Command Injection in lodash

Description

References

• nvd.nist.gov/vuln/detail/CVE-2021-23337 · ADVISORY
• lodash/lodash commit 3469357 · WEB
• oracle.com/security-alerts/cpuoct2021.html · WEB
• oracle.com/security-alerts/cpujul2022.html · WEB
• oracle.com/security-alerts/cpujan2022.html · WEB
• oracle.com//security-alerts/cpujul2021.html · WEB
• snyk.io/vuln/SNYK-JS-LODASH-1040724 · WEB
• snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929 · WEB
• snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931 · WEB
• snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928 · WEB
• snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930 · WEB
• snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932

lodash-rails 的其他漏洞

• CVE-2020-28500中危 5.3Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions…
• CVE-2020-8203高危 7.4Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
• CVE-2019-10744严重 9.1Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modif…
• CVE-2019-1010266中危 6.5lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date…
• CVE-2018-16487中危 5.6A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into …