The vulnerability of the SetValue() function (/goform/WizardHandle) in the Tenda AC18 router’s microprogramming software allows a hacker to induce a service failure.

The vulnerability of the SetValue function /goform/WizardHandle of the Tenda AC18 router’s microprogramming system is related to the issue of writing data beyond the buffer boundaries when processing the nptr parameter. Exploiting this vulnerability could allow a malicious actor to cause service...

Prototype Pollution

@amoy/common is vulnerable to prototype pollution. The vulnerability is due to setValue function, potentially allowing attackers to execute arbitrary code or cause a Denial of Service DoS by injecting arbitrary properties...

CVE-2024-39003

amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function setValue. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties...

amoy common Security Vulnerabilities

amoy common is a library in amoyjs open source. A security vulnerability exists in amoy common v1.0.10, which stems from prototype contamination via the function setValue, allowing an attacker to execute arbitrary code or cause a denial of service DoS by injecting arbitrary properties...

PT-2024-28319 · Amoyjs · Amoyjs

Name of the Vulnerable Software and Affected Versions: amoyjs amoy common version 1.0.10 Description: The issue is related to a prototype pollution vulnerability via the setValue function. This allows attackers to execute arbitrary code or cause a Denial of Service DoS by injecting arbitrary...

CVE-2024-39003: Improperly Controlled Modification of Object Prototype Attributes

amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function setValue. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties...

fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtime

Summary Fuzz testing on crossplane/crossplane, by Ada Logics and sponsored by the CNCF, identified input to a function in the fieldpath package that can cause an out of memory panic. Applications that use the Paved type's SetValue method with user provided input without proper validation might us...

GHSA-VFVJ-3M3G-M532 fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtime

Summary Fuzz testing on crossplane/crossplane, by Ada Logics and sponsored by the CNCF, identified input to a function in the fieldpath package that can cause an out of memory panic. Applications that use the Paved type's SetValue method with user provided input without proper validation might us...

GO-2023-1623 Out-of-memory panic in github.com/crossplane/crossplane-runtime

An out of memory panic vulnerability exists in the crossplane-runtime libraries. Applications that use the Paved type's SetValue method with user-provided input that is not properly validated might use excessive amounts of memory and cause an out of memory panic. In the fieldpath package, the...

Denial Of Service (DoS)

github.com/crossplane/crossplane-runtime is vulnerable to Denial Of Service DoS. The vulnerability exists due to the Pave and setValue functions in paved.go because it does not enforce the max index size of a field path, allowing an attacker to use excessive memory and cause an application crash...

CVE-2023-27483

crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. An out of memory panic vulnerability has been discovered in affected versions. Applications that use the Paved type's SetValue method with user provided input without proper...

CVE-2023-27483

CVE-2023-27483 affects crossplane-runtime: the fieldpath package’s Paved.SetValue can grow slices to very large sizes when given unvalidated input, causing an out-of-memory panic. Affected code path is the Paved.SetValue method that writes values along a path without validation, with the index ca...

CVE-2023-27483 fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtime

crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. An out of memory panic vulnerability has been discovered in affected versions. Applications that use the Paved type's SetValue method with user provided input without proper...

Prototype Pollution

madlib-object-utils is vulnerable to prototype pollution. The vulnerability exists in the utils.js due to lack of validation in setValue which allows an attacker to inject and execute arbitrary code...

GHSA-PFV6-PRQM-85Q8 Prototype Pollution in madlib-object-utils

The package madlib-object-utils before version 0.1.8 is vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix of CVE-2020-7701...

Prototype Pollution in madlib-object-utils

The package madlib-object-utils before version 0.1.8 is vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix of CVE-2020-7701...

UBUNTU-CVE-2022-24279

The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix of CVE-2020-7701...

Design/Logic Flaw

The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix of CVE-2020-7701...

CVE-2022-24279

The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix of CVE-2020-7701...

CVE-2022-24279

CVE-2022-24279 affects the package madlib-object-utils before 0.1.8. It is vulnerable to Prototype Pollution via the setValue method, allowing an attacker to merge object prototypes into the package. The vulnerability derives from an incomplete fix of CVE-2020-7701. The provided documents describ...