotly.js library 2.11.1. Plotly.js releases prior to version 2.25.2 have a risk of proto being polluted in expandObjectPaths or nestedProperty...