All versions of package tiny-conf are vulnerable to Prototype Pollution via the set function.
All versions of package promisehelpers are vulnerable to Prototype Pollution via the insert function.
All versions of package nodee-utils are vulnerable to Prototype Pollution via the deepSet function.
All versions of package node-oojs are vulnerable to Prototype Pollution via the setPath function.
The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.
Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function.
All versions of package gammautils are vulnerable to Prototype Pollution via the deepSet and deepMerge functions.
All versions of package dot-notes are vulnerable to Prototype Pollution via the create function.
All versions of package deeps are vulnerable to Prototype Pollution via the set function.
All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function.
All versions of package confucious are vulnerable to Prototype Pollution via the set function.
All versions of package arr-flatten-unflatten are vulnerable to Prototype Pollution via the constructor.
NETGEAR R8300 devices before 1.0.2.134 are affected by command injection by an unauthenticated attacker.
An issue was discovered on LG mobile devices with Android OS 9 and 10 software. LGTelephonyProvider allows a bypass of intended privilege restrictions. The LG ID is LVE-SMP-200017 (July 2020).
An issue was discovered on LG mobile devices with Android OS 9 and 10 software on the VZW network. lge_property allows property overwrites. The LG ID is LVE-SMP-200016 (July 2020).
An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9, and 10 software. The network_management service does not properly restrict configuration changes. The LG ID is LVE-SMP-200012 (July 2020).
An issue was discovered on LG mobile devices with Android OS 10 software. MDMService does not properly restrict APK installations. The LG ID is LVE-SMP-200011 (July 2020).
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The persona service allows attackers (who control an unprivileged SecureFolder process) to bypass admin restrictions in KnoxContainer. The Samsung ID is SVE-2020-18133 (August 2020).
An issue was discovered on Samsung mobile devices with software through 2020-04-02 (Exynos modem chipsets). There is a heap-based buffer over-read in the Shannon baseband. The Samsung ID is SVE-2020-17239 (August 2020).
An issue was discovered on Samsung mobile devices with Q(10.0) (exynos9830 chipsets) software. RKP allows arbitrary code execution. The Samsung ID is SVE-2020-17435 (August 2020).