aswin1906/github-advisory-2021.csv huggingface dataset:
Cloud Foundry Routing Improper Input Validation vulnerability
Published: 2021-05-18T15:31:39Z
Aliases: CVE-2019-11289

Cloud Foundry Routing, all versions before 0.0.0-20191101214924-b1b5c44e050f, does not properly validate nonce input. A remote unauthorized malicious user could forge a route service request using an invalid nonce that will cause the Gorouter to crash.
Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor
Published: 2021-05-18T18:27:50Z
Aliases: CVE-2019-19025

Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows CSRF in the VMware Harbor Container Registry for the Pivotal Platform.
Improper Certificate Validation in xmlhttprequest-ssl
Published: 2021-05-24T19:52:55Z
Aliases: CVE-2021-31597

The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
Cross-Site Request Forgery in OpenNMS Horizon
Published: 2021-05-25T18:46:55Z
Aliases: CVE-2021-25931

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection at `/opennms/admin/userGroupView/users/updateUser`. This flaw allows assigning `ROLE_ADMIN` security role to a normal user. Using this flaw, an attacker can trick the admin user to assign administrator privileges to a normal user by enticing him to click upon an attacker-controlled website.
Integer overflow in TFLite memory allocation
Published: 2021-05-21T14:28:22Z
Aliases: CVE-2021-29605

### Impact
The TFLite code for allocating `TFLiteIntArray`s is [vulnerable to an integer overflow issue](https://github.com/tensorflow/tensorflow/blob/4ceffae632721e52bf3501b736e4fe9d1221cdfa/tensorflow/lite/c/common.c#L24-L27):

```cc
int TfLiteIntArrayGetSizeInBytes(int size) {
  static TfLiteIntArray dummy;
  return sizeof(dummy) + sizeof(dummy.data[0]) * size;
}   
```

An attacker can craft a model such that the `size` multiplier is so large that the return value overflows the `int` datatype and becomes negative. In turn, this results in [invalid value being given to `malloc`](https://github.com/tensorflow/tensorflow/blob/4ceffae632721e52bf3501b736e4fe9d1221cdfa/tensorflow/lite/c/common.c#L47-L52):

```cc
TfLiteIntArray* TfLiteIntArrayCreate(int size) {
  TfLiteIntArray* ret = (TfLiteIntArray*)malloc(TfLiteIntArrayGetSizeInBytes(size));
  ret->size = size; 
  return ret;
}
``` 

In this case, `ret->size` would dereference an invalid pointer.

### Patches
We have patched the issue in GitHub commit [7c8cc4ec69cd348e44ad6a2699057ca88faad3e5](https://github.com/tensorflow/tensorflow/commit/7c8cc4ec69cd348e44ad6a2699057ca88faad3e5).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Cross-Site Request Forgery in MAGMI
Published: 2021-05-06T18:54:41Z
Aliases: CVE-2020-5776

All versions of MAGMI up to and including version 0.7.24 are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI.
Missing Release of Memory after Effective Lifetime in Apache Tika
Published: 2021-05-07T15:53:40Z
Aliases: CVE-2020-9489

A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should upgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were partially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency to org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we upgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.
CHECK-fail in SparseCross due to type confusion
Published: 2021-05-21T14:21:08Z
Aliases: CVE-2021-29519

### Impact
The API of `tf.raw_ops.SparseCross` allows combinations which would result in a `CHECK`-failure and denial of service:

```python
import tensorflow as tf

hashed_output = False
num_buckets = 1949315406
hash_key = 1869835877
out_type = tf.string 
internal_type = tf.string

indices_1 = tf.constant([0, 6], shape=[1, 2], dtype=tf.int64)
indices_2 = tf.constant([0, 0], shape=[1, 2], dtype=tf.int64)
indices = [indices_1, indices_2]

values_1 = tf.constant([0], dtype=tf.int64)
values_2 = tf.constant([72], dtype=tf.int64)
values = [values_1, values_2]

batch_size = 4
shape_1 = tf.constant([4, 122], dtype=tf.int64)
shape_2 = tf.constant([4, 188], dtype=tf.int64)
shapes = [shape_1, shape_2]

dense_1 = tf.constant([188, 127, 336, 0], shape=[4, 1], dtype=tf.int64)
dense_2 = tf.constant([341, 470, 470, 470], shape=[4, 1], dtype=tf.int64)
dense_3 = tf.constant([188, 188, 341, 922], shape=[4, 1], dtype=tf.int64)
denses = [dense_1, dense_2, dense_3]

tf.raw_ops.SparseCross(indices=indices, values=values, shapes=shapes, dense_inputs=denses, hashed_output=hashed_output,
                       num_buckets=num_buckets, hash_key=hash_key, out_type=out_type, internal_type=internal_type)
```

