You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.
mend-bolt-for-githubbot
changed the title
CVE-2020-8116 (Medium) detected in dot-prop-3.0.0.tgz, dot-prop-4.2.0.tgz
CVE-2020-8116 (High) detected in dot-prop-3.0.0.tgz, dot-prop-4.2.0.tgz
Oct 29, 2020
mend-bolt-for-githubbot
changed the title
CVE-2020-8116 (High) detected in dot-prop-3.0.0.tgz, dot-prop-4.2.0.tgz
CVE-2020-8116 (High) detected in dot-prop-4.2.0.tgz, dot-prop-3.0.0.tgz
Oct 29, 2020
mend-bolt-for-githubbot
changed the title
CVE-2020-8116 (High) detected in dot-prop-4.2.0.tgz, dot-prop-3.0.0.tgz
CVE-2020-8116 (High) detected in dot-prop-3.0.0.tgz, dot-prop-4.2.0.tgz
Oct 29, 2020
mend-bolt-for-githubbot
changed the title
CVE-2020-8116 (High) detected in dot-prop-3.0.0.tgz, dot-prop-4.2.0.tgz
CVE-2020-8116 (High) detected in dot-prop-4.2.0.tgz, dot-prop-3.0.0.tgz
Dec 8, 2020
mend-bolt-for-githubbot
changed the title
CVE-2020-8116 (High) detected in dot-prop-4.2.0.tgz, dot-prop-3.0.0.tgz
CVE-2020-8116 (High) detected in dot-prop-3.0.0.tgz, dot-prop-4.2.0.tgz
Dec 8, 2020
mend-bolt-for-githubbot
changed the title
CVE-2020-8116 (High) detected in dot-prop-3.0.0.tgz, dot-prop-4.2.0.tgz
CVE-2020-8116 (High) detected in dot-prop-4.2.0.tgz, dot-prop-3.0.0.tgz
Jan 23, 2021
CVE-2020-8116 - High Severity Vulnerability
dot-prop-4.2.0.tgz
Get, set, or delete a property from a nested object using a dot path
Library home page: https://registry.npmjs.org/dot-prop/-/dot-prop-4.2.0.tgz
Path to dependency file: import-moltin-to-algolia/package.json
Path to vulnerable library: import-moltin-to-algolia/node_modules/npm/node_modules/dot-prop/package.json
Dependency Hierarchy:
dot-prop-3.0.0.tgz
Get, set, or delete a property from a nested object using a dot path
Library home page: https://registry.npmjs.org/dot-prop/-/dot-prop-3.0.0.tgz
Path to dependency file: import-moltin-to-algolia/package.json
Path to vulnerable library: import-moltin-to-algolia/node_modules/dot-prop/package.json
Dependency Hierarchy:
Found in HEAD commit: ccaf5a52d34928cd303fe582d62c1ad6c44f08bf
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.
Publish Date: 2020-02-04
URL: CVE-2020-8116
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8116
Release Date: 2020-02-04
Fix Resolution: dot-prop - 5.1.1
Step up your Open Source Security Game with WhiteSource here
The text was updated successfully, but these errors were encountered: