All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains __proto__, constructor or protorype. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution.

Affected: npm: dset, Maven: org.webjars.npm:dset

All versions of `dset` prior to 3.1.2 are vulnerable to Prototype Pollution via `dset/merge` mode, as the `dset` function checks for prototype pollution by validating if the top-level path contains `__proto__`, `constructor` or `prototype`. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution.

golang.org/x/crypto: empty plaintext packet causes panic nconf: Prototype pollution in memory store golang: crypto/elliptic: IsOnCurve returns true for invalid field elements nats-server: misusing the "dynamically provisioned sandbox accounts" feature authenticated user can obtain the privileges of the System account Moment.js: Path traversal in moment.locale dset: Prototype Pollution in dset golang: syscall: faccessat checks wrong group go-getter: writes SSH credentials into logfile, exposing sensitive credentials to local uses

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Advanced Cluster Management ausnutzen, um Daten zu manipulieren, einen Denial of Service zu verursachen oder Informationen offenzulagen.