The above code will result in a `CHECK` fail in [`tensor.cc`](https://github.com/tensorflow/tensorflow/blob/3d782b7d47b1bf2ed32bd4a246d6d6cadc4c903d/tensorflow/core/framework/tensor.cc#L670-L675):

```cc
void Tensor::CheckTypeAndIsAligned(DataType expected_dtype) const {
  CHECK_EQ(dtype(), expected_dtype)
      << " " << DataTypeString(expected_dtype) << " expected, got "
      << DataTypeString(dtype());
  ...
}
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/3d782b7d47b1bf2ed32bd4a246d6d6cadc4c903d/tensorflow/core/kernels/sparse_cross_op.cc#L114-L116) is tricked to consider a tensor of type `tstring` which in fact contains integral elements:

```cc
  if (DT_STRING == values_.dtype())
      return Fingerprint64(values_.vec<tstring>().data()[start + n]);
  return values_.vec<int64>().data()[start + n];
```

Fixing the type confusion by preventing mixing `DT_STRING` and `DT_INT64` types solves this issue.

### Patches
We have patched the issue in GitHub commit [b1cc5e5a50e7cee09f2c6eb48eb40ee9c4125025](https://github.com/tensorflow/tensorflow/commit/b1cc5e5a50e7cee09f2c6eb48eb40ee9c4125025).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
JWT leak via Open Redirect in Programmatic access
Published: 2021-05-21T16:24:34Z
Aliases: CVE-2021-29651

### Impact
Using programmatic access on protected sites, one can get a signed login URL with pomerium_redirect_uri set to an arbitrary URL. Then, if the user has already logged into Pomerium, they will be redirected to the specified pomerium_redirect_uri with a JWT attached. This allows an outside attacker to get a signed login URL that, upon visiting it, will redirect a victim to the attacker’s site. This creates an issue of Open Redirect and, more seriously, JWT leakage.

With a leaked JWT, the attacker will be able to unveil the victim’s identity (.e.g. email address) by supplying the JWT to the authenticate service or verify.pomerium.com. In addition, if an application integrating Pomerium only verifies the iss claim and others but not the aud claim, the attacker will be able to access it as the victim.

### Patches
Patched in Pomerium v0.13.4

### For more information
If you have any questions or comments about this advisory
* Open an issue in [pomerium](http://github.com/pomerium/pomerium)
* Email us at [security@pomerium.com](mailto:security@pomerium.com)
Server-Side Request Forgery in node-pdf-generator
Published: 2021-05-10T18:38:34Z
Aliases: CVE-2020-7740

This affects all versions of package node-pdf-generator up to and including 0.0.6. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an SSRF attack.
Division by 0 in `SparseMatMul`
Published: 2021-05-21T14:24:48Z
Aliases: CVE-2021-29557

### Impact
An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.SparseMatMul`:

```python
import tensorflow as tf

a = tf.constant([100.0, 100.0, 100.0, 100.0], shape=[2, 2], dtype=tf.float32)
b = tf.constant([], shape=[0, 2], dtype=tf.float32)

