EUVD-2021-2500

Malware in sbrugna...

CVE-2021-25953

Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution...

Prototype Pollution

putil-merge is vulnerable to prototype pollution. The vulnerability exists due to the validations are not handled properly in the merge method in merge.js file which allows an attacker to inject properties into existing construct prototypes and modify attributes...

GHSA-4G77-CVGW-GRVW Prototype Pollution in putil-merge

This affects the package putil-merge before 3.8.0. The merge function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in...

Prototype Pollution in putil-merge

This affects the package putil-merge before 3.8.0. The merge function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in...

CVE-2021-23470

This affects the package putil-merge before 3.8.0. The merge function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in...

CVE-2021-23470

This affects the package putil-merge before 3.8.0. The merge function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in...

Hardcoded credentials

This affects the package putil-merge before 3.8.0. The merge function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in...

CVE-2021-23470

CVE-2021-23470 (NVD OSV entries) affects the package putil-merge up to version 3.8.0. The vulnerability arises in the merge() function, which does not validate incoming values, allowing an attacker to inject properties via the constructor property and pollute prototypes. The issue is described as...

CVE-2021-23470 Prototype Pollution

This affects the package putil-merge before 3.8.0. The merge function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in...

CVE-2021-23470

This affects the package putil-merge before 3.8.0. The merge function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in...

CVE-2021-23470

This affects the package putil-merge before 3.8.0. The merge function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in...

PT-2022-9400

Name of the Vulnerable Software and Affected Versions putil-merge versions prior to 3.8.0 Description The issue arises from the merge function not checking the values passed into its argument, allowing an attacker to supply a malicious value by adjusting it to include the constructor property. Th...

CVE-2021-23470: Improperly Controlled Modification of Object Prototype Attributes

This affects the package putil-merge before 3.8.0. The merge function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in...

putil-merge 安全漏洞

putil-merge is an open source solution for merging two or more objects. It supports deep merging, cloning attributes, copying descriptors and filtering. A security vulnerability exists in putil-merge versions prior to 3.8.0, which stems from the merge function not checking the values of incoming...

Prototype Pollution

Overview putil-merge is a Lightweight solution for merging multiple objects into one. Also it supports deep merge. Affected versions of this package are vulnerable to Prototype Pollution. The merge function does not check the values passed into the argument. An attacker can supply a malicious val...

GHSA-9X7M-9HPG-XXMW Prototype Pollution in putil-merge

Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution...

hixtory (1.0.0), ncfg (>=0.0.1, <=0.12.1) +2 more potentially affected by CVE-2021-25953 via putil-merge (>=1.2.0, <=2.2.0)

putil-merge NPM version =1.2.0, =0.0.1, =0.9.1, =1.5.2, =2.10.5 Source cves: CVE-2021-25953 Source advisory: OSV:GHSA-9X7M-9HPG-XXMW...

Prototype Pollution in putil-merge

Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution...

CVE-2021-25953

Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution...