EUVD-2022-3928

Malicious code in bioql PyPI...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to prototype pollution due to the protobufjs package (CVE-2022-25878)

Summary Protobufjs is used by DataStage on Cloud Pak for Data as part of data serialization. Vulnerability Details CVEID:CVE-2022-25878 DESCRIPTION: The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the...

Malicious code in protobufjs-protify-example (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a1fc26bdc2549188a81eca766317ffb5fdf7c0f904db9df458c43a670a86951 Any computer that has this package installed or running should be considered...

MAL-2025-5720 Malicious code in protobufjs-protify-example (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a1fc26bdc2549188a81eca766317ffb5fdf7c0f904db9df458c43a670a86951 Any computer that has this package installed or running should be considered...

Malicious code in protobufjs-websocket-example (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a5372e68ba0b48947bc24234bd3009eaf3350edf61ca65bd42229c19a046fe8 Any computer that has this package installed or running should be considered...

MAL-2025-5721 Malicious code in protobufjs-websocket-example (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a5372e68ba0b48947bc24234bd3009eaf3350edf61ca65bd42229c19a046fe8 Any computer that has this package installed or running should be considered...

Linux Distros Unpatched Vulnerability : CVE-2022-25878

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This...

Malicious code in protobufjs-shopee (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d558f09949572f10d9f515f1a37f9b4237d75b1c2eb57bfef053eb328e770126 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11068 Malicious code in protobufjs-shopee (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d558f09949572f10d9f515f1a37f9b4237d75b1c2eb57bfef053eb328e770126 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

RHEL 9 : grafana (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - grafana: session control failure may lead to information disclosure CVE-2022-32275 - protobufjs: prototyp...

SUSE CVE-2022-25878

The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption...

GHSA-H755-8QP9-CQ85 protobufjs Prototype Pollution vulnerability

protobuf.js aka protobufjs 6.10.0 until 6.11.4 and 7.0.0 until 7.2.4 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and...

@00ssh/erdnest (>=0.2.19 <=0.2.23), @0cfg/rpc-common (>=0.0.1 <=0.1.3) +2639 more potentially affected by CVE-2023-36665 via protobufjs (>=6.10.0 <=6.11.3)

protobufjs NPM version =6.10.0, =0.2.19, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =0.0.8-alpha.0, =0.1.0, =0.0.2, =0.0.1, =0.0.5, =1.9.4, =1.9.15 and more Source cves: CVE-2023-36665 Source advisory: OSV:GHSA-H755-8QP9-CQ85...

10minions-engine (>=0.0.1 <=0.0.4), @1amageek/document-propagator (>=0.10.1 <=1.0.0) +1979 more potentially affected by CVE-2023-36665 via protobufjs (>=7.0.0 <=7.2.4)

protobufjs NPM version =7.0.0, =0.0.1, =0.10.1, =1.1.0, =0.4.0, =1.22.0, =6.2.36, =1.0.0, =1.8.0, =0.0.0-beta.0, =1.0.0, =1.0.1, =3.1.0 and more Source cves: CVE-2023-36665 Source advisory: OSV:GHSA-H755-8QP9-CQ85...

CVE-2023-36665

CVE-2023-36665 affects protobuf.js (protobufjs) 6.10.0 through 7.x, before 7.2.5. A user‑controlled protobuf message can pollute Object.prototype by adding/overwriting its data and functions. Exploitation paths include: 1) parse, 2) loading .proto files via load/loadSync, or 3) untrusted input to...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer operands may be vulnerable to arbitrary code execution due to CVE-2022-25878

Summary Node.js module protobufjs is used internally by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container IntegrationServer operands may be vulnerable to arbitrary code execution. This bulletin provides patch information to address the reported...

Malicious code in protobufjs-databricks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ae198b4c60528a62453f589485b597ef1cfc87e25d9af4500e8445aac5b5c3b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5489 Malicious code in protobufjs-databricks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ae198b4c60528a62453f589485b597ef1cfc87e25d9af4500e8445aac5b5c3b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-25878

A flaw was found in protobufjs, where it is vulnerable to Prototype Pollution, allowing an attacker to add/modify properties of the Object.prototype. This vulnerability can occur by providing untrusted user input to the util.setProperty or to the ReflectionObject.setParsedOption functions, and al...

Prototype Pollution

protobufjs is vulnerable to Prototype Pollution. An attacker is able to add/modify properties of the Object.prototype by parsing/loading .proto files or via providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions, resulting in prototype pollution...