Common Weakness Enumeration

CWE-843

Allowed

Access of Resource Using Incompatible Type ('Type Confusion')

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

1281 vulnerabilities reference this CWE, most recent first.

GHSA-89VP-X45C-52CQ

Vulnerability from github – Published: 2026-10-07 20:23 – Updated: 2026-10-07 20:23
VLAI
Summary
Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service
Details

Summary

A DOM Clobbering vulnerability exists in Quasar's openURL() utility when handling the iOS SafariViewController bridge.

The vulnerable implementation only checks whether window.SafariViewController exists before invoking it as a native bridge object. An attacker who can inject HTML content containing a named element such as <a id="SafariViewController"> can cause the browser to expose that element as window.SafariViewController.

When openURL() is later called in an iOS environment, Quasar incorrectly treats the DOM element as the native bridge object and attempts to invoke bridge methods that do not exist, resulting in:

TypeError: window.SafariViewController.isAvailable is not a function

This can cause client-side denial of service and break navigation-related workflows in Quasar applications.

Details

Quasar provides the openURL() utility to open external URLs. On iOS platforms, this utility supports integration with the native SafariViewController bridge.

The vulnerable code is located in:

ui/src/utils/open-url/open-url.js
````

The affected logic is:

```javascript
if (Platform.is.ios && window.SafariViewController !== void 0) {
  window.SafariViewController.isAvailable(available => {
    if (available) {
      window.SafariViewController.show({ url }, noop, reject)
    }
  })
}
````

The issue is that Quasar only verifies that `window.SafariViewController` is not `undefined`. It does not verify whether the value is the expected native bridge object or whether required methods such as `isAvailable()` and `show()` are valid functions.

Modern browsers expose elements with specific `id` or `name` attributes as properties of the global `window` object. Therefore, attacker-controlled HTML such as:

```html
<a id="SafariViewController"></a>

can cause:

window.SafariViewController

to resolve to an HTMLAnchorElement instead of the expected native bridge object.

When Quasar later executes:

window.SafariViewController.isAvailable(...)

the DOM element is incorrectly treated as the bridge object, causing:

TypeError: window.SafariViewController.isAvailable is not a function

The root cause is insufficient validation of browser-controlled global properties before using them as trusted native bridge objects.

The vulnerability was verified through the Quasar QEditor rendering path. When attacker-controlled HTML content is rendered into the DOM and creates the SafariViewController named element, subsequent calls to openURL() fail.

Additional component-level affected paths were identified in QSelect and QChatMessage when applications enable HTML rendering features and provide attacker-controlled content. These paths require specific application configurations and were not used as the primary end-to-end reproduction.

PoC

Steps to reproduce

  1. Render attacker-controlled HTML content through a Quasar HTML rendering component such as QEditor.
  2. Insert the following payload:
<a id="SafariViewController" href="#bridge">
  SafariViewController
</a>
````

3. Verify that the browser exposes the element as a global property:   

```javascript
window.SafariViewController

The value resolves to the injected DOM element instead of the expected native bridge object.

  1. Trigger a normal workflow that invokes: 
openURL('https://example.com')
  1. Observe the browser console output: 
TypeError: window.SafariViewController.isAvailable is not a function

The URL opening workflow fails because Quasar attempts to invoke native bridge methods on the DOM element.

The same underlying issue can also affect other HTML rendering paths such as QSelect and QChatMessage when attacker-controlled HTML is rendered and the application later calls openURL().

Impact

This vulnerability is a client-side DOM Clobbering and type confusion issue affecting Quasar applications that use the iOS SafariViewController integration. An attacker who can control HTML content rendered into the application DOM may cause Quasar's openURL() functionality to fail by replacing the expected native bridge object with a DOM element through browser named property resolution.

Potentially affected workflows include external URL navigation, OAuth/login redirects, help or documentation links, payment flows, third-party service redirects, and other application actions that rely on URL opening functionality.

The confirmed impact is client-side denial of service and navigation or workflow disruption. When the vulnerable condition is triggered, Quasar throws an exception while attempting to invoke methods on the clobbered SafariViewController object, preventing the expected URL opening behavior.

