CVE-2020-28282

A flaw was found in nodejs-getobject. The set function does not check for the type of object before assigning value to the property allowing an attacker to create a non-existent property or allow the manipulation of the property which could lead to a denial of service or a remote code execution...

CVE-2020-13654

XWiki Platform before 12.8 mishandles escaping in the property displayer...

CVE-2020-13654

XWiki Platform before 12.8 mishandles escaping in the property displayer...

PT-2020-13641 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 12.8 Description: The issue is related to the mishandling of escaping in the property displayer. Recommendations: For versions prior to 12.8, update to version 12.8 or later to resolve the issue...

CVE-2020-13654

CVE-2020-13654 affects XWiki Platform prior to 12.8, where the property displayer mishandles escaping. The root cause is improper escaping in the property displayer, with impact stated as confidentially high/partial and no explicit exploitation details in the provided materials. Remediation refer...

CVE-2020-13654

XWiki Platform before 12.8 mishandles escaping in the property displayer...

CVE-2020-13654

XWiki Platform before 12.8 mishandles escaping in the property displayer...

Bohan Weiye (Beijing) Technology Co., Ltd. community arterial property management integrated management and control cloud service platform has logic flaws and vulnerabilities

Bohanweiye Beijing Technology Co., Ltd. is a comprehensive solution provider of mobile Internet of Things IoT. A logic flaw exists in the Community Artery Property Management Integrated Control Cloud Service Platform of Bohan Weiye Beijing Technology Co. An attacker can use the vulnerability to l...

GHSA-45Q2-34RF-MR94 Code Injection in mquery

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property e.g., proto can be copied during a merge or clone operation...

RHEL 7 : python-XStatic-jQuery (RHSA-2020:5581)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:5581 advisory. python-XStatic-jQuery is the jQuery javascript library packaged for Python's setuptools Security Fixes: Prototype pollution in object's prototype...

jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection

A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the extend function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with...

bootstrap: XSS in the affix configuration target property

A flaw was found in Bootstrap, where it is vulnerable to Cross-site scripting caused by improper validation of user-supplied input by the affix configuration target property. This flaw allows a remote attacker to execute a script in a victim's Web browser within the security context of the hostin...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution. The vulnerability is in the set function. PoC const decal = require'decal'; console.log'Before:', .polluted; decal.set, "proto.polluted", "1337"; console.log'After:', .polluted; Details Prototype Pollution is a...

Information disclosure

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property e.g., proto can be copied during a merge or clone operation...

Buffer Overflow

MuPDF is vulnerable to buffer overflow. This vulnerability allow attackers to execute arbitrary code via a crafted PDF file. This occurs with a large BDC property name that overflows the allocated size of a display list node...

Healthcare 2021: Cyberattacks to Center on COVID-19 Spying, Patient Data

Sophisticated cybercriminals have been trying to steal COVID-19 vaccine research – and researchers say there’s more of that to come going into 2021. Intellectual property theft will join ransomware, cloud-stored patient data theft and advanced phishing efforts as the main hallmarks of...

Unauthorized Access Vulnerability in Zijin Bridge RealHistorian Cross-Platform Real-Time Database

RealHistorian cross-platform real-time database is independently developed by Zijinqiao, with completely independent intellectual property rights, and has been successfully applied in many national key fields, such as civil ships and military industry. There is an unauthorized access vulnerabilit...

November spam roundup: Stalkers, property tips, porn, stern words and PayPal

Today were rounding up some of the interesting pieces of spam currently in circulation, taking in everything from housing deals to mysteriously free slices of cash. You may have seen some of these already. Hopefully we can help make up your mind about whatevers lurking in your mailbox. A full hou...

Systeminformation Operating System Command Injection Vulnerability

systeminformation is an Npm software library for individual developers individual developers to obtain operating system information. A security vulnerability exists in systeminformation version 4.30.2, which can be exploited by an attacker to override properties and functions of an object, leadin...

Prototype Pollution

Overview merge is a library that allows you to merge multiple objects into one, optionally creating a new cloned object. Similar to the jQuery.extend but more flexible. Works in Node.js and the browser. Affected versions of this package are vulnerable to Prototype Pollution via recursiveMerge...