Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
442 results · page 7 of 9
Apr 26, 2021Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code executCVE-2021-25927 · Other software · Safe-flat Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
- Product
- Safe-flat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Apr 23, 2021Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in purl 2.3.2 allows a malicious user to inject properties into ObjectCVE-2021-20089 · Other software · Purl Project · reported by vulnreport@tenable.comHigh 8.8
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in purl 2.3.2 allows a malicious user to inject properties into Object.prototype.
- Product
- Purl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2021Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-bbq 1.2.1 allows a malicious user to inject properties into CVE-2021-20086 · Other software · Jquery-bbq Project · reported by vulnreport@tenable.comHigh 8.8
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-bbq 1.2.1 allows a malicious user to inject properties into Object.prototype.
- Product
- Jquery-bbq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2021Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in backbone-query-parameters 0.4.0 allows a malicious user to inject pCVE-2021-20085 · Other software · Backbone-query-parameters Project · reported by vulnreport@tenable.comHigh 8.8
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in backbone-query-parameters 0.4.0 allows a malicious user to inject properties into Object.prototype.
- Product
- Backbone-query-parameters
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2021Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-plugin-query-object 2.2.3 allows a malicious user to inject CVE-2021-20083 · Other software · Jquery-plugin-query-object Project · reported by vulnreport@tenable.comHigh 8.8
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-plugin-query-object 2.2.3 allows a malicious user to inject properties into Object.prototype.
- Product
- Jquery-plugin-query-object
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 23, 2021Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in mootools-more 1.6.0 allows a malicious user to inject properties inCVE-2021-20088 · Other software · Mootools · reported by vulnreport@tenable.comHigh 8.8
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in mootools-more 1.6.0 allows a malicious user to inject properties into Object.prototype.
- Product
- Mootools-more
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2021Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-deparam 0.5.1 allows a malicious user to inject properties iCVE-2021-20087 · Other software · Acemetrix · reported by vulnreport@tenable.comHigh 8.8
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-deparam 0.5.1 allows a malicious user to inject properties into Object.prototype.
- Product
- Jquery-deparam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2021Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-sparkle 1.5.2-beta allows a malicious user to inject propertCVE-2021-20084 · Other software · Jquery-sparkle Project · reported by vulnreport@tenable.comHigh 8.8
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-sparkle 1.5.2-beta allows a malicious user to inject properties into Object.prototype.
- Product
- Jquery-sparkle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2021The package copy-props before 2.0.5 are vulnerable to Prototype Pollution via the main functionality.CVE-2020-28503 · Other software · Gulpjs · reported by report@snyk.ioHigh 7.3
The package copy-props before 2.0.5 are vulnerable to Prototype Pollution via the main functionality.
- Product
- Copy-props
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2021Prototype pollution vulnerability in 'patchmerge' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execuCVE-2021-25916 · Other software · Patchmerge Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'patchmerge' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
- Product
- Patchmerge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Mar 9, 2021Prototype pollution vulnerability in 'changeset' versions 0.0.1 through 0.2.5 allows an attacker to cause a denial of service and may lead to remote code executCVE-2021-25915 · Other software · Changeset Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'changeset' versions 0.0.1 through 0.2.5 allows an attacker to cause a denial of service and may lead to remote code execution.
- Product
- Changeset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Mar 1, 2021Prototype pollution vulnerability in 'object-collider' versions 1.0.0 through 1.0.3 allows attacker to cause a denial of service and may lead to remote code exeCVE-2021-25914 · Other software · Fireblink · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'object-collider' versions 1.0.0 through 1.0.3 allows attacker to cause a denial of service and may lead to remote code execution.
- Product
- Object-collider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Feb 18, 2021All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .CVE-2020-28499 · Other software · Merge Project · reported by report@snyk.ioHigh 7.3
All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .
- Product
- Merge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2021Prototype pollution vulnerability in 'set-or-get' version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code execuCVE-2021-25913 · Other software · Set-or-get Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'set-or-get' version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code execution.
- Product
- Set-or-get
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Feb 2, 2021Prototype pollution vulnerability in 'dotty' versions 0.0.1 through 0.1.0 allows attackers to cause a denial of service and may lead to remote code execution.CVE-2021-25912 · Other software · Dotty Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'dotty' versions 0.0.1 through 0.1.0 allows attackers to cause a denial of service and may lead to remote code execution.
- Product
- Dotty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Jan 31, 2021The package nested-object-assign before 1.0.4 are vulnerable to Prototype Pollution via the default function, as demonstrated by running the PoC below.CVE-2021-23329 · Other software · Getadigital · reported by report@snyk.ioHigh 7.5
The package nested-object-assign before 1.0.4 are vulnerable to Prototype Pollution via the default function, as demonstrated by running the PoC below.
- Product
- Nested-object-assign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2021The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath (https://resources.jointjs.com/docs/jointjs/v3.2/joint.htmlutil.setByPCVE-2020-28480 · Other software · Jointjs · reported by report@snyk.ioHigh 7.3
The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath (https://resources.jointjs.com/docs/jointjs/v3.2/joint.htmlutil.setByPath). The path used the access the object's key and set the value is not properly sanitized, leading to a Prototype Pollution.
- Product
- Jointjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2021The package asciitable.js before 1.0.3 are vulnerable to Prototype Pollution via the main function.CVE-2020-7771 · Other software · Asciitable.js Project · reported by report@snyk.ioHigh 7.5
The package asciitable.js before 1.0.3 are vulnerable to Prototype Pollution via the main function.
- Product
- Asciitable.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2020Prototype pollution vulnerability in 'libnested' versions 0.0.0 through 1.5.0 allows an attacker to cause a denial of service and may lead to remote code executCVE-2020-28283 · Other software · Libnested Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'libnested' versions 0.0.0 through 1.5.0 allows an attacker to cause a denial of service and may lead to remote code execution.
- Product
- Libnested
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Dec 29, 2020Prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.CVE-2020-28282 · Other software · Getobject Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.
- Product
- Getobject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Dec 29, 2020Prototype pollution vulnerability in 'set-object-value' versions 0.0.0 through 0.0.5 allows an attacker to cause a denial of service and may lead to remote codeCVE-2020-28281 · Other software · Set-object-value Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'set-object-value' versions 0.0.0 through 0.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.
- Product
- Set-object-value
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Dec 29, 2020Prototype pollution vulnerability in 'predefine' versions 0.0.0 through 0.1.2 allows an attacker to cause a denial of service and may lead to remote code executCVE-2020-28280 · Other software · Predefine Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'predefine' versions 0.0.0 through 0.1.2 allows an attacker to cause a denial of service and may lead to remote code execution.
- Product
- Predefine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Dec 29, 2020Prototype pollution vulnerability in 'flattenizer' versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of service and may lead to remote code execCVE-2020-28279 · Other software · Flattenizer Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'flattenizer' versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.
- Product
- Flattenizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Dec 29, 2020Prototype pollution vulnerability in 'shvl' versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.CVE-2020-28278 · Other software · Shvl Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'shvl' versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
- Product
- Shvl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Dec 29, 2020Prototype pollution vulnerability in 'dset' versions 1.0.0 through 2.0.1 allows attacker to cause a denial of service and may lead to remote code execution.CVE-2020-28277 · Other software · Dset Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'dset' versions 1.0.0 through 2.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
- Product
- Dset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Dec 29, 2020Prototype pollution vulnerability in 'deep-set' versions 1.0.0 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.CVE-2020-28276 · Other software · Deep-set Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'deep-set' versions 1.0.0 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
- Product
- Deep-set
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Dec 16, 2020All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.CVE-2020-28458 · Other software · Datatables · reported by report@snyk.ioHigh 7.3
All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.
- Product
- Datatables.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn function.CVE-2020-28442 · Other software · Js-data · reported by report@snyk.ioHigh 7.5
All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn function.
- Product
- Js-data
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020Prototype pollution vulnerability in 'deepref' versions 1.1.1 through 1.2.1 allows attacker to cause a denial of service and may lead to remote code execution.CVE-2020-28274 · Other software · Deepref Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'deepref' versions 1.1.1 through 1.2.1 allows attacker to cause a denial of service and may lead to remote code execution.
- Product
- Deepref
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwhitesourcesoftware.comwhitesourcesoftware.com
Dec 2, 2020Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution.CVE-2020-28273 · Other software · Set-in Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution.
- Product
- Set-in
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Dec 2, 2020Prototype pollution vulnerability in 'keyget' versions 1.0.0 through 2.2.0 allows attacker to cause a denial of service and may lead to remote code execution.CVE-2020-28272 · Other software · Keyget Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'keyget' versions 1.0.0 through 2.2.0 allows attacker to cause a denial of service and may lead to remote code execution.
- Product
- Keyget
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Nov 27, 2020npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection.CVE-2020-26245 · Other software · sebhildebrandt · reported by GitHubHigh 8.1
npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. The issue was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. The issue is fixed in version 4.30.5. If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite().
- Product
- systeminformation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2020The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.CVE-2020-7774 · Other software · Y18n Project · reported by report@snyk.ioHigh 7.3
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
- Product
- Y18n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comgithub.com
Nov 15, 2020Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code exCVE-2020-28268 · Other software · Controlled-merge Project · reported by vulnerabilitylab@mend.ioHigh 7.5
Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution.
