MAL-2022-5489 Malicious code in protobufjs-databricks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ae198b4c60528a62453f589485b597ef1cfc87e25d9af4500e8445aac5b5c3b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-25878

A flaw was found in protobufjs, where it is vulnerable to Prototype Pollution, allowing an attacker to add/modify properties of the Object.prototype. This vulnerability can occur by providing untrusted user input to the util.setProperty or to the ReflectionObject.setParsedOption functions, and al...

Prototype Pollution

protobufjs is vulnerable to Prototype Pollution. An attacker is able to add/modify properties of the Object.prototype by parsing/loading .proto files or via providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions, resulting in prototype pollution...

@0cfg/rpc-common (>=0.0.1, <=0.1.3), @0cfg/rpc-node (>=0.0.1, <=0.1.3) +305 more potentially affected by CVE-2022-25878 via protobufjs (>=6.11.0-pre, <=6.11.2)

protobufjs NPM version =6.11.0-pre, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =0.0.2, =0.1.0, =0.4.0, =4.0.0, =1.0.0, =0.4.21, =1.0.3-next.0, =0.1.0-alpha.32, =0.1.0-alpha.0, =0.4.115, =0.5.167 and more Source cves: CVE-2022-25878 Source advisory: OSV:GHSA-G954-5HWP-PP24...

@agconnect/database (>=1.1.0, <=1.3.2), @ardenthq/sdk-egld (>=1.0.0, <=1.3.1) +124 more potentially affected by CVE-2022-25878 via protobufjs (>=6.10.0, <=6.10.2)

protobufjs NPM version =6.10.0, =1.1.0, =1.0.0, =3.0.0-next.36, =3.0.0-next.36, =3.0.0-next.36, =3.0.0-next.36, =0.0.0, =0.0.0-beta.20200917165907, =0.0.0-beta.20200724145337, =0.0.0-beta.20200724123546, =0.0.0-beta.20200724123546, =0.0.0-beta.20210111150545 and more Source cves: CVE-2022-25878...

Prototype Pollution in protobufjs

The package protobufjs is vulnerable to Prototype Pollution, which can allow an attacker to add/modify properties of the Object.prototype. Versions after and including 6.10.0 until 6.10.3 and after and including 6.11.0 until 6.11.3 are vulnerable. This vulnerability can occur in multiple ways: 1...

GHSA-G954-5HWP-PP24 Prototype Pollution in protobufjs

The package protobufjs is vulnerable to Prototype Pollution, which can allow an attacker to add/modify properties of the Object.prototype. Versions after and including 6.10.0 until 6.10.3 and after and including 6.11.0 until 6.11.3 are vulnerable. This vulnerability can occur in multiple ways: 1...

CVE-2022-25878

The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption...

CVE-2022-25878 Prototype Pollution

The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption...

CVE-2022-25878

CVE-2022-25878 affects protobufjs with Prototype Pollution (Object.prototype) via untrusted input to util.setProperty, ReflectionObject.setParsedOption, or .proto parsing. Connected docs show a related entry (CVE-2023-36665) describing protobufjs 6.10.0–7.x before 7.2.5 as vulnerable to prototype...

CVE-2022-25878 Prototype Pollution

The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption...

CVE-2022-25878

The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption...

@0cfg/rpc-common (>=0.0.1, <=0.1.3), @0cfg/rpc-node (>=0.0.1, <=0.1.3) +305 more potentially affected by CVE-2022-25878 via protobufjs (>=6.11.0-pre, <=6.11.2)

protobufjs NPM version =6.11.0-pre, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =0.0.2, =0.1.0, =0.4.0, =4.0.0, =1.0.0, =0.4.21, =1.0.3-next.0, =0.1.0-alpha.32, =0.1.0-alpha.0, =0.4.115, =0.5.167 and more Source cves: CVE-2022-25878 Source advisory: SNYK:JS-PROTOBUFJS-2441248...

Prototype Pollution

Overview protobufjs is a protocol buffer for JavaScript & TypeScript. Affected versions of this package are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user...

@agconnect/database (>=1.1.0, <=1.3.2), @ardenthq/sdk-egld (>=1.0.0, <=1.3.1) +124 more potentially affected by CVE-2022-25878 via protobufjs (>=6.10.0, <=6.10.2)

protobufjs NPM version =6.10.0, =1.1.0, =1.0.0, =3.0.0-next.36, =3.0.0-next.36, =3.0.0-next.36, =3.0.0-next.36, =0.0.0, =0.0.0-beta.20200917165907, =0.0.0-beta.20200724145337, =0.0.0-beta.20200724123546, =0.0.0-beta.20200724123546, =0.0.0-beta.20210111150545 and more Source cves: CVE-2022-25878...

GHSA-4GPV-CVMQ-6526 Denial of Service in protobufjs

Withdrawn: Duplicate of GHSA-762f-c2wg-m8c8...

Denial of Service in protobufjs

Withdrawn: Duplicate of GHSA-762f-c2wg-m8c8...

@angular/bazel (>=5.0.0-beta.5, <=7.0.0), @atomist/sample-sdm (>=0.5.1-atomist-update-latest-1540938130032.20181101043939, <=0.5.1-master.20181101044648) +123 more potentially affected by CVE-2018-3738 via protobufjs (>=5.0.0, <=5.0.2)

protobufjs NPM version =5.0.0, =5.0.0-beta.5, =0.5.1-atomist-update-latest-1540938130032.20181101043939, =0.2.2-20180615211533, =0.2.4-20180621213746, =0.1.0-20180815155955, =0.0.6, =1.2.1, =1.0.2, =5.0.1, =1.3.1, =0.0.7, =1.3.0, =0.0.1, =0.0.1, =0.0.12 and more Source cves: CVE-2018-3738 Source...

Denial of Service in protobufjs

Versions of protobufjs before 5.0.3 and 6.8.6 are vulnerable to a regular expression denial of service when parsing crafted invalid .proto files. Recommendation Update to version 5.0.3, 6.8.6 or later...

@accordproject/cicero-cli (>=0.2.48, <=0.3.16), @accordproject/cicero-common (>=0.2.50, <=0.2.54) +114 more potentially affected by CVE-2018-3738 via protobufjs (>=6.1.0, <=6.8.5)

protobufjs NPM version =6.1.0, =0.2.48, =0.2.50, =0.2.46, =0.2.46, =0.2.46, =0.0.37, =0.0.36, =0.0.37, =0.1.0, =1.0.0, =2.2.0 - @ibmblockchain/composer-playground 0.16.2 and more Source cves: CVE-2018-3738 Source advisory: OSV:GHSA-762F-C2WG-M8C8...