{"vulnerability": "cve-2022-2587", "sightings": [{"uuid": "0db172b6-399e-4242-9b8a-7cb3cbd0edc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-25878", "type": "seen", "source": "https://t.me/cibsecurity/65973", "content": "\u203c CVE-2023-36665 \u203c\n\nprotobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.4 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty. NOTE: this CVE Record is about \"Object.constructor.prototype. = ...;\" whereas CVE-2022-25878 was about \"Object.__proto__. = ...;\" instead.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-05T18:21:53.000000Z"}, {"uuid": "f85ac51d-e63d-414c-9563-d532776ae822", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-25875", "type": "seen", "source": "https://t.me/cibsecurity/46081", "content": "\u203c CVE-2022-25875 \u203c\n\nThe package svelte before 3.49.0 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering). Exploiting this vulnerability is possible via objects with a custom toString() function.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-07-12T22:25:27.000000Z"}, {"uuid": "1b0ff052-8f6d-48e1-821e-e31f0c09a2f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-25871", "type": "seen", "source": "https://t.me/cibsecurity/44761", "content": "\u203c CVE-2022-25871 \u203c\n\nAll versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. Note: This vulnerability derives from an incomplete fix of [CVE-2020-7600](https://security.snyk.io/vuln/SNYK-JS-QUERYMEN-559867).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-06-18T00:23:13.000000Z"}, {"uuid": "a20242f3-46ec-4f5c-82a5-92efe6dfdc70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-25872", "type": "seen", "source": "https://t.me/cibsecurity/44762", "content": "\u203c CVE-2022-25872 \u203c\n\nAll versions of package fast-string-search are vulnerable to Out-of-bounds Read due to incorrect memory freeing and length calculation for any non-string input as the source. This allows the attacker to read previously allocated memory.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-06-18T00:23:14.000000Z"}, {"uuid": "a84b3c4a-2c85-4e5e-9039-308657c4dd65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-25878", "type": "seen", "source": "https://t.me/cibsecurity/43506", "content": "\u203c CVE-2022-25878 \u203c\n\nThe package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-05-28T00:15:22.000000Z"}, {"uuid": "1431d5a3-8996-4fbf-a03e-50c8025053b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-25876", "type": "seen", "source": "https://t.me/cibsecurity/45523", "content": "\u203c CVE-2022-25876 \u203c\n\nThe package link-preview-js before 2.1.16 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local network and read the response. This is due to flawed DNS rebinding protection.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-07-02T00:39:49.000000Z"}]}