CVE-2022-23033

arm: guestphysmapremovepage not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm p2mremovemapping, guestphysmapremovepage, and p2msetentry with mfn set to INVALIDMFN do not actually clear the pagetable entry if the entry doesn't have the vali...

CVE-2022-23033

arm: guestphysmapremovepage not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm p2mremovemapping, guestphysmapremovepage, and p2msetentry with mfn set to INVALIDMFN do not actually clear the pagetable entry if the entry doesn't have the vali...

NETGEAR Wi-Fi Router Pre-set Credentials Unauthorized Access

The vulnerability of NETGEAR Wi-Fi router software, including models RBK352, RBR350, and RBS350, stems from the use of pre-set login credentials. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to protected information from a remote location...

PT-2022-9535

Name of the Vulnerable Software and Affected Versions Five Star Restaurant Reservations WordPress plugin versions prior to 2.4.8 Description The issue concerns a lack of capability and CSRF checks in the rtb welcome set schedule AJAX action. This allows any authenticated users to call the action,...

CVE-2021-23460

The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types...

CVE-2021-23460

The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types...

min-dash security vulnerabilities

min-dash is a minimal utility belt for use with bpmn.io related libraries. A security vulnerability exists in versions prior to min-dash 3.8.1, which stems from the lack of critical type enforcement and makes the software susceptible to prototype contamination via the set method...

PT-2022-9399

Name of the Vulnerable Software and Affected Versions min-dash versions prior to 3.8.1 Description The issue concerns Prototype Pollution via the set method due to missing enforcement of key types. Recommendations For versions prior to 3.8.1, update to version 3.8.1 or later to resolve the issue...

CVE-2021-23460: Improperly Controlled Modification of Object Prototype Attributes

The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types...

CVE-2021-46346

There is an Assertion 'localtza == ecmadatelocaltimezoneadjustment datevalue' failed at /jerry-core/ecma/builtin-objects/ecma-builtin-date-prototype.cecmabuiltindateprototypedispatchset:421 in JerryScript 3.0.0...

Prototype Pollution

Overview deep-get-set is a Set and get values on objects via dot-notation strings. Affected versions of this package are vulnerable to Prototype Pollution via the 'deep' function. Note: This vulnerability derives from an incomplete fix of CVE-2020-7715 POC: js let deep = require'deep-get-set';...

moleculer-rabbitmq-extend-delay (1.1.12) potentially affected by CVE-2020-7715 +1 more via deep-get-set (1.1.1)

deep-get-set NPM version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on deep-get-set and may be impacted: - moleculer-rabbitmq-extend-delay 1.1.12 Source cves: CVE-2020-7715, CVE-2022-21231 Source advisory: SNYK:JS-DEEPGETSET-2342655...

Prototype Pollution

Overview bmoor is an A basic foundation for other libraries, establishing useful patterbs, and letting them be more. Affected versions of this package are vulnerable to Prototype Pollution due to missing sanitization in set function. Note: This vulnerability derives from an incomplete fix in...

CVE-2021-38783

There is a Out-of-Bound Write in the Allwinner R818 SoC Android Q SDK V1.0 camera driver "/dev/cedardev" through iotcl cmd IOCTLSETPROCINFO and IOCTLCOPYPROCINFO, which could cause a system crash or EoP...

CVE-2021-33964

China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRRuleFilter/setfirewalllevel which receives parameters by POST request, and the parameter firewalllevel has a command injection vulnerability. An attacker can use the vulnerability to execute remote commands...

PT-2022-10305

Name of the Vulnerable Software and Affected Versions China Mobile An Lianbao WF-1 router version 1.0.1 Description The issue concerns a command injection vulnerability in the web interface of the China Mobile An Lianbao WF-1 router. Specifically, the API endpoint "/api/ZRRuleFilter/set firewall...

PT-2022-10306

Name of the Vulnerable Software and Affected Versions China Mobile An Lianbao WF-1 version 1.0.1 Description The China Mobile An Lianbao WF-1 router provides a web interface at the "/api/ZRMesh/set ZRMesh" endpoint, which receives parameters by POST request. The mesh enable and mesh device...

Prototype Pollution

Overview min-dash is a Minimal utility tool belt to be used with bpmn.io related libraries. Affected versions of this package are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types. PoC: js let parser = require"min-dash"; parser.set, "proto", "polluted",...

PT-2022-12603

Name of the Vulnerable Software and Affected Versions Modex version 2.11 Description A NULL pointer dereference was discovered in the set create id function at xtract.c. Recommendations For Modex version 2.11, at the moment, there is no information about a newer version that contains a fix for th...

Modex code-related vulnerabilities

Modex is a model extractor. It is used to mechanically extract verification models from implementation-level C code. A security vulnerability exists in Modex, which stems from the fact that Modex v2.11 was found to contain a NULL pointer dereference in setcreateid of xtract.c. The vulnerability i...