Design/Logic Flaw

All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality...

CVE-2021-23373

The CVE-2021-23373 entry concerns set-deep-prop, where the main functionality is vulnerable to Prototype Pollution. Multiple connected sources confirm the vulnerability in set-deep-prop (e.g., GHSA, Veracode, Snyk) and describe how an attacker can pollute Object.prototype via the library’s setDee...

CVE-2021-23373 Prototype Pollution

All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality...

CVE-2021-23373

All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality...

PT-2022-9395 · Unknown · Set-Deep-Prop

Name of the Vulnerable Software and Affected Versions: set-deep-prop affected versions not specified Description: The issue affects the main functionality of the package, allowing for Prototype Pollution. Recommendations: At the moment, there is no information about a newer version that contains ...

set-deep-prop 安全漏洞

set-deep-prop is a tool for setting the values of deeply nested objects and arrays. A security vulnerability exists in set-deep-prop, which stems from the vulnerability of this package to prototype contamination...

Malicious code in conversations-prop-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c20bd54322321d088eb7701b01f36ae45e1b5ec45973927e46181c9783c4fb43 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in prop-validators (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 208823f77227ee7ce0ddb2250eff9a0f1c0b1c93919dc9c90b7c03e52a669696 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-59R9-6JP6-JCM7 XSS vulnerability in GraphQL Playground from untrusted schemas

GraphQL Playground introspection schema template injection attack: Advisory Statement This is a security advisory for an XSS vulnerability in graphql-playground. A similar vulnerability affects graphiql, the package from which graphql-playground was forked. There is a corresponding graphiql...

CVE-2021-41248 XSS vulnerability in GraphiQL

GraphiQL is the reference implementation of this monorepo, GraphQL IDE, an official project under the GraphQL Foundation. All versions of graphiql older than [email protected] are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names,...

CVE-2021-25385

An improper input validation vulnerability in sdfffdparsechunkPROP in libsdffextractor library prior to SMR MAY-2021 Release 1 allows attackers to execute arbitrary code on mediaextractor process...

SAMSUNG Mobile devices 缓冲区错误漏洞

The Samsung libsdffextractor library is a component for Samsung Samsung mobile devices. The Samsung libsdffextractor library suffers from an input validation error vulnerability that stems from improper input validation logic in the presence of a sample rate chunk in sdfffdparsechunkPROP in the...

The vulnerability of the dot-prop library in application software, Aurora Center, arises from uncontrolled changes to object prototypes’ attributes. This allows attackers to execute “prototype pollution” attacks.

The vulnerability of the dot-prop library in application software, Aurora Center, involves uncontrolled changes to object prototypes’ attributes. Exploiting this vulnerability could allow a malicious actor to execute a “prototype contamination” attack...

Prototype Pollution

Overview set-deep-prop is a Set the value of a deeply nested object or array Affected versions of this package are vulnerable to Prototype Pollution via the main functionality. PoC const setDeepProp = require'set-deep-prop'; setDeepProp,'proto', 'x', 'polluted'; console.log.a; // polluted Details...

nodejs-dot-prop: prototype pollution

A prototype pollution flaw was found in nodejs-dot-prop. The function set could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or proto paths. The highest threat from this vulnerability is to data confidentiality and integrity as well a...

RHEL 8 : nodejs:10 (RHSA-2021:0548)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0548 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...

nodejs-dot-prop: prototype pollution

A prototype pollution flaw was found in nodejs-dot-prop. The function set could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or proto paths. The highest threat from this vulnerability is to data confidentiality and integrity as well a...

Prototype Pollution in alexandervu/dot-prop-opt

Description dot-prop-opt is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: javascript // poc.js const set = require'dot-prop-opt' console.log'Before: ' + .polluted set, 'proto.polluted', true console.log'After: ' + .polluted 2. Execute the following commands...

nodejs-dot-prop: prototype pollution

A prototype pollution flaw was found in nodejs-dot-prop. The function set could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or proto paths. The highest threat from this vulnerability is to data confidentiality and integrity as well a...

Prop 24 passes in California, will change data privacy law

First-day returns in California showed voters firmly approving to change their state’s current data privacy law—which already guarantees certain privacy protections that many states do not—through the passage of Prop 24. As of the morning of November 4, according to The Sacramento Bee, 56.1 perce...