segueproperties.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1171596 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Node.js third-party modules: [extend-merge] Prototype pollution

I would like to report a prototype pollution vulnerability in extend-merge module. It allows an attacker to inject properties on Object.prototype. Module module name: extend-merge version: 1.0.5 npm page: https://www.npmjs.com/package/extend-merge Module Description Shallow extend and deep merge...

Node.js third-party modules: [keyd] Prototype pollution

I would like to report a prototype pollution vulnerability in keyd module. It allows an attacker to inject properties on Object.prototype. Module module name: keyd version: 1.3.4 npm page: https://www.npmjs.com/package/keyd Module Description A small library for using and manipulating key paths i...

Fun-map Resource Management Error Vulnerability

fun-map is a Clojure string mapping utility program. A security vulnerability exists in fun-map 3.3.1 and earlier versions. The vulnerability can be exploited to add or modify Object.prototype properties via the "assocInM" function...

Make use of Secure Introspector in Velocity Templates - CVE-2019-20409

This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented. The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote...

End of support for Office 2016 and Office 2019

None None...

CVE-2020-11703

An issue was discovered in ProVide formerly zFTPServer through 13.1. /ajax/GetInheritedProperties allows HTTP Response Splitting via the language parameter...

Information Disclosure

java is vulnerable to information disclosure. The vulnerability exists as a public static field declaration allowed untrusted JNLP Java Network Launching Protocol applications to read privileged data. A remote attacker could directly or indirectly read the values of restricted system properties,...

Access Control Bypass

dbus-glib is vulnerable to access control bypass. It was discovered that dbus-glib did not enforce the "access" flag on exported GObject properties. If such a property were read/write internally but specified as read-only externally, a malicious, local user could use this flaw to modify that...

Information Disclosure

firefox is vulnerable to information disclosure. A flaw was found in the way a malformed .properties file was processed by Firefox. A malicious extension could read uninitialized memory, possibly leaking sensitive data to the extension...

Update Rollup 8 for System Center 2012 R2 Operations Manager

Update Rollup 8 for System Center 2012 R2 Operations Manager Introduction This article describes the issues that are fixed in Update Rollup 8 for Microsoft System Center 2012 R2 Operations Manager. Additionally, this article contains the installation instructions for Update Rollup 8 for System...

Prototype Pollution

express-mock-middleware is vulnerable to Prototype Pollution. It allows an attacker to inject properties of the Object.prototype, manipulating the attributes by overwriting, or polluting them...

CVE-2020-7614

npm-programmatic through 0.0.12 is vulnerable to Command Injection.The packages and option properties are concatenated together without any validation and are used by the 'exec' function directly...

Command injection

npm-programmatic through 0.0.12 is vulnerable to Command Injection.The packages and option properties are concatenated together without any validation and are used by the 'exec' function directly...

CVE-2020-7639

eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function 'set' could be tricked into adding or modifying properties of 'Object.prototype' using a 'proto' payload...

DEBIAN-CVE-2020-5274

In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the ErrorHandler rendered it stacktrace. In addition, the stacktrace were displayed even in a non-debug configuration. The ErrorHandler now escape alls properties of the exception, and the...

Design/Logic Flaw

In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the ErrorHandler rendered it stacktrace. In addition, the stacktrace were displayed even in a non-debug configuration. The ErrorHandler now escape alls properties of the exception, and the...

PT-2020-18364 · Symfony · Symfony +1

Name of the Vulnerable Software and Affected Versions: Symfony versions prior to 4.4.5 and 5.0.5 symfony/http-foundation versions prior to 4.4.5 and 5.0.5 Description: The issue arises from the ErrorHandler rendering unescaped properties of the Exception class when displaying the stacktrace, whic...

March 17, 2020—KB4541331 (OS Build 17763.1131)

None None...

CVE-2020-7600

querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handlertype, name, fn can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks...