CWE-1321 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-1321/ Sun, 26 Feb 2023 06:50:37 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-1321 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-1321/ 32 32 CVE-2018-6195 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-6195/ Sun, 26 Feb 2023 06:50:37 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-6195/ admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator, editor, or author) remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the ‘session’ HTTP GET parameter to wp-admin/upload.php.

The post CVE-2018-6195 appeared first on CVE Vulnerability.

]]> admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator, editor, or author) remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the ‘session’ HTTP GET parameter to wp-admin/upload.php.

The post CVE-2018-6195 appeared first on CVE Vulnerability.

]]> CVE-2018-3721 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-3721/ Sun, 26 Feb 2023 06:49:47 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-3721/ lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of “Object” via __proto__, causing the addition or modification of an existing property that will exist on all objects.

The post CVE-2018-3721 appeared first on CVE Vulnerability.

]]> lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of “Object” via __proto__, causing the addition or modification of an existing property that will exist on all objects.

The post CVE-2018-3721 appeared first on CVE Vulnerability.

]]> CVE-2018-19296 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-19296/ Sun, 26 Feb 2023 06:48:07 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-19296/ PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.

The post CVE-2018-19296 appeared first on CVE Vulnerability.

]]> PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.

The post CVE-2018-19296 appeared first on CVE Vulnerability.

]]> CVE-2018-19274 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-19274/ Sun, 26 Feb 2023 06:48:06 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-19274/ Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions.

The post CVE-2018-19274 appeared first on CVE Vulnerability.

]]> Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions.

The post CVE-2018-19274 appeared first on CVE Vulnerability.

]]> CVE-2018-11135 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-11135/ Sun, 26 Feb 2023 06:45:07 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-11135/ The script ‘/adminui/error_details.php’ in the Quest KACE System Management Appliance 8.0.318 allows authenticated users to conduct PHP object injection attacks.

The post CVE-2018-11135 appeared first on CVE Vulnerability.

]]> The script ‘/adminui/error_details.php’ in the Quest KACE System Management Appliance 8.0.318 allows authenticated users to conduct PHP object injection attacks.

The post CVE-2018-11135 appeared first on CVE Vulnerability.

]]> CVE-2020-8203 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-8203/ Sun, 26 Feb 2023 06:43:18 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-8203/ Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

The post CVE-2020-8203 appeared first on CVE Vulnerability.

]]> Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

The post CVE-2020-8203 appeared first on CVE Vulnerability.

]]> CVE-2020-8158 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-8158/ Sun, 26 Feb 2023 06:43:17 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-8158/ Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.

The post CVE-2020-8158 appeared first on CVE Vulnerability.

]]> Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.

The post CVE-2020-8158 appeared first on CVE Vulnerability.

]]> CVE-2020-8116 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-8116/ Sun, 26 Feb 2023 06:43:16 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-8116/ Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

The post CVE-2020-8116 appeared first on CVE Vulnerability.

]]> Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

The post CVE-2020-8116 appeared first on CVE Vulnerability.

]]> CVE-2020-7768 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-7768/ Sun, 26 Feb 2023 06:43:10 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-7768/ The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition.

The post CVE-2020-7768 appeared first on CVE Vulnerability.

]]> The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition.

The post CVE-2020-7768 appeared first on CVE Vulnerability.

]]> CVE-2020-7770 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-7770/ Sun, 26 Feb 2023 06:43:10 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-7770/ This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution.

The post CVE-2020-7770 appeared first on CVE Vulnerability.

]]> This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution.

The post CVE-2020-7770 appeared first on CVE Vulnerability.

]]>