Most recent entries from all

bdu:2019-02911

certfr-2021-avi-951 — De multiples vulnérabilités ont été découvertes dans le noyau Linux de RedHat. Certaines d'entre elles permettent à un…

certfr-2021-avi-951

cnvd-2019-25451

EUVD-2026-53912

fkie_cve-2019-10744

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

GHSA-jf85-cpcp-j695 — Prototype Pollution in lodash

Affected: npm: lodash, npm: lodash-es, npm: lodash-amd, npm: lodash.defaultsdeep, RubyGems: lodash-rails

Versions of `lodash` before 4.17.12 are vulnerable to Prototype Pollution. The function `defaultsDeep` allows a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing property that will exist on all objects.

## Recommendation

Update to version 4.17.12 or later.

gsd-2019-10744

RHSA-2019:3024 — Red Hat Security Advisory: ovirt-web-ui security and bug fix update

bootstrap: XSS in the tooltip or popover data-template attribute nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection

Withdrawn: UBUNTU-CVE-2019-10744

Withdrawn by the publisher.

Affected: Ubuntu:20.04:LTS: node-lodash

WID-SEC-W-2023-1350 — Splunk Splunk Enterprise: Mehrere Schwachstellen in Komponenten von Drittanbietern

Ein Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise in diversen Komponenten von Drittanbietern ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.