- Product
- Controlled-merge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Nov 12, 2020Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.CVE-2020-28271 · Other software · Sharpred · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.
- Product
- Deephas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Nov 12, 2020Prototype pollution vulnerability in 'object-hierarchy-access' versions 0.2.0 through 0.32.0 allows attacker to cause a denial of service and may lead to remoteCVE-2020-28270 · Other software · Mjpclab · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'object-hierarchy-access' versions 0.2.0 through 0.32.0 allows attacker to cause a denial of service and may lead to remote code execution.
- Product
- Object-hierarchy-access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Nov 12, 2020Prototype pollution vulnerability in 'field' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.CVE-2020-28269 · Other software · Exodus · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'field' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
- Product
- Field
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Nov 11, 2020The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition.CVE-2020-7768 · Other software · Grpc · reported by report@snyk.ioHigh 7.5
The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition.
- Product
- Grpc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2020Prototype pollution vulnerability in '@strikeentco/set' version 1.0.0 allows attacker to cause a denial of service and may lead to remote code execution.CVE-2020-28267 · Other software · SET Project · reported by vulnerabilitylab@mend.ioHigh 7.5
Prototype pollution vulnerability in '@strikeentco/set' version 1.0.0 allows attacker to cause a denial of service and may lead to remote code execution.
- Product
- SET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Nov 9, 2020Prototype pollution vulnerability in json8-merge-patch npm package < 1.0.3 may allow attackers to inject or modify methods and properties of the global object cCVE-2020-8268 · Other software · Json8-merge-patch Project · reported by support@hackerone.comHigh 7.5
Prototype pollution vulnerability in json8-merge-patch npm package < 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor.
- Product
- Json8-merge-patch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Oct 26, 2020pathval before version 1.1.1 is vulnerable to prototype pollution.CVE-2020-7751 · Other software · Chaijis · reported by report@snyk.ioMedium 6
pathval before version 1.1.1 is vulnerable to prototype pollution.
- Product
- Pathval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2020A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method.CVE-2020-15256 · Other software · mariocasciaro · reported by GitHubHigh 7.7
A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of `object-path` and setting the option `includeInheritedProps: true`, or by using the default `withInheritedProps` instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage of `set()` in versions < 0.11.0 is vulnerable. The issue is fixed in object-path version 0.11.5 As a workaround, don't use the `includeInheritedProps: true` options or the `withInheritedProps` instance if using a version >= 0.11.0.
- Product
- object-path
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2020The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.CVE-2020-7743 · Other software · Mathjs · reported by report@snyk.ioHigh 7.3
The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.
- Product
- Mathjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2020All versions of package safetydance are vulnerable to Prototype Pollution via the set function.CVE-2020-7737 · Other software · Safetydance Project · reported by report@snyk.ioHigh 7.3
All versions of package safetydance are vulnerable to Prototype Pollution via the set function.
- Product
- Safetydance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2020The package bmoor before 0.8.12 are vulnerable to Prototype Pollution via the set function.CVE-2020-7736 · Other software · Bmoor Project · reported by report@snyk.ioHigh 7.3
The package bmoor before 0.8.12 are vulnerable to Prototype Pollution via the set function.
- Product
- Bmoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2020Prototype pollution in json-bigint npm package < 1.0.0 may lead to a denial-of-service (DoS) attack.CVE-2020-8237 · Other software · Json-bigint Project · reported by support@hackerone.comHigh 7.5
Prototype pollution in json-bigint npm package < 1.0.0 may lead to a denial-of-service (DoS) attack.
- Product
- Json-bigint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Sep 18, 2020Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service orCVE-2020-8158 · Other software · Typeorm · reported by support@hackerone.comCritical 9.8
Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.
- Product
- Typeorm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Sep 3, 2020A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes prior to commit fe5285CVE-2020-1911 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes prior to commit fe52854cdf6725c2eaa9e125995da76e6ceb27da allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
- Product
- Hermes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comfacebook.com
Sep 1, 2020All versions of package gedi are vulnerable to Prototype Pollution via the set function.CVE-2020-7727 · Other software · Gedi Project · reported by report@snyk.ioCritical 9.8
All versions of package gedi are vulnerable to Prototype Pollution via the set function.
- Product
- Gedi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2020All versions of package safe-object2 are vulnerable to Prototype Pollution via the setter function.CVE-2020-7726 · Other software · Safe-object2 Project · reported by report@snyk.ioCritical 9.8
All versions of package safe-object2 are vulnerable to Prototype Pollution via the setter function.
- Product
- Safe-object2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.