Filtered by vendor Merge Project
Subscribe
Total
4 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-3645 | 1 Merge Project | 1 Merge | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
|
merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
|
|||||
| CVE-2021-23397 | 1 Merge Project | 1 Merge | 2024-11-21 | N/A | 5.6 MEDIUM |
|
All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @generates/merger instead.
|
|||||
| CVE-2020-28499 | 1 Merge Project | 1 Merge | 2024-11-21 | 7.5 HIGH | 7.3 HIGH |
|
All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .
|
|||||
| CVE-2018-16469 | 1 Merge Project | 1 Merge | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
|
The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects allowing for a denial of service attack.
|
|||||