https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 06:18:23 +0000 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0428 certfr-2023-avi-0428 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0428 https://cve.radiocsirt.org/vuln/euvd-2026-18859 EUVD-2026-18859 https://cve.radiocsirt.org/vuln/euvd-2026-18859 https://cve.radiocsirt.org/vuln/fkie_cve-2022-37616 <p>A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states &#34;we are in the process of marking this report as invalid&#34;; however, some third parties takes the position that &#34;A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted.&#34;</p> <p>A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states &#34;we are in the process of marking this report as invalid&#34;; however, some third parties takes the position that &#34;A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted.&#34;</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-37616 https://cve.radiocsirt.org/vuln/ghsa-9pgh-qqpf-7wqj <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> npm: @xmldom/xmldom, npm: xmldom</p> <p>## Withdrawn</p> <p>This advisory has been withdrawn because the maintainers of `@xmldom/xmldom` and multiple third parties disputed the validity of the issue. Attempts to create or replicate a proof of concept have been unsuccessful.</p> <p>## Original Description</p> <p>### Impact A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package.</p> <p>### Patches Update to `@xmldom/xmldom@~0.7.6`, `@xmldom/xmldom@~0.8.3` (dist-tag `latest`) or `@xmldom/xmldom@&gt;=0.9.0-beta.2` (dist-tag `next`).</p> <p>### Workarounds None</p> <p>### References https://github.com/xmldom/xmldom/pull/437</p> <p>### For more information If you have any questions or comments about this advisory: * Email us at security@xmldom.org * Add information to https://github.com/xmldom/xmldom/issues/436</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> npm: @xmldom/xmldom, npm: xmldom</p> <p>## Withdrawn</p> <p>This advisory has been withdrawn because the maintainers of `@xmldom/xmldom` and multiple third parties disputed the validity of the issue. Attempts to create or replicate a proof of concept have been unsuccessful.</p> <p>## Original Description</p> <p>### Impact A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package.</p> <p>### Patches Update to `@xmldom/xmldom@~0.7.6`, `@xmldom/xmldom@~0.8.3` (dist-tag `latest`) or `@xmldom/xmldom@&gt;=0.9.0-beta.2` (dist-tag `next`).</p> <p>### Workarounds None</p> <p>### References https://github.com/xmldom/xmldom/pull/437</p> <p>### For more information If you have any questions or comments about this advisory: * Email us at security@xmldom.org * Add information to https://github.com/xmldom/xmldom/issues/436</p> https://cve.radiocsirt.org/vuln/ghsa-9pgh-qqpf-7wqj https://cve.radiocsirt.org/vuln/gsd-2022-37616 gsd-2022-37616 https://cve.radiocsirt.org/vuln/gsd-2022-37616 https://cve.radiocsirt.org/vuln/msrc_cve-2022-37616 msrc_CVE-2022-37616 https://cve.radiocsirt.org/vuln/msrc_cve-2022-37616 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-37616 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: node-xmldom, Ubuntu:22.04:LTS: node-xmldom</p> <p>A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states &#34;we are in the process of marking this report as invalid&#34;; however, some third parties takes the position that &#34;A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted.&#34;</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: node-xmldom, Ubuntu:22.04:LTS: node-xmldom</p> <p>A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states &#34;we are in the process of marking this report as invalid&#34;; however, some third parties takes the position that &#34;A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted.&#34;</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-37616 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-2368 <p>Ein Angreifer kann mehrere Schwachstellen in HCL BigFix ausnutzen, um die Verfügbarkeit, die Vertraulichkeit und die Integrität zu gefährden.</p> <p>Ein Angreifer kann mehrere Schwachstellen in HCL BigFix ausnutzen, um die Verfügbarkeit, die Vertraulichkeit und die Integrität zu gefährden.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2022-2368