PT-2019-4634

Name of the Vulnerable Software and Affected Versions handlebars versions prior to 4.3.0 handlebars versions prior to 3.0.8 Description The issue allows an attacker to execute arbitrary code through crafted payloads by altering an Object's proto and defineGetter properties. This is due to the lac...

UBUNTU-CVE-2019-10768

In AngularJS before 1.7.9 the function merge could be tricked into adding or modifying properties of Object.prototype using a proto payload...

Atlassian Confluence 6.15.1 Directory Traversal

Exploit Title: Atlassian Confluence 6.15.1 - Directory Traversal Google Dork: N/A Date: 2019-11-11 Exploit Author: max7253 Vendor Homepage: https://www.atlassian.com Software Link: https://www.atlassian.com/software/confluence/download-archives Version: 6.15.1 Tested on: Microsoft Windows 7...

CVE-2018-20994

An issue was discovered in the trust-dns-proto crate before 0.5.0-alpha.3 for Rust. There is infinite recursion because DNS message compression is mishandled...

CVE-2018-20994

An issue was discovered in the trust-dns-proto crate before 0.5.0-alpha.3 for Rust. There is infinite recursion because DNS message compression is mishandled...

CVE-2018-20994

An issue was discovered in the trust-dns-proto crate before 0.5.0-alpha.3 for Rust. There is infinite recursion because DNS message compression is mishandled...

CVE-2018-20994

An issue was discovered in the trust-dns-proto crate before 0.5.0-alpha.3 for Rust. There is infinite recursion because DNS message compression is mishandled...

CVE-2018-20994

CVE-2018-20994 affects the Rust crate trust-dns-proto prior to 0.5.0-alpha.3. The issue is infinite recursion/stack overflow caused by incorrect handling of DNS message compression (RFC1035 section 4.1.4). Connected advisories (e.g., RUSTSEC-2018-0007, GHSA-369H-PJR2-6WRH, Red Hat RH/CVE-2018-209...

CVE-2018-20994: Uncontrolled Recursion

An issue was discovered in the trust-dns-proto crate before 0.5.0-alpha.3 for Rust. There is infinite recursion because DNS message compression is mishandled...

CVE-2019-10750

deeply is vulnerable to Prototype Pollution in versions before 3.1.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using using a proto payload...

CVE-2019-10750

deeply is vulnerable to Prototype Pollution in versions before 3.1.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using using a proto payload...

CVE-2019-10745

assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a proto payload...

PT-2019-6099

Name of the Vulnerable Software and Affected Versions HAProxy versions prior to 2.0.3 HAProxy through 2.0.2 Description The issue is related to a denial of service condition that can be triggered by exploiting a loop with an unavailable exit condition. This can allow a remote attacker to cause a...

Prototype Pollution

Overview deeply is an a toolkit for deep structure manipulations, provides deep merge/clone functionality out of the box, and exposes hooks and custom adapters for more control and greater flexibility. Affected versions of this package are vulnerable to Prototype Pollution. The function assign-de...

Prototype Pollution

Overview set-value is a package that creates nested values and any intermediaries using dot notation 'a.b.c' paths. Affected versions of this package are vulnerable to Prototype Pollution. The function set-value could be tricked into adding or modifying properties of Object.prototype using any of...

PT-2019-10056

Name of the Vulnerable Software and Affected Versions: Cesanta Mongoose Embedded Web Server Library versions 6.13 and earlier Description: The issue is caused by a use-after-free vulnerability in the mg http free proto data cgi function call in mongoose.c, which can lead to an invalid write of 8...

PT-2019-10057

Name of the Vulnerable Software and Affected Versions: Cesanta Mongoose Embedded Web Server Library versions 6.13 and earlier Description: The issue is caused by a use-after-free vulnerability in the mg http free proto data cgi function call in mongoose.c, allowing for an invalid read of 8 bytes...

PT-2019-10054

Name of the Vulnerable Software and Affected Versions: Cesanta Mongoose Embedded Web Server Library versions 6.13 and earlier Description: The issue is caused by a use-after-free vulnerability in the mg http get proto data function, which can lead to a denial of service or remote code execution...

Mozilla: Ionmonkey type confusion with __proto__ mutations

Incorrect handling of proto mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write. This vulnerability affects Firefox 66.0.1, Firefox ESR 60.6.1, and Thunderbird 60.6.1...

Mozilla: Ionmonkey type confusion with __proto__ mutations

Incorrect handling of proto mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write. This vulnerability affects Firefox 66.0.1, Firefox ESR 60.6.1, and Thunderbird 60.6.1...