971 matches found
AZL-45051 CVE-2022-24999 affecting package js-jquery 3.5.0-4
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an proto key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string ...
DEBIAN-CVE-2022-24999
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an proto key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string ...
AZL-44307 CVE-2022-24999 affecting package nodejs-nodemon 2.0.3-5
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an proto key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string ...
UBUNTU-CVE-2022-24999
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an proto key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string ...
qs 安全漏洞
ljharb qs is a query string parser with nesting support by the individual developer Jordan Harband in the United States. A security vulnerability exists in versions prior to qs 6.10.3, which stems from parse ignoring the proto key, and can be exploited by an attacker to place an attack payload in...
Oracle Linux 9 : protobuf (ELSA-2022-7970)
The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-7970 advisory. 3.14.0-13 - Rebuilt for test fixes 3.14.0-12 - Rebuilt for test fixes 3.14.0-11 - Applied patch for for CVE-2021-22570 2055641 Tenable has extracted the precedi...
Silverstripe CMS 跨站脚本漏洞
Silverstripe CMS is an application from Silverstripe New Zealand. Empower powerful digital teams by creating a platform for digital change. A cross-site scripting vulnerability exists in Silverstripe CMS versions prior to 4.12.0 that stems from the use of jQuery 1.7.2, which is affected by...
AlmaLinux 9 : protobuf (ALSA-2022:7970)
The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:7970 advisory. - Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name duri...
OESA-2022-2106 protobuf security update
Protocol Buffers a.k.a., protobuf are Google's language-neutral, platform-neutral, extensible mechanism for serializing structured data. You can find protobuf's documentation on the Google Developers site. Security Fixes: Nullptr dereference when a null char is present in a proto symbol. The symb...
protobuf: Incorrect parsing of nullchar in the proto symbol leads to Nullptr dereference
A flaw was found in protobuf. The vulnerability occurs due to incorrect parsing of a NULL character in the proto symbol and leads to a Null pointer dereference. This flaw allows an attacker to execute unauthorized code or commands, read memory, modify memory...
CVE-2022-42743
deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the 'proto' property to be edited...
PT-2022-26533 · Unknown · Deep-Parse-Json
Name of the Vulnerable Software and Affected Versions: deep-parse-json version 1.0.2 Description: The issue allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the proto...
PT-2022-26043 · Unknown · Deep-Object-Diff
Name of the Vulnerable Software and Affected Versions: deep-object-diff versions 1.1.0 through 1.1.5 Description: The issue allows an external attacker to edit or add new properties to an object because the application does not properly validate incoming JSON keys, thus allowing the proto propert...
minimist: prototype pollution
An Uncontrolled Resource Consumption flaw was found in minimist. The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. This flaw CVE-2021-44906 allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using ...
minimist: prototype pollution
An Uncontrolled Resource Consumption flaw was found in minimist. The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. This flaw CVE-2021-44906 allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using ...
minimist: prototype pollution
An Uncontrolled Resource Consumption flaw was found in minimist. The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. This flaw CVE-2021-44906 allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using ...
minimist: prototype pollution
An Uncontrolled Resource Consumption flaw was found in minimist. The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. This flaw CVE-2021-44906 allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using ...
Prototype Pollution
Overview ts-deepmerge is an a deep merge function that automatically infers the return type based on your input, without mutating the source objects. Affected versions of this package are vulnerable to Prototype Pollution due to missing sanitization of the merge function. PoC: js var tsDeepmerge ...
MAL-2022-535 Malicious code in @proto-services/banking (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 287c482c1bc2e6beee2f3c527f4fa2333ff7e8c00800919fe40fa31ed2d3eda6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...