CVE-2021-23426 Prototype Pollution

This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function...

CVE-2021-23426

Proto is vulnerable to prototype pollution via the merge function across all versions. The root cause is an unsafe recursive merge (and related path-based pollution) that can inject properties into Object.prototype (proto , constructor, prototype). Potential impact includes DoS and possible remot...

CVE-2021-23426

This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function...

Proto安全漏洞

Proto is an open source, extensible program code template for creating objects. A security vulnerability exists in Proto that stems from the ability to contaminate an application with object property injections...

DEBIAN-CVE-2021-23434

This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === 'proto' returns false if currentPath is 'proto'. This is because t...

GHSA-369H-PJR2-6WRH Uncontrolled recursion in trust-dns-proto

There's a stack overflow leading to a crash when Trust-DNS's parses a malicious DNS packet. Affected versions of this crate did not properly handle parsing of DNS message compression RFC1035 section 4.1.4. The parser could be tricked into infinite loop when a compression offset pointed back to th...

Uncontrolled recursion in trust-dns-proto

There's a stack overflow leading to a crash when Trust-DNS's parses a malicious DNS packet. Affected versions of this crate did not properly handle parsing of DNS message compression RFC1035 section 4.1.4. The parser could be tricked into infinite loop when a compression offset pointed back to th...

PT-2021-24348 · Unknown · Fast-Xml-Parser

Name of the Vulnerable Software and Affected Versions: fast-xml-parser versions prior to 4.1.2 Description: The issue allows for Prototype Pollution via the proto variable. This can be exploited by including proto as a tag or attribute name in an XML string. The estimated number of potentially...

The vulnerability of the proto-max-bulk-len configuration parameter in the Redis database management system allows a hacker to execute arbitrary code.

The vulnerability of the proto-max-bulk-len configuration parameter in the Redis database management system is related to reading beyond the range and integer overflow of the buffer. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2021-23419

This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a proto or constructor payload...

PT-2021-15507 · Unknown · Open-Graph

Name of the Vulnerable Software and Affected Versions: open-graph versions prior to 0.2.6 Description: The issue affects the parse function, which can be tricked into adding or modifying properties of Object.prototype using a proto or constructor payload. This could potentially lead to unintended...

Prototype Pollution

Overview mootools is an a library for web development, with support for OOP. Affected versions of this package are vulnerable to Prototype Pollution. This is due to the ability to pass untrusted input to Object.merge PoC: require"mootools" Object.merge, JSON.parse""proto": "vulnerable": true"...

Redis remote code execution vulnerability

Redis is an open source ANSI C, network-enabled, memory-based, and persistent logging, Key-Value storage database with a multilingual API. The vulnerability can be exploited to attack 32-bit Redis programs running on 32-bit systems by combining the BIT command with the proto-max-bulk-len...

ALPINE-CVE-2021-32761

Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15, and 6.2.5. On 32-bit systems, Redis BIT command are vulnerable to integer overflow that...

DEBIAN-CVE-2021-32761

Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15, and 6.2.5. On 32-bit systems, Redis BIT command are vulnerable to integer overflow that...

11zwheat (=0.2.6), barley (=0.0.1) +28 more potentially affected by CVE-2021-23426 via proto (>=1.0.17 <=1.0.19)

proto NPM version =1.0.17, =1.0.0, =1.0.4, =1.0.1, =1.0.0, =2.0.0, =0.0.1, =0.0.1, =1.1.0, =2.0.0, =2.0.1 and more Source cves: CVE-2021-23426 Source advisory: SNYK:JS-PROTO-1316301...

Prototype Pollution

Overview Proto is an An extensible program-code-template for creating objects Affected versions of this package are vulnerable to Prototype Pollution. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function. PoC var proto = require'Proto...

OSV-2021-850 Heap-buffer-overflow in proto_item_append_text

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35102 Crash type: Heap-buffer-overflow READ 8 Crash state: protoitemappendtext dissectpfcp3gppenterpriseies calldissectorwork...

CVE-2021-32625

Redis is an open source BSD licensed, in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer, could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This ...

DEBIAN-CVE-2021-32625

Redis is an open source BSD licensed, in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer, could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This ...