tf.raw_ops.SparseMatMul(
    a=a, b=b, transpose_a=True, transpose_b=True,
    a_is_sparse=True, b_is_sparse=True)
``` 
    
The division by 0 occurs deep in Eigen code because the `b` tensor is empty.
    
### Patches
We have patched the issue in GitHub commit [7f283ff806b2031f407db64c4d3edcda8fb9f9f5](https://github.com/tensorflow/tensorflow/commit/7f283ff806b2031f407db64c4d3edcda8fb9f9f5).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Improper Input Validation in sanitize-html
Published: 2021-05-06T16:10:19Z
Aliases: CVE-2021-26540

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\\example.com".
Cross-site Scripting in PrimeFaces
Published: 2021-05-07T16:16:30Z
Aliases: CVE-2020-10544

An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces 7.0.11. In a web application using PrimeFaces, an attacker can provide JavaScript code in an input field whose data is later used as a tooltip title without any input validation.
Regular Expression Denial of Service in hosted-git-info
Published: 2021-05-06T16:10:39Z
Aliases: CVE-2021-23362

The npm package `hosted-git-info` before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity
Incorrect Authorization in Spring Cloud Netflix Zuul
Published: 2021-05-10T15:18:50Z
Aliases: CVE-2021-22113

Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing the “Sensitive Headers” restriction when executing requests with specially constructed URLs. Applications that use Spring Security's StrictHttpFirewall (enabled by default for all URLs) are not affected by the vulnerability, as they reject requests that allow bypassing.
Prototype pollution in chart.js
Published: 2021-05-10T18:47:53Z
Aliases: CVE-2020-7746

This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options (or the defaults options) are deeply merged with provided options. However, during this operation, the keys of the object being set are not checked, leading to a prototype pollution.
Open Redirect in Liferay Portal
Published: 2021-05-07T15:54:54Z
Aliases: CVE-2020-24554

The redirect module in Liferay Portal before 7.3.3 does not limit the number of URLs resulting in a 404 error that is recorded, which allows remote attackers to perform a denial of service attack by making repeated requests for pages that do not exist.
Server-side request forgery in Ghost CMS
Published: 2021-05-06T18:28:08Z
Aliases: CVE-2020-8134

Server-side request forgery (SSRF) vulnerability in Ghost CMS < 3.10.0 allows an attacker to scan local or external network or otherwise interact with internal systems.
Crash due to malformed relay protocol message
Published: 2021-05-21T16:23:17Z
Aliases: CVE-2021-21404

### Impact

1. `syncthing` can be caused to crash and exit if sent a malformed relay
   protocol message message with a negative length field.

2. The relay server `strelaysrv` can be caused to crash and exit if sent
   a malformed relay protocol message with a negative length field.

At no point is sensitive data exposed or liable to be altered due to this
issue. Sensitive data is never exposed to relay operators. Syncthing itself
would need to be lured to connect to a malicious relay server in order to
exploit the issue.

### Patches

Fixed in version 1.15.0.

### Workarounds

1. No known workaround for `strelaysrv`.

2. `syncthing` can be configured to not use relays, or to only use specific,
   trusted relays. If Syncthing is used in a closed environment or with
   relaying disabled, i.e., it does not communicate with unknown relays,
   Syncthing is not vulnerable.

### For more information

If you have any questions or comments about this advisory, please discuss it [on the forum](https://forum.syncthing.net/).

Thanks to Wojciech Paciorek for discovering and reporting this issue.
Prototype Pollution in tiny-conf
Published: 2021-05-10T15:59:24Z
Aliases: CVE-2020-7724

All versions of package tiny-conf up to and including version 1.1.0 are vulnerable to Prototype Pollution via the set function.
Division by 0 in `Conv2D`
Published: 2021-05-21T14:21:55Z
Aliases: CVE-2021-29526

### Impact
An attacker can trigger a division by 0 in `tf.raw_ops.Conv2D`:

```python
import tensorflow as tf

input = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.float32)
filter = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.float32)

strides = [1, 1, 1, 1]
padding = "SAME"
                               
tf.raw_ops.Conv2D(input=input, filter=filter, strides=strides, padding=padding)
```                            
                               
This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/988087bd83f144af14087fe4fecee2d250d93737/tensorflow/core/kernels/conv_ops.cc#L261-L263) does a division by a quantity that is controlled by the caller:
```cc
  const int64 patch_depth = filter.dim_size(2);
  if (in_depth % patch_depth != 0) { ... }
```
  
### Patches
We have patched the issue in GitHub commit [b12aa1d44352de21d1a6faaf04172d8c2508b42b](https://github.com/tensorflow/tensorflow/commit/b12aa1d44352de21d1a6faaf04172d8c2508b42b).
  
The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution 
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
OS Command Injection in pulverizr
Published: 2021-05-07T16:20:44Z
Aliases: CVE-2020-7604

pulverizr through 0.7.0 allows execution of arbitrary commands. Within `lib/job.js`, the variable `filename` can be controlled by the attacker. This function uses the variable &quot;filename&quot; to construct the argument of the exec call without any sanitization. In order to successfully exploit this vulnerability, an attacker will need to create a new file with the same name as the attack command.
Division by zero in TFLite's implementation of hashtable lookup
Published: 2021-05-21T14:28:19Z
Aliases: CVE-2021-29604

### Impact
The TFLite implementation of hashtable lookup is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/1a8e885b864c818198a5b2c0cbbeca5a1e833bc8/tensorflow/lite/kernels/hashtable_lookup.cc#L114-L115):

