Prototype Pollution

Overview confinit is an Application configuration helpers for Node.Js. Affected versions of this package are vulnerable to Prototype Pollution. The setDeepProperty function could be tricked into adding or modifying properties of Object.prototype using a proto payload. PoC var root =...

Prototype Pollution

Overview class-transformer is a Proper decorator-based transformation / serialization / deserialization of plain javascript objects to class constructors. Affected versions of this package are vulnerable to Prototype Pollution the classToPlainFromExist function could be tricked into adding or...

yargs-parser input validation error vulnerability

yargs-parser is an option parser. An input validation error vulnerability exists in yargs-parser versions prior to 13.1.2, 14.0.0 and later fixed in 15.0.1, and 16.0.0 and later fixed in 18.1.1, which can be exploited to add or modify an Object.prototype property with the help of the 'proto'...

minimist Input Validation Error Vulnerability

minimist is a command line parameter parsing tool. An input validation error vulnerability exists in minimist, which can be exploited by an attacker to add or modify properties of Object.prototype using the "constructor" or "proto" payload...

UBUNTU-CVE-2020-7598

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload...

The vulnerability of the __proto__ and __defineGetter__ properties of the Handlebars template engine allows a attacker to execute arbitrary code.

The vulnerability of the proto and defineGetter properties of the Handlebars template engine exists because special elements are not properly eliminated. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Prototype Pollution

Overview undefsafe is a Simple function for retrieving deep object properties without getting "Cannot read property 'X' of undefined". Affected versions of this package are vulnerable to Prototype Pollution. The a function could be tricked into adding or modifying properties of Object.prototype...

Prototype Pollution

Overview bodymen is a Body parser middleware for MongoDB, Express and Nodejs. Affected versions of this package are vulnerable to Prototype Pollution. The handler function could be tricked into adding or modifying properties of Object.prototype using a proto payload. PoC by JHU System Security La...

approveapi (0.1.0), approveapi_openapi (0.1.1) +185 more potentially affected by unknown CVE via tokio-proto (0.1.1)

tokio-proto CARGO version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on tokio-proto and may be impacted: - approveapi 0.1.0 - approveapiopenapi 0.1.1 - arc-reactor =0.1.0, =0.2.0, =0.2.0, =1.5.0, =0.4.2, =0.5.0, =0.1.0, =0.1.0, =0.1.6 and more...

RUSTSEC-2020-0162 `tokio-proto` is deprecated/unmaintained

The tokio-proto crate has been deprecated, and its GitHub repository has been archived. Users may be interested in tokio-tower instead, per https://github.com/tokio-rs/tokio/issues/118issuecomment-452969665...

UBUNTU-CVE-2019-10768

In AngularJS before 1.7.9 the function merge could be tricked into adding or modifying properties of Object.prototype using a proto payload...

Atlassian Confluence 6.15.1 Directory Traversal

Exploit Title: Atlassian Confluence 6.15.1 - Directory Traversal Google Dork: N/A Date: 2019-11-11 Exploit Author: max7253 Vendor Homepage: https://www.atlassian.com Software Link: https://www.atlassian.com/software/confluence/download-archives Version: 6.15.1 Tested on: Microsoft Windows 7...

CVE-2018-20994

An issue was discovered in the trust-dns-proto crate before 0.5.0-alpha.3 for Rust. There is infinite recursion because DNS message compression is mishandled...

CVE-2018-20994

An issue was discovered in the trust-dns-proto crate before 0.5.0-alpha.3 for Rust. There is infinite recursion because DNS message compression is mishandled...

CVE-2018-20994

CVE-2018-20994 affects the Rust crate trust-dns-proto prior to 0.5.0-alpha.3. The issue is infinite recursion/stack overflow caused by incorrect handling of DNS message compression (RFC1035 section 4.1.4). Connected advisories (e.g., RUSTSEC-2018-0007, GHSA-369H-PJR2-6WRH, Red Hat RH/CVE-2018-209...

CVE-2018-20994

An issue was discovered in the trust-dns-proto crate before 0.5.0-alpha.3 for Rust. There is infinite recursion because DNS message compression is mishandled...

CVE-2019-10750

deeply is vulnerable to Prototype Pollution in versions before 3.1.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using using a proto payload...

Prototype Pollution

Overview deeply is an a toolkit for deep structure manipulations, provides deep merge/clone functionality out of the box, and exposes hooks and custom adapters for more control and greater flexibility. Affected versions of this package are vulnerable to Prototype Pollution. The function assign-de...

Prototype Pollution

Overview set-value is a package that creates nested values and any intermediaries using dot notation 'a.b.c' paths. Affected versions of this package are vulnerable to Prototype Pollution. The function set-value could be tricked into adding or modifying properties of Object.prototype using any of...

Mozilla: Ionmonkey type confusion with __proto__ mutations

Incorrect handling of proto mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write. This vulnerability affects Firefox 66.0.1, Firefox ESR 60.6.1, and Thunderbird 60.6.1...