Google Android 缓冲区错误漏洞

Google Android is a Linux-based open source operating system from the USGoogleOpen Handheld Alliance Google. A security vulnerability exists in Google Android/Pixel that stems from a lack of privilege checking in callCallbackForRequest in ConnectivityService.java, which could bypass privileges...

CVE-2019-25021

An issue was discovered in Scytl sVote 2.1. Due to the implementation of the database manager, an attacker can access the OrientDB by providing admin as the admin password. A different password cannot be set because of the implementation in code...

AZL-6843 CVE-2021-21309 affecting package redis for versions less than 5.0.5-7

Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for...

UBUNTU-CVE-2021-21309

Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for...

Prototype Pollution

Overview tree-kit is a Tree utilities which provides a full-featured extend and object-cloning facility, and various tools to deal with nested object structures. Affected versions of this package are vulnerable to Prototype Pollution via dotPath.set. PoC: const dotPath = require'tree-kit'...

CVE-2021-27097

The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT...

nodejs-set-value: prototype pollution in function set-value

A flaw was found in nodejs-set-value. The function mixin-deep can be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or proto payloads. The highest threat from this vulnerability is to data confidentiality and integrity...

nodejs-set-value: prototype pollution in function set-value

A flaw was found in nodejs-set-value. The function mixin-deep can be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or proto payloads. The highest threat from this vulnerability is to data confidentiality and integrity...

Prototype Pollution

dynamoose is vulnerable to prototype pollution. The vulnerability exists through lib/utils/object/set.ts where an attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

CVE-2021-25913

Prototype pollution vulnerability in 'set-or-get' version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code execution...

CVE-2021-25913

The CVE-2021-25913 entry involves a prototype pollution vulnerability in the set-or-get npm package (versions 1.0.0–1.2.10). The underlying flaw allows an attacker to pollute JavaScript object prototypes, potentially causing a denial of service and, in some cases, remote code execution. A fix is ...

CVE-2021-25913

Prototype pollution vulnerability in 'set-or-get' version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code execution...

PT-2021-16843 · Unknown · Set-Or-Get

Name of the Vulnerable Software and Affected Versions: set-or-get versions 1.0.0 through 1.2.10 Description: The issue is a prototype pollution vulnerability that allows an attacker to cause a denial of service and may lead to remote code execution. Recommendations: For versions 1.0.0 through...

Fishcharlie Amazon Dynamoose Security Breach

Fishcharlie Amazon Dynamoose is a modeling tool from the Fishcharlie organization in the United States. A modeling tool for Amazon DynamoDB is provided. Fishcharlie Amazon Dynamoose has a security vulnerability in versions prior to 2.0.0 and 2.7.0 that stems from a prototype contamination...

set-or-get security breach

set-or-get is an open source package. It is used to set or get object field values. A security vulnerability in set-or-get versions 1.0.0 through 1.2.10 allows attackers to trigger a denial of service and potentially lead to remote code execution...

GHSA-6CF8-QHQJ-VJQM Prototype pollution in total.js

There is a prototype pollution vulnerability in the package total.js before version 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impa...

CVE-2020-28449

This affects all versions of package decal. The vulnerability is in the set function...

Design/Logic Flaw

This affects all versions of package decal. The vulnerability is in the set function...

CVE-2020-28449

CVE-2020-28449 corresponds to a prototype pollution vulnerability in the JavaScript package decal, with the issue located in the set function. Affected software is decal (all versions), and exploitation involves injecting properties into Object.prototype (e.g., via proto or path-based definitions...

Shinuza Decimal-js Security Vulnerability

Shinuza Decimal-js is a Javascript-based codebase used to provide decimal calculations for Node applications by Shinuza Individual Developers. A security vulnerability exists in Shinuza Decimal-js, which stems from the set function...