```cc
const int num_rows = SizeOfDimension(value, 0); 
const int row_bytes = value->bytes / num_rows; 
```

An attacker can craft a model such that `values`'s first dimension would be 0.

### Patches
We have patched the issue in GitHub commit [5117e0851348065ed59c991562c0ec80d9193db2](https://github.com/tensorflow/tensorflow/commit/5117e0851348065ed59c991562c0ec80d9193db2).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information 
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
OS Command Injection in node-prompt-here
Published: 2021-05-07T16:16:16Z
Aliases: CVE-2020-7602

node-prompt-here through 1.0.1 allows execution of arbitrary commands. The `runCommand()` is called by `getDevices()` function in file `linux/manager.js`, which is required by the `index. process.env.NM_CLI` in the file `linux/manager.js`. This function is used to construct the argument of function `execSync()`, which can be controlled by users without any sanitization.
xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection
Published: 2021-05-04T18:02:34Z
Aliases: CVE-2020-28502

This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (`async=False` on `xhr.open`), malicious user input flowing into `xhr.send` could result in arbitrary code being injected and run.
Prototype Pollution in phpjs
Published: 2021-05-06T17:28:46Z
Aliases: CVE-2020-7700

All versions of phpjs up to and including 1.3.2 are vulnerable to Prototype Pollution via parse_str. phpjs is no longer maintained and users are advised to use Locutus as a replacement (https://github.com/locutusjs/locutus)
Division by zero in TFLite's implementation of Split
Published: 2021-05-21T14:28:01Z
Aliases: CVE-2021-29599

### Impact
The implementation of the `Split` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/e2752089ef7ce9bcf3db0ec618ebd23ea119d0c7/tensorflow/lite/kernels/split.cc#L63-L65):

```cc
TF_LITE_ENSURE_MSG(context, input_size % num_splits == 0, "Not an even split");
const int slice_size = input_size / num_splits;
```

An attacker can craft a model such that `num_splits` would be 0.

### Patches
We have patched the issue in GitHub commit [b22786e7e9b7bdb6a56936ff29cc7e9968d7bc1d](https://github.com/tensorflow/tensorflow/commit/b22786e7e9b7bdb6a56936ff29cc7e9968d7bc1d).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Infinite loop in Apache Tika
Published: 2021-05-10T15:23:25Z
Aliases: CVE-2021-28657

A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.
Prototype pollution in json8
Published: 2021-05-10T19:17:05Z
Aliases: CVE-2020-7770

This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution.
Uncontrolled Resource Consumption in firebase
Published: 2021-05-18T01:57:24Z
Aliases: CVE-2020-7765

This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.
Heap OOB read in `tf.raw_ops.Dequantize`
Published: 2021-05-21T14:26:32Z
Aliases: CVE-2021-29582

### Impact
Due to lack of validation in `tf.raw_ops.Dequantize`, an attacker can trigger a read from outside of bounds of heap allocated data:

```python
import tensorflow as tf

input_tensor=tf.constant(
  [75, 75, 75, 75, -6, -9, -10, -10, -10, -10, -10, -10, -10, -10, -10, -10,\
  -10, -10, -10, -10, -10, -10, -10, -10, -10, -10, -10, -10, -10, -10, -10,\
  -10, -10, -10, -10, -10, -10, -10, -10, -10, -10, -10, -10, -10, -10, -10,\
  -10, -10, -10, -10], shape=[5, 10], dtype=tf.int32)
input_tensor=tf.cast(input_tensor, dtype=tf.quint8)
min_range = tf.constant([-10], shape=[1], dtype=tf.float32)
max_range = tf.constant([24, 758, 758, 758, 758], shape=[5], dtype=tf.float32)
  
tf.raw_ops.Dequantize( 
  input=input_tensor, min_range=min_range, max_range=max_range, mode='SCALED',
  narrow_range=True, axis=0, dtype=tf.dtypes.float32)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/26003593aa94b1742f34dc22ce88a1e17776a67d/tensorflow/core/kernels/dequantize_op.cc#L106-L131) accesses the `min_range` and `max_range` tensors in parallel but fails to check that they have the same shape:

```cc
if (num_slices == 1) {
  const float min_range = input_min_tensor.flat<float>()(0);
  const float max_range = input_max_tensor.flat<float>()(0);
  DequantizeTensor(ctx, input, min_range, max_range, &float_output);
} else {
  ...
  auto min_ranges = input_min_tensor.vec<float>();
  auto max_ranges = input_max_tensor.vec<float>();
  for (int i = 0; i < num_slices; ++i) {
    DequantizeSlice(ctx->eigen_device<Device>(), ctx,
                    input_tensor.template chip<1>(i), min_ranges(i),
                    max_ranges(i), output_tensor.template chip<1>(i));
    ...
  }
}
```

### Patches
We have patched the issue in GitHub commit [5899741d0421391ca878da47907b1452f06aaf1b](https://github.com/tensorflow/tensorflow/commit/5899741d0421391ca878da47907b1452f06aaf1b).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Prototype Pollution in backbone-query-parameters
Published: 2021-05-06T15:52:02Z
Aliases: CVE-2021-20085

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in backbone-query-parameters 0.4.0 allows a malicious user to inject properties into Object.prototype.