CVE-2021-23507 Prototype Pollution

The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-OBJECTPATHSET-607908...

CVE-2021-23507

The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-OBJECTPATHSET-607908...

express-requests-loggly (>=0.1.0, <=0.1.2), mongoose-power-populate (>=1.0.0, <=1.3.4) +5 more potentially affected by CVE-2021-23507 via object-path-set (>=0.0.1, <=0.0.2)

object-path-set NPM version =0.0.1, =0.1.0, =1.0.0, =0.2.3, =0.2.0, =0.1.0, =0.1.0, =1.0.0, =1.1.1 Source cves: CVE-2021-23507 Source advisory: MEND:CVE-2021-23507...

CVE-2021-23507

CVE-2021-23507 affects the npm package object-path-set . Versions before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, enabling an attacker to merge properties into object prototypes. Impact can include denial of service or potential remote code execution, per the provided r...

CVE-2021-23497

This affects the package @strikeentco/set before 1.0.2. It allows an attacker to cause a denial of service and may lead to remote code execution. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-STRIKEENTCOSET-1038821...

CVE-2021-23497

The CVE-2021-23497 entry affects the package @strikeentco/set prior to 1.0.2. The vulnerability arises from an incomplete fix and enables Prototype Pollution, leading to a Denial of Service and may enable Remote Code Execution. Affected code paths include unsafe recursive merges and path-based pr...

CVE-2021-23497 Prototype Pollution

This affects the package @strikeentco/set before 1.0.2. It allows an attacker to cause a denial of service and may lead to remote code execution. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-STRIKEENTCOSET-1038821...

CVE-2021-23507

The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-OBJECTPATHSET-607908...

CVE-2021-23497

This affects the package @strikeentco/set before 1.0.2. It allows an attacker to cause a denial of service and may lead to remote code execution. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-STRIKEENTCOSET-1038821...

DEBIAN-CVE-2021-45429

A Buffer Overflow vulnerablity exists in VirusTotal YARA git commit: 605b2edf07ed8eb9a2c61ba22eb2e7c362f47ba7 via yrsetconfiguration in yara/libyara/libyara.c, which could cause a Denial of Service...

UBUNTU-CVE-2021-45429

A Buffer Overflow vulnerablity exists in VirusTotal YARA git commit: 605b2edf07ed8eb9a2c61ba22eb2e7c362f47ba7 via yrsetconfiguration in yara/libyara/libyara.c, which could cause a Denial of Service...

CVE-2022-24163

Tenda AX3 v16.03.12.10CN was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability allows attackers to cause a Denial of Service DoS via the timeZone parameter...

CVE-2022-24167

Tenda routers G1 and G3 v15.11.0.179502CN were discovered to contain a command injection vulnerability in the function formSetDMZ. This vulnerability allows attackers to execute arbitrary commands via the dmzHost1 parameter...

CVE-2022-24155

Tenda AX3 v16.03.12.10CN was discovered to contain a heap overflow in the function setSchedWifi. This vulnerability allows attackers to cause a Denial of Service DoS via the schedStartTime and schedEndTime parameters...

CVE-2022-24145

Tenda AX3 v16.03.12.10CN was discovered to contain a stack overflow in the function formWifiBasicSet. This vulnerability allows attackers to cause a Denial of Service DoS via the security and security5g parameters...

Object-path security vulnerabilities

object-path is a personal developer's Npm library for accessing variables in data structures via paths. A security vulnerability exists in object-path-set prior to version 1.0.2, which stems from software that is vulnerable to Prototype Pollution via the setPath method, allowing an attacker to...

PT-2022-16493

Name of the Vulnerable Software and Affected Versions Tenda AX3 version 16.03.12.10 CN Tenda AX12 version 22.03.01.2 CN Description A stack overflow was discovered in the form fast setting wifi set function, allowing attackers to cause a Denial of Service DoS via the timeZone parameter...

PT-2022-9404

Name of the Vulnerable Software and Affected Versions object-path-set versions prior to 1.0.2 Description The issue allows an attacker to merge object prototypes into it via the setPath method, enabling Prototype Pollution. This vulnerability is a result of an incomplete fix. Recommendations For...

PT-2022-16082

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.0 through 2.7.1 TensorFlow versions 2.6.0 through 2.6.3 TensorFlow versions 2.5.0 through 2.5.3 Description TensorFlow is vulnerable to a heap out-of-bounds OOB write in Grappler. The...

PT-2022-9403

Name of the Vulnerable Software and Affected Versions @strikeentco/set versions prior to 1.0.2 Description This issue allows an attacker to cause a denial of service and may lead to remote code execution. It derives from an incomplete fix. Recommendations For versions prior to 1.0.2, update to...