Search for packages
| purl | pkg:deb/debian/node-set-value@0.4.0-1%2Bdeb10u1 |
| Next non-vulnerable version | 3.0.1-2+deb11u1 |
| Latest non-vulnerable version | 3.0.1-2+deb11u1 |
| Risk | 4.5 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-cu35-t78a-wfcj
Aliases: CVE-2019-10747 GHSA-4g88-fppr-53pp |
Prototype Pollution in set-value Versions of `set-value` prior to 3.0.1 or 2.0.1 are vulnerable to Prototype Pollution. The `set` function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects. ## Recommendation If you are using `set-value` 3.x, upgrade to version 3.0.1 or later. If you are using `set-value` 2.x, upgrade to version 2.0.1 or later. |
Affected by 0 other vulnerabilities. |
|
VCID-eq42-z92a-ffet
Aliases: CVE-2021-23440 GHSA-4jqc-8m5r-9rpr |
Access of Resource Using Incompatible Type (Type Confusion) This affects the package set-value A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||