Prototype Pollution

msgpack5 is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

MyBB SQL注入漏洞

MyBB is a free open source forum software. A SQL injection vulnerability exists in the theme properties of MyBB versions prior to 1.8.26. No detailed vulnerability details are provided at this time...

Design/Logic Flaw

When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property array before inserting anything into it. Otherwise the array might resize, invalidating previously stored references. This pre-reservation was not occurring in HHVM prior to v4.32....

UBUNTU-CVE-2020-1900

When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property array before inserting anything into it. Otherwise the array might resize, invalidating previously stored references. This pre-reservation was not occurring in HHVM prior to v4.32....

CVE-2020-1900

HHVM (HipHop VM) has a vulnerability CVE-2020-1900 affecting unserialization of objects with dynamic properties. The issue occurs when HHVM does not pre-reserve the full size of the dynamic property array before inserting into it, causing potential array resizing that can invalidate previously st...

CatDV 9.2 - RMI Authentication Bypass Exploit

Exploit Title: CatDV 9.2 - RMI Authentication Bypass Exploit Author: Christopher Ellis, Nick Gonella, Workday Inc. Vendor Homepage: https://catdv.com/ Software Link: https://www.squarebox.com/download/CatDVServer9.2.0.exe Version: 9.2 and lower Tested on: Windows, Mac import org.h2.engine.User;...

The vulnerability of the Apache Struts software platform lies in the lack of proper control over the modification of dynamically defined object properties, allowing attackers to execute arbitrary code.

The vulnerability of the Apache Struts software framework is related to insufficient control over the modification of dynamically defined object properties. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

In SQLite before 3.32.3 select.c mishandles query-flattener optimization leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.

...

Prototype Pollution

dynamoose is vulnerable to prototype pollution. The vulnerability exists through lib/utils/object/set.ts where an attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

Prototype Pollution

set-or-get is vulnerable to prototype pollution. An attacker is able to exploit the vulnerability to inject arbitrary properties into existing construct prototypes in function SetOrGet and modify attributes such as proto, constructor and prototype...

Prototype Pollution

hellojs is vulnerable to prototype pollution. An attacker is able to exploit the vulnerability to inject arbitrary properties into hello.utils.extend construct prototypes and modify attributes such as proto, constructor and prototype...

Code injection

An issue was discovered on LG Wing mobile devices with Android OS 10 software. The biometric sensor has weak security properties. The LG ID is LVE-SMP-200030 February 2021...

CVE-2021-26688

An issue was discovered on LG Wing mobile devices with Android OS 10 software. The biometric sensor has weak security properties. The LG ID is LVE-SMP-200030 February 2021...

Prototype Pollution

total.js is vulnerable to prototype pollution. The keys of the path being set are not properly sanitized, allowing for injection of arbitrary properties into existing construct prototypes and modification of attributes such as proto, constructor and prototype...

Prototype Pollution

dotty is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

Prototype Pollution

nested-object-assign is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

Prototype Pollution

@theia/plugin-ext is vulnerable to prototype pollution. The function mergeContents allows an attacker to get control of value of “path” and modify attributes such as proto, constructor and prototype. An attacker is able to supply a malicious object that causes the function to overwrite properties...

Prototype Pollution

merge-deep is vulnerable to prototype pollution attacks. An attacker is able to inject and overwrite arbitrary properties such as proto, constructor or prototype, resulting in privilege escalation, denial of service or potential arbitrary code execution...

The vulnerability of the _exposedProps_ mechanism in the Mozilla Firefox browser allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the exposedProps mechanism in Mozilla Firefox is related to the lack of access restrictions for certain exposed properties. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

@adobe/aio-app-scripts (>=0.6.0 <=2.3.0), @adobe/aio-cli (>=2.1.0 <=4.0.0) +21 more potentially affected by CVE-2020-28471 via properties-reader (>=2.0.0 <=2.1.1)

properties-reader NPM version =2.0.0, =0.6.0, =2.1.0, =1.0.0, =0.3.1, =1.0.3, =0.6.0, =1.7.0, =0.0.16, =2.0.0, =2.4.1-next.238, =2.0.0-RC1, =2.1.1-next.0, =2.1.1-next.0, =2.2.1-next.5, =2.1.1-next.0, =2.5.2-next.17 and more Source cves: CVE-2020-28471 Source advisory:...