Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Affected: npm: lodash, npm: lodash-es, npm: lodash-amd, npm: lodash.defaultsdeep, RubyGems: lodash-rails

Versions of `lodash` before 4.17.12 are vulnerable to Prototype Pollution. The function `defaultsDeep` allows a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing property that will exist on all objects.

## Recommendation

Update to version 4.17.12 or later.

bootstrap: XSS in the tooltip or popover data-template attribute nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection

Withdrawn by the publisher.

Affected: Ubuntu:20.04:LTS: node-lodash

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Ein Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise in diversen Komponenten von Drittanbietern ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.