Severity
3.1 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.32.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "quasar"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.32.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-106101"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-843"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T20:23:47Z",
    "nvd_published_at": "2026-10-06T17:17:24Z",
    "severity": "LOW"
  },
  "details": "### Summary\n\nA DOM Clobbering vulnerability exists in Quasar\u0027s `openURL()` utility when handling the iOS `SafariViewController` bridge.\n\nThe vulnerable implementation only checks whether `window.SafariViewController` exists before invoking it as a native bridge object. An attacker who can inject HTML content containing a named element such as `\u003ca id=\"SafariViewController\"\u003e` can cause the browser to expose that element as `window.SafariViewController`.\n\nWhen `openURL()` is later called in an iOS environment, Quasar incorrectly treats the DOM element as the native bridge object and attempts to invoke bridge methods that do not exist, resulting in:\n\n```\nTypeError: window.SafariViewController.isAvailable is not a function\n```\n\nThis can cause client-side denial of service and break navigation-related workflows in Quasar applications.\n\n### Details\n\nQuasar provides the `openURL()` utility to open external URLs. On iOS platforms, this utility supports integration with the native `SafariViewController` bridge.\n\nThe vulnerable code is located in:\n\n```\nui/src/utils/open-url/open-url.js\n````\n\nThe affected logic is:\n\n```javascript\nif (Platform.is.ios \u0026\u0026 window.SafariViewController !== void 0) {\n  window.SafariViewController.isAvailable(available =\u003e {\n    if (available) {\n      window.SafariViewController.show({ url }, noop, reject)\n    }\n  })\n}\n````\n\nThe issue is that Quasar only verifies that `window.SafariViewController` is not `undefined`. It does not verify whether the value is the expected native bridge object or whether required methods such as `isAvailable()` and `show()` are valid functions.\n\nModern browsers expose elements with specific `id` or `name` attributes as properties of the global `window` object. Therefore, attacker-controlled HTML such as:\n\n```html\n\u003ca id=\"SafariViewController\"\u003e\u003c/a\u003e\n```\n\ncan cause:\n\n```javascript\nwindow.SafariViewController\n```\n\nto resolve to an `HTMLAnchorElement` instead of the expected native bridge object.\n\nWhen Quasar later executes:\n\n```javascript\nwindow.SafariViewController.isAvailable(...)\n```\n\nthe DOM element is incorrectly treated as the bridge object, causing:\n\n```\nTypeError: window.SafariViewController.isAvailable is not a function\n```\n\nThe root cause is insufficient validation of browser-controlled global properties before using them as trusted native bridge objects.\n\nThe vulnerability was verified through the Quasar `QEditor` rendering path. When attacker-controlled HTML content is rendered into the DOM and creates the `SafariViewController` named element, subsequent calls to `openURL()` fail.\n\nAdditional component-level affected paths were identified in `QSelect` and `QChatMessage` when applications enable HTML rendering features and provide attacker-controlled content. These paths require specific application configurations and were not used as the primary end-to-end reproduction.\n\n### PoC\n\n#### Steps to reproduce\n\n1. Render attacker-controlled HTML content through a Quasar HTML rendering component such as `QEditor`.\n2. Insert the following payload:\n```html\n\u003ca id=\"SafariViewController\" href=\"#bridge\"\u003e\n  SafariViewController\n\u003c/a\u003e\n````\n\n3. Verify that the browser exposes the element as a global property:   \n\n```javascript\nwindow.SafariViewController\n```\n\nThe value resolves to the injected DOM element instead of the expected native bridge object.\n\n4. Trigger a normal workflow that invokes:    \n\n```javascript\nopenURL(\u0027https://example.com\u0027)\n```\n\n5. Observe the browser console output:    \n\n```\nTypeError: window.SafariViewController.isAvailable is not a function\n```\n\nThe URL opening workflow fails because Quasar attempts to invoke native bridge methods on the DOM element.\n\nThe same underlying issue can also affect other HTML rendering paths such as `QSelect` and `QChatMessage` when attacker-controlled HTML is rendered and the application later calls `openURL()`.\n\n### Impact\n\nThis vulnerability is a client-side DOM Clobbering and type confusion issue affecting Quasar applications that use the iOS `SafariViewController` integration. An attacker who can control HTML content rendered into the application DOM may cause Quasar\u0027s `openURL()` functionality to fail by replacing the expected native bridge object with a DOM element through browser named property resolution.\n\nPotentially affected workflows include external URL navigation, OAuth/login redirects, help or documentation links, payment flows, third-party service redirects, and other application actions that rely on URL opening functionality.\n\nThe confirmed impact is client-side denial of service and navigation or workflow disruption. When the vulnerable condition is triggered, Quasar throws an exception while attempting to invoke methods on the clobbered `SafariViewController` object, preventing the expected URL opening behavior.",
  "id": "GHSA-89vp-x45c-52cq",
  "modified": "2026-10-07T20:23:47Z",
  "published": "2026-10-07T20:23:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-89vp-x45c-52cq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106101"
    },
    {
      "type": "WEB",
      "url": "https://github.com/quasarframework/quasar/commit/52d874bf55309dd3656fb02aed033ab025d477ec"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/quasarframework/quasar"
    },
    {
      "type": "WEB",
      "url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.32.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service"
}

GHSA-89W4-V286-M7R9

Vulnerability from github – Published: 2025-09-09 18:31 – Updated: 2025-09-09 18:31
VLAI
Details

Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.

Severity
6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-54094"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-843"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-09T17:15:53Z",
    "severity": "MODERATE"
  },
  "details": "Access of resource using incompatible type (\u0027type confusion\u0027) in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.",
  "id": "GHSA-89w4-v286-m7r9",
  "modified": "2025-09-09T18:31:20Z",
  "published": "2025-09-09T18:31:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54094"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54094"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8CGQ-MF9J-MHPV

Vulnerability from github – Published: 2022-05-24 19:01 – Updated: 2022-05-24 19:01
VLAI
Details

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the the handling of app.media objects. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process Was ZDI-CAN-13333.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-31461"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-843"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-05-07T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the the handling of app.media objects. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process Was ZDI-CAN-13333.",
  "id": "GHSA-8cgq-mf9j-mhpv",
  "modified": "2022-05-24T19:01:42Z",
  "published": "2022-05-24T19:01:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31461"
    },
    {
      "type": "WEB",
      "url": "https://www.foxitsoftware.com/support/security-bulletins.php"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-550"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-8FFR-Q7J8-H445

Vulnerability from github – Published: 2022-05-24 16:50 – Updated: 2025-10-22 00:31
VLAI
Details

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-11707"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-843"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-07-23T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR \u003c 60.7.1, Firefox \u003c 67.0.3, and Thunderbird \u003c 60.7.2.",
  "id": "GHSA-8ffr-q7j8-h445",
  "modified": "2025-10-22T00:31:43Z",
  "published": "2022-05-24T16:50:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11707"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1544386"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201908-12"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11707"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2019-18"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2019-20"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8FMQ-PFXF-6HMC

Vulnerability from github – Published: 2026-10-07 00:31 – Updated: 2026-10-07 00:31
VLAI
Details

In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.

Severity
3.6 (Low)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-106587"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-843"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-06T22:17:06Z",
    "severity": "LOW"
  },
  "details": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.",
  "id": "GHSA-8fmq-pfxf-6hmc",
  "modified": "2026-10-07T00:31:36Z",
  "published": "2026-10-07T00:31:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106587"
    },
    {
      "type": "WEB",
      "url": "https://www.openssh.org/releasenotes.html#10.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8FWF-6328-M3PR

Vulnerability from github – Published: 2022-05-24 17:03 – Updated: 2022-05-24 17:03
VLAI
Details

Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-13764"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-843"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-12-10T22:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
  "id": "GHSA-8fwf-6328-m3pr",
  "modified": "2022-05-24T17:03:05Z",
  "published": "2022-05-24T17:03:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13764"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2019:4238"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html"
    },
    {
      "type": "WEB",
      "url": "https://crbug.com/1028863"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2Z5M4FPUMDNX2LDPHJKN5ZV5GIS2AKNU"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N5CIQCVS6E3ULJCNU7YJXJPO2BLQZDTK"
    },
    {
      "type": "WEB",
      "url": "https://seclists.org/bugtraq/2020/Jan/27"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202003-08"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2020/dsa-4606"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8FWW-GXXH-7H5F

Vulnerability from github – Published: 2022-05-24 17:22 – Updated: 2022-05-24 17:22
VLAI
Details

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-8250"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-843"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-07-06T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .",
  "id": "GHSA-8fww-gxxh-7h5f",
  "modified": "2022-05-24T17:22:25Z",
  "published": "2022-05-24T17:22:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8250"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/acrobat/apsb19-41.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-8FXW-MFFQ-432C

Vulnerability from github – Published: 2025-07-02 18:30 – Updated: 2025-07-02 18:30
VLAI
Details

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-49713"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-843"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-02T18:15:24Z",
    "severity": "HIGH"
  },
  "details": "Access of resource using incompatible type (\u0027type confusion\u0027) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
  "id": "GHSA-8fxw-mffq-432c",
  "modified": "2025-07-02T18:30:38Z",
  "published": "2025-07-02T18:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49713"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49713"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8G8J-CRRV-VM86

Vulnerability from github – Published: 2025-11-28 03:30 – Updated: 2025-11-28 03:30
VLAI
Details

Permission control vulnerability in the memory management module. Impact: Successful exploitation of this vulnerability may affect confidentiality.

Severity
9.3 (Critical)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-64314"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-843"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-28T03:16:00Z",
    "severity": "CRITICAL"
  },
  "details": "Permission control vulnerability in the memory management module.\nImpact: Successful exploitation of this vulnerability may affect confidentiality.",
  "id": "GHSA-8g8j-crrv-vm86",
  "modified": "2025-11-28T03:30:27Z",
  "published": "2025-11-28T03:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64314"
    },
    {
      "type": "WEB",
      "url": "https://consumer.huawei.com/cn/support/bulletinlaptops/2025/11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8GWJ-8HXC-285W

Vulnerability from github – Published: 2021-11-08 17:43 – Updated: 2021-11-08 17:43
VLAI
Summary
Prototype Pollution in json-ptr
Details

This affects the package json-ptr before 3.0.0. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided keys used in the pointer parameter are arrays.

Severity
5.6 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "json-ptr"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-23509"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-843"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-11-04T16:56:49Z",
    "nvd_published_at": "2021-11-03T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "This affects the package `json-ptr` before `3.0.0`. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided keys used in the pointer parameter are arrays.",
  "id": "GHSA-8gwj-8hxc-285w",
  "modified": "2021-11-08T17:43:16Z",
  "published": "2021-11-08T17:43:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23509"
    },
    {
      "type": "WEB",
      "url": "https://github.com/flitbit/json-ptr/pull/42"
    },
    {
      "type": "WEB",
      "url": "https://github.com/flitbit/json-ptr/commit/5dