Lucene search
Veracode Vulnerability DatabaseVERACODE:21940HistoryNov 11, 2019 - 5:56 a.m.
Prototype Pollution
2019-11-1105:56:35
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
4
0.001 Low
EPSS
Percentile
45.8%
pomelo is vulnerable to prototype pollution. A malicious user-input can corrupt arbitrary methods and attributes in template/game-server/app/servers/connector/handler/entryHandler.js due to overwriting of certain internal attributes via a conflicting name. This could allow an attacker to execute arbitrary code by adding additional attributes to user-input.
Related
cve
cve
CVE-2019-18954
2019-11-14 00:15:11
nvd
nvd
CVE-2019-18954
2019-11-14 00:15:11
github
github
Pomelo allows external control of critical state data
2019-12-02 18:16:34
githubexploit
githubexploit
Exploit for Exposure of Resource to Wrong Sphere in Netease Pomelo
2020-12-01 09:18:58
osv
osv
Pomelo allows external control of critical state data
2019-12-02 18:16:34
CVE-2019-18954
2019-11-14 00:15:11
cvelist
cvelist
CVE-2019-18954
2019-11-13 23:39:46
prion
prion
Xxe
2019-11-14 00:15:00