CVEs-PoC/2018/CVE-2018-16487.md

CVE-2018-16487

Description

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

POC

Reference

• https://hackerone.com/reports/380873

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/Fallout93/Prototype
• https://github.com/HotDB-Community/HotDB-Engine
• https://github.com/Kirill89/prototype-pollution-explained
• https://github.com/KorayAgaya/TrivyWeb
• https://github.com/LucaBrembilla/PrototypePollutionChatBot
• https://github.com/Mohzeela/external-secret
• https://github.com/alphaSeclab/sec-daily-2019
• https://github.com/bunji2/NodeJS_Security_Best_Practice_JA
• https://github.com/chkp-dhouari/CloudGuard-ShiftLeft-CICD
• https://github.com/dcambronero/shiftleft
• https://github.com/duckstroms/Web-CTF-Cheatsheet
• https://github.com/endorama/CsvToL10nJson
• https://github.com/nilsujma-dev/CloudGuard-ShiftLeft-CICD
• https://github.com/ossf-cve-benchmark/CVE-2018-16487
• https://github.com/p3sky/Cloudguard-Shifleft-CICD
• https://github.com/puryersc/shiftleftv2
• https://github.com/puryersc/shiftleftv3
• https://github.com/puryersc/shiftleftv4
• https://github.com/rjenkinsjr/lufo
• https://github.com/seal-community/patches
• https://github.com/siddharthraopotukuchi/trivy
• https://github.com/simiyo/trivy
• https://github.com/t31m0/Vulnerability-Scanner-for-Containers
• https://github.com/umahari/security
• https://github.com/w181496/Web-CTF-Cheatsheet