yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
https://cwe.mitre.org/data/definitions/1321.html →Open in CWE collection →A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.
https://cwe.mitre.org/data/definitions/267.html →Open in CWE collection →In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
https://capec.mitre.org/data/definitions/1.html →Open in CAPEC collection →An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.
https://capec.mitre.org/data/definitions/58.html →Open in CAPEC collection →This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.
https://capec.mitre.org/data/definitions/77.html →Open in CAPEC collection →An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.
https://capec.mitre.org/data/definitions/180.html →Open in CAPEC collection →The adversary exploits the target system's audio and video functionalities through malware or scheduled tasks. The goal is to capture sensitive information about the target for financial, personal, political, or other gains which is accomplished by collecting communication data between two parties via the use of peripheral devices (e.g. microphones and webcams) or applications with audio and video capabilities (e.g. Skype) on a system.
https://capec.mitre.org/data/definitions/634.html →Open in CAPEC collection →The adversary exploits an application that allows for the copying of sensitive data or information by collecting information copied to the clipboard. Data copied to the clipboard can be accessed by other applications, such as malware built to exfiltrate or log clipboard contents on a periodic basis. In this way, the adversary aims to garner information to which they are unauthorized.
https://capec.mitre.org/data/definitions/637.html →Open in CAPEC collection →An adversary discovers connections between systems by exploiting the target system's standard practice of revealing them in searchable, common areas. Through the identification of shared folders/drives between systems, the adversary may further their goals of locating and collecting sensitive information/files, or map potential routes for lateral movement within the network.
https://capec.mitre.org/data/definitions/643.html →Open in CAPEC collection →An adversary gathers sensitive information by exploiting the system's screen capture functionality. Through screenshots, the adversary aims to see what happens on the screen over the course of an operation. The adversary can leverage information gathered in order to carry out further attacks.
https://capec.mitre.org/data/definitions/648.html →Open in CAPEC collection →| Product | Vendor | Status |
|---|---|---|
| node-yargs-parser | Tracked | |
| node-yargs-parser | Tracked | |
| node-yargs-parser | Tracked | |
| node-yargs-parser | Tracked | |
| node-yargs-parser | Tracked | |
| node-yargs-parser | Tracked | |
| node-yargs-parser | Tracked | |
| node-yargs-parser | Tracked | |
| node-yargs-parser | Tracked | |
| node-yargs-parser | Tracked | |
| node-yargs-parser | Tracked | |
| node-yargs-parser | Tracked | |
| node-yargs-parser | Tracked | |
| node-yargs-parser | Tracked | |
| node-yargs-parser | Tracked | |
| node-yargs-parser | Tracked | |
| node-yargs-parser | Tracked | |
| node-yargs-parser | Tracked | |
| nodejs | Tracked | |
| nodejs | Tracked |