Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
442 results · page 6 of 9
Feb 2, 2022Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0.CVE-2022-0432 · Other software · mastodon · reported by security@huntr.devMedium 6.1
Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0.
- Product
- mastodon/mastodon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2022The package keyget from 0.0.0 are vulnerable to Prototype Pollution via the methods set, push, and at which could allow an attacker to cause a denial of serviceCVE-2021-23760 · Other software · Keyget Project · reported by report@snyk.ioMedium 5.6
The package keyget from 0.0.0 are vulnerable to Prototype Pollution via the methods set, push, and at which could allow an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives from an incomplete fix to [CVE-2020-28272](https://security.snyk.io/vuln/SNYK-JS-KEYGET-1048048)
- Product
- Keyget
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2022The package bmoor before 0.10.1 are vulnerable to Prototype Pollution due to missing sanitization in set function.CVE-2021-23558 · Other software · Bmoor Project · reported by report@snyk.ioHigh 7.3
The package bmoor before 0.10.1 are vulnerable to Prototype Pollution due to missing sanitization in set function. **Note:** This vulnerability derives from an incomplete fix in [CVE-2020-7736](https://security.snyk.io/vuln/SNYK-JS-BMOOR-598664)
- Product
- Bmoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2022The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in tCVE-2021-23518 · Other software · Cached-path-relative Project · reported by report@snyk.ioHigh 7.3
The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573
- Product
- Cached-path-relative
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jan 21, 2022The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.CVE-2021-23460 · Other software · Camunda · reported by report@snyk.ioHigh 7.5
The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.
- Product
- Min-dash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2022There is an Assertion 'local_tza == ecma_date_local_time_zone_adjustment (date_value)' failed at /jerry-core/ecma/builtin-objects/ecma-builtin-date-prototype.c(CVE-2021-46351 · Other software · Jerryscript · reported by MITREMedium 5.5
There is an Assertion 'local_tza == ecma_date_local_time_zone_adjustment (date_value)' failed at /jerry-core/ecma/builtin-objects/ecma-builtin-date-prototype.c(ecma_builtin_date_prototype_dispatch_set):421 in JerryScript 3.0.0.
- Product
- Jerryscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2022There is an Assertion 'local_tza == ecma_date_local_time_zone_adjustment (date_value)' failed at /jerry-core/ecma/builtin-objects/ecma-builtin-date-prototype.c(CVE-2021-46346 · Other software · Jerryscript · reported by MITREMedium 5.5
There is an Assertion 'local_tza == ecma_date_local_time_zone_adjustment (date_value)' failed at /jerry-core/ecma/builtin-objects/ecma-builtin-date-prototype.c(ecma_builtin_date_prototype_dispatch_set):421 in JerryScript 3.0.0.
- Product
- Jerryscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2022Moddable SDK v11.5.0 was discovered to contain a NULL pointer dereference in the component fx_Function_prototype_hasInstance.CVE-2021-46335 · Other software · Moddable · reported by MITREMedium 5.5
Moddable SDK v11.5.0 was discovered to contain a NULL pointer dereference in the component fx_Function_prototype_hasInstance.
- Product
- Moddable SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2022Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via xs/sources/xsProxy.c in fxProxyGetPrototype.CVE-2021-46331 · Other software · Moddable · reported by MITREMedium 5.5
Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via xs/sources/xsProxy.c in fxProxyGetPrototype.
- Product
- Moddable SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2022Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via xs/sources/xsDataView.c in fx_ArrayBuffer_prototype_concat.CVE-2021-46330 · Other software · Moddable · reported by MITREMedium 5.5
Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via xs/sources/xsDataView.c in fx_ArrayBuffer_prototype_concat.
- Product
- Moddable SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2022Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via xs/sources/xsArray.c in fx_Array_prototype_sort.CVE-2021-46327 · Other software · Moddable · reported by MITREMedium 5.5
Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via xs/sources/xsArray.c in fx_Array_prototype_sort.
- Product
- Moddable SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.CVE-2021-23594 · Other software · Agoric · reported by report@snyk.ioCritical 9.8
All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.
- Product
- Realms-shim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge.CVE-2021-23568 · Other software · Eggjs · reported by report@snyk.ioHigh 7.3
The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge.
- Product
- Extend2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.CVE-2021-23543 · Other software · Agoric · reported by report@snyk.ioCritical 9.8
All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.
- Product
- Realms-shim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2021All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions.CVE-2021-23574 · Other software · Js-data · reported by report@snyk.ioHigh 7.5
All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of [CVE-2020-28442](https://snyk.io/vuln/SNYK-JS-JSDATA-1023655).
- Product
- Js-data
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2021All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.CVE-2021-23450 · Computers, phones & browsers · Linuxfoundation · reported by report@snyk.ioHigh 7.5
All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.
- Product
- Dojo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Dec 10, 2021All versions of package merge-deep2 are vulnerable to Prototype Pollution via the mergeDeep() function.CVE-2021-23700 · Other software · Merge-deep2 Project · reported by report@snyk.ioMedium 6.5
All versions of package merge-deep2 are vulnerable to Prototype Pollution via the mergeDeep() function.
- Product
- Merge-deep2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2021All versions of package sey are vulnerable to Prototype Pollution via the deepmerge() function.CVE-2021-23663 · Other software · SEY Project · reported by report@snyk.ioMedium 6.5
All versions of package sey are vulnerable to Prototype Pollution via the deepmerge() function.
- Product
- SEY
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2021All versions of package comb are vulnerable to Prototype Pollution via the deepMerge() function.CVE-2021-23561 · Other software · C2fo · reported by report@snyk.ioMedium 6.5
All versions of package comb are vulnerable to Prototype Pollution via the deepMerge() function.
- Product
- Comb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2021utils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2021-3815 · Other software · fabiocaccamo · reported by security@huntr.devCritical 9.8
utils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- Product
- fabiocaccamo/utils.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2021The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParamCVE-2021-23433 · Other software · Algolia · reported by report@snyk.ioMedium 5.9
The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters._parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the implementation allows users to define arbitrary search patterns.
- Product
- Algoliasearch-helper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2021OpenSource Moddable v10.5.0 was discovered to contain a heap buffer overflow in the fx_String_prototype_repeat function at /moddable/xs/sources/xsString.c.CVE-2021-29325 · Other software · Moddable · reported by MITREHigh 7.8
OpenSource Moddable v10.5.0 was discovered to contain a heap buffer overflow in the fx_String_prototype_repeat function at /moddable/xs/sources/xsString.c.
- Product
- Moddable
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2021json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2021-3918 · Other software · kriszyp · reported by security@huntr.devCritical 9.8
json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- Product
- kriszyp/json-schema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2021This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host machine.CVE-2021-23449 · Other software · Vm2 Project · reported by report@snyk.ioCritical 9.8
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host machine.
- Product
- Vm2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2021All versions of package config-handler are vulnerable to Prototype Pollution when loading config files.CVE-2021-23448 · Other software · Config-handler Project · reported by report@snyk.ioMedium 6.5
All versions of package config-handler are vulnerable to Prototype Pollution when loading config files.
- Product
- Config-handler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2021object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2021-3805 · Other software · mariocasciaro · reported by security@huntr.devHigh 7.5
object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- Product
- mariocasciaro/object-path
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2021body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2021-3666 · Other software · fiznool · reported by security@huntr.devCritical 9.8
body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- Product
- fiznool/body-parser-xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2021merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2021-3645 · Other software · viking04 · reported by security@huntr.devCritical 9.8
merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- Product
- viking04/merge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2021objection.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2021-3766 · Other software · vincit · reported by security@huntr.devCritical 9.8
objection.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- Product
- vincit/objection.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2021immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2021-3757 · Other software · immerjs · reported by security@huntr.devCritical 9.8
immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- Product
- immerjs/immer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2021All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function.CVE-2021-23421 · Other software · Merge-change Project · reported by report@snyk.ioMedium 5.6
All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function.
- Product
- Merge-change
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2021All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.CVE-2021-23417 · Other software · Deepmergefn Project · reported by report@snyk.ioMedium 5.6
All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.
- Product
- Deepmergefn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2021Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code executioCVE-2021-25953 · Other software · Putil-merge Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution.
- Product
- Putil-merge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwhitesourcesoftware.comwhitesourcesoftware.com
Jul 7, 2021Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lead to remote code exCVE-2021-25952 · Other software · Just-safe-set Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lead to remote code execution.
- Product
- Just-safe-set
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Jul 2, 2021All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.CVE-2021-23403 · Other software · Ts-nodash Project · reported by report@snyk.ioHigh 7.3
All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.
- Product
- Ts-nodash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2021All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality.CVE-2021-23402 · Other software · Record-like-deep-assign Project · reported by report@snyk.ioHigh 7.3
All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality.
- Product
- Record-like-deep-assign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2021An issue was discovered in the stripTags and unescapeHTML components in Prototype 1.7.3 where an attacker can cause a Regular Expression Denial of Service (ReDOCVE-2020-27511 · Other software · Prototypejs · reported by MITREHigh 7.5
An issue was discovered in the stripTags and unescapeHTML components in Prototype 1.7.3 where an attacker can cause a Regular Expression Denial of Service (ReDOS) through stripping crafted HTML tags.
- Product
- Prototype
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprototypejs.orggithub.com
Jun 17, 2021All versions of package lutils are vulnerable to Prototype Pollution via the main (merge) function.CVE-2021-23396 · Other software · Lutils Project · reported by report@snyk.ioMedium 5.6
All versions of package lutils are vulnerable to Prototype Pollution via the main (merge) function.
- Product
- Lutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2021Prototype pollution in Stampit supermixer 1.0.3 allows an attacker to modify the prototype of a base object which can vary in severity depending on the implemenCVE-2020-24939 · Other software · Stampit · reported by MITREHigh 7.5
Prototype pollution in Stampit supermixer 1.0.3 allows an attacker to modify the prototype of a base object which can vary in severity depending on the implementation.
- Product
- Supermixer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Jun 10, 2021Prototype pollution vulnerability in 'set-getter' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.CVE-2021-25949 · Other software · Set-getter Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'set-getter' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.
- Product
- Set-getter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Jun 10, 2021Prototype pollution vulnerability in 'expand-hash' versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execCVE-2021-25948 · Other software · Expand-hash Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'expand-hash' versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
- Product
- Expand-hash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Jun 3, 2021Prototype pollution vulnerability in 'nestie' versions 0.0.0 through 1.0.0 allows an attacker to cause a denial of service and may lead to remote code executionCVE-2021-25947 · Other software · Nestie Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'nestie' versions 0.0.0 through 1.0.0 allows an attacker to cause a denial of service and may lead to remote code execution.
- Product
- Nestie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwhitesourcesoftware.comwhitesourcesoftware.com
Jun 2, 2021The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it.CVE-2021-26707 · Other software · Merge-deep Project · reported by MITRECritical 9.8
The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library.
- Product
- Merge-deep
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
May 26, 2021Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code executionCVE-2021-25945 · Other software · Js-extend Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
- Product
- Js-extend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwhitesourcesoftware.comwhitesourcesoftware.com
May 25, 2021Prototype pollution vulnerability in `nconf-toml` versions 0.0.1 through 0.0.2 allows an attacker to cause a denial of service and may lead to remote code execuCVE-2021-25946 · Other software · Nconf-toml Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in `nconf-toml` versions 0.0.1 through 0.0.2 allows an attacker to cause a denial of service and may lead to remote code execution.
- Product
- Nconf-toml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
May 25, 2021Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execuCVE-2021-25944 · Other software · Deep-defaults Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.
- Product
- Deep-defaults
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwhitesourcesoftware.comwhitesourcesoftware.com
May 14, 2021Prototype pollution vulnerability in '101' versions 1.0.0 through 1.6.3 allows an attacker to cause a denial of service and may lead to remote code execution.CVE-2021-25943 · Other software · 101 Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in '101' versions 1.0.0 through 1.6.3 allows an attacker to cause a denial of service and may lead to remote code execution.
- Product
- 101
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
May 14, 2021Prototype pollution vulnerability in 'deep-override' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code exCVE-2021-25941 · Other software · Deep-override Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'deep-override' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
- Product
- Deep-override
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
May 4, 2021The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrustedCVE-2021-23383 · Other software · Handlebarsjs · reported by report@snyk.ioMedium 5.6
The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.
- Product
- Handlebars
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
Apr 26, 2021Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code executiCVE-2021-25928 · Other software · Manta · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execution.
- Product
- Safe-obj
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.