Node.js third-party modules: Prototype pollution in dot-prop

I would like to report a parameter pollution in dot-prop It allows an attacker to modify the prototype of a base object which can vary in severity depending on the implementation DoS, access to sensitive data, RCE. Module module name: dot-prop version: 5.1.1 npm page:...

Prototype Pollution

Overview Versions of dot-prop before 4.2.1 or 5.1.1 are vulnerable to prototype pollution. The function set does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects. Recommendation Upgrade to...

Infovista VistaPortal SE Cross-Site Scripting Vulnerability (CNVD-2019-07227)

Infovista VistaPortal SE is a Web-based application from Infovista USA. A cross-site scripting vulnerability exists in the EditCurrentPool.jsp page in Infovista VistaPortal SE version 5.1 build 51029, which can be exploited by a remote attacker with the help of the 'PropName' parameter to inject...

Prop Hunt Multiplayer Free - Dynamic Code Loading, External URLs, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application Prop Hunt Multiplayer Free published at the 'play' market has multiple vulnerabilities...

Prop Hunt Portable - Dynamic Code Loading, External URLs, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application Prop Hunt Portable published at the 'play' market has multiple vulnerabilities...

CVE-2014-7717

The Mills-Hazel Property Mgmt aka com.appexpress.millshazelpropertymanagement application 3.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2012-4249

The Amazon Lab126 com.lab126.system sendEvent implementation on the Kindle Touch before 5.1.2 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a string, as demonstrated by using lipc-set-prop to set an LIPC property, a different vulnerability than...

Fedora 14 : subversion-1.6.16-1.fc14 (2011-2657)

A NULL pointer dereference flaw was found in the way the moddavsvn module processed certain requests to lock working copy paths in a repository. A remote attacker could issue a lock request that could cause the httpd process serving the request to crash. CVE-2011-0715 The Fedora Project would lik...

Fedora 13 : subversion-1.6.16-1.fc13 (2011-2698)

A NULL pointer dereference flaw was found in the way the moddavsvn module processed certain requests to lock working copy paths in a repository. A remote attacker could issue a lock request that could cause the httpd process serving the request to crash. CVE-2011-0715 The Fedora Project would lik...

zeeproperty 1.0 - Arbitrary File Upload Cross-Site Scripting

zeeproperty 1.0 - Arbitrary File Upload Cross-Site Scripting ZEEPROPERTY v1.0 remote file Upload & XSS author: ZoRLu msn: [email protected] home: www.z0rlu.blogspot.com dork: "Designed & Developed by Zeeways.com" first register to site you add this code your shell to head GIF89a; example...