Most recent entries from all

EUVD-2026-183934

fkie_cve-2022-25645

All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains __proto__, constructor or protorype. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution.

GHSA-23wx-cgxq-vpwx — Prototype Pollution in dset

Affected: npm: dset, Maven: org.webjars.npm:dset

All versions of `dset` prior to 3.1.2 are vulnerable to Prototype Pollution via `dset/merge` mode, as the `dset` function checks for prototype pollution by validating if the top-level path contains `__proto__`, `constructor` or `prototype`. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution.

gsd-2022-25645

RHSA-2022:5201 — Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.4.5 security updates and bug fixes

golang.org/x/crypto: empty plaintext packet causes panic nconf: Prototype pollution in memory store golang: crypto/elliptic: IsOnCurve returns true for invalid field elements nats-server: misusing the "dynamically provisioned sandbox accounts" feature authenticated user can obtain the privileges of the System account Moment.js: Path traversal in moment.locale dset: Prototype Pollution in dset golang: syscall: faccessat checks wrong group go-getter: writes SSH credentials into logfile, exposing sensitive credentials to local uses

WID-SEC-W-2022-0491 — Red Hat Advanced Cluster Management: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Advanced Cluster Management ausnutzen, um Daten zu manipulieren, einen Denial of Service zu verursachen oder Informationen offenzulagen.