Prototype Pollution

Overview total.js is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. It can be used as web, desktop, service or IoT application. Affected versions of this package are vulnerable to Prototype Pollution. The set function can be...

CVE-2021-22871

Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then displayed unsanitized in the affiliate-preview.php tag generation screen, leading to a persistent cross-site scripting XSS vulnerability...

Command Execution Vulnerability in HC Community Property Management System of Hefei Six Out Network Technology Co.

HC neighborhood property management system is initiated by the java110 team in April 2017 front and back end separation , distributed architecture open source projects. Hefei Six Out Network Technology Co. HC community property management system has a command execution vulnerability that can be...

Prototype Pollution

Overview handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source. POC // compile the template var s2 = 'a/." ||...

XWiki Platform has unspecified vulnerabilities

XWiki Platform is a set of wiki platforms for creating web collaboration applications from the French company XWiki Xwiki. XWiki Platform has a security vulnerability that stems from incorrect handling of escapes in the display of properties. No details of the vulnerability are currently availabl...

CVE-2020-28282

A flaw was found in nodejs-getobject. The set function does not check for the type of object before assigning value to the property allowing an attacker to create a non-existent property or allow the manipulation of the property which could lead to a denial of service or a remote code execution...

CVE-2020-13654

XWiki Platform before 12.8 mishandles escaping in the property displayer...

CVE-2020-13654

XWiki Platform before 12.8 mishandles escaping in the property displayer...

PT-2020-13641 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 12.8 Description: The issue is related to the mishandling of escaping in the property displayer. Recommendations: For versions prior to 12.8, update to version 12.8 or later to resolve the issue...

CVE-2020-13654

CVE-2020-13654 affects XWiki Platform prior to 12.8, where the property displayer mishandles escaping. The root cause is improper escaping in the property displayer, with impact stated as confidentially high/partial and no explicit exploitation details in the provided materials. Remediation refer...

CVE-2020-13654

XWiki Platform before 12.8 mishandles escaping in the property displayer...

CVE-2020-13654

XWiki Platform before 12.8 mishandles escaping in the property displayer...

Bohan Weiye (Beijing) Technology Co., Ltd. community arterial property management integrated management and control cloud service platform has logic flaws and vulnerabilities

Bohanweiye Beijing Technology Co., Ltd. is a comprehensive solution provider of mobile Internet of Things IoT. A logic flaw exists in the Community Artery Property Management Integrated Control Cloud Service Platform of Bohan Weiye Beijing Technology Co. An attacker can use the vulnerability to l...

GHSA-45Q2-34RF-MR94 Code Injection in mquery

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property e.g., proto can be copied during a merge or clone operation...

RHEL 7 : python-XStatic-jQuery (RHSA-2020:5581)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:5581 advisory. python-XStatic-jQuery is the jQuery javascript library packaged for Python's setuptools Security Fixes: Prototype pollution in object's prototype...

jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection

A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the extend function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with...

bootstrap: XSS in the affix configuration target property

A flaw was found in Bootstrap, where it is vulnerable to Cross-site scripting caused by improper validation of user-supplied input by the affix configuration target property. This flaw allows a remote attacker to execute a script in a victim's Web browser within the security context of the hostin...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution. The vulnerability is in the set function. PoC const decal = require'decal'; console.log'Before:', .polluted; decal.set, "proto.polluted", "1337"; console.log'After:', .polluted; Details Prototype Pollution is a...

Information disclosure

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property e.g., proto can be copied during a merge or clone operation...

Buffer Overflow

MuPDF is vulnerable to buffer overflow. This vulnerability allow attackers to execute arbitrary code via a crafted PDF file. This occurs with a large BDC property name that overflows the allocated size of a display list node...