Kind Of
1 CVEs
product
Monthly
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Information Disclosure
Kind Of
NVD
GitHub
CVSS 3.1
7.5
EPSS
2.3%
CVE-2019-20149
npm
EPSS 2%
CVSS 7.5
HIGH
POC
PATCH
This Week
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Information Disclosure
Kind Of
NVD
GitHub