Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution. The vulnerability is in the set function. PoC const decal = require'decal'; console.log'Before:', .polluted; decal.set, "proto.polluted", "1337"; console.log'After:', .polluted; Details Prototype Pollution is a...

xorg-x11-server: Out-of-bounds access in XkbSetMap function

A flaw was found in the X.Org Server. An out-of-bounds access in the XkbSetMap function may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service.

...

TapinRadio 2.13.7 - Denial of Service Exploit

Exploit Title: TapinRadio 2.13.7 - Denial of Service PoC Date: 2020-05-12 Exploit Author: Ismael Nava Vendor Homepage: http://www.raimersoft.com/ Software Link: www.raimersoft.com/downloads/tapinradiosetupx64.exe Version: 2.13.7 x64 Tested on: Windows 10 Home x64 STEPS Open the program TapinRadio...

Prototype Pollution

set-in is vulnerable to prototype pollution. The vulnerability exists through the lack of validation on the proto key values in headers...

CVE-2020-28273

Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution...

CVE-2020-28273

The CVE-2020-28273 entry concerns a prototype pollution vulnerability in the npm package set-in, affected in versions 1.0.0 through 2.0.0. The root cause is prototype pollution via the setIn method, which allows merging object prototypes and can lead to a denial of service and may enable remote c...

CVE-2020-28273

Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution...

DEBIAN-CVE-2020-25704

A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERFEVENTIOCSETFILTER. A local user could use this flaw to starve the resources causing denial of service...

UBUNTU-CVE-2020-25704

A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERFEVENTIOCSETFILTER. A local user could use this flaw to starve the resources causing denial of service...

Ahdinosaur Set-in Security Vulnerability

Ahdinosaur Set-in is a Js-based codebase from the individual developer of Ahdinosaur that can assign values to keys in nested associative structures. A security vulnerability exists in Ahdinosaur Set-in versions 1.0.0 through 2.0.0, which stems from a prototype contamination vulnerability that...

CVE-2020-15256

A flaw was found in object-path. A prototype pollution vulnerability has been found in object-path affecting the set method. The vulnerability is limited to the includeInheritedProps mode if version = 0.11.0 is used, which has to be explicitly enabled by creating a new instance of object-path and...

Hrsale Cross-Site Scripting Vulnerability

Hrsale is an HRMS written in PHP by the Hrsale team. A cross-site scripting vulnerability exists in HRSALE 2.0.0. The vulnerability can be exploited by an attacker to conduct a cross-site scripting attack via the admin/project/projectscalendar setdate parameter...

CVE-2020-29053

HRSALE 2.0.0 allows XSS via the admin/project/projectscalendar setdate parameter...

Hrsale 跨站脚本漏洞

Hrsale is an HRMS written in PHP by the Hrsale team. A cross-site scripting vulnerability exists in HRSALE 2.0.0. The vulnerability can be exploited by an attacker to conduct a cross-site scripting attack via the admin/project/projectscalendar setdate parameter...

CVE-2020-7842

Improper Input validation vulnerability exists in Netis Korea D'live AP which could cause arbitrary command injection and execution when the time setting using ntpServerlp1 parameter for the users. This affects D'live set-top box APWF2429TB v1.1.10...

Input validation

Improper Input validation vulnerability exists in Netis Korea D'live AP which could cause arbitrary command injection and execution when the time setting using ntpServerlp1 parameter for the users. This affects D'live set-top box APWF2429TB v1.1.10...

U.S. General Services Administration: CRLF INJECTION

Vulnerable url - https://www.epay.fas.gsa.gov/%0D%0ASet-Cookie:crlfinjection=crlfinjection Impact an attacker can set new header...

Taskcafe 0.1.0 / 0.1.1 Cross Origin Resource Sharing

Exploit Title: Taskcafé 0.1.0 and 0.1.1- Cross-Origin Resource Sharing Date: 2020- 09- 02 Exploit Author: Mufaddal Masalawala Vendor Homepage: https://github.com/JordanKnott/ Software Link: https://github.com/JordanKnott/taskcafe Version: 0.1.0 and 0.1.1 Tested on: Kali Linux 2020.3 POC: The web...

Prototype Pollution

@strikeentco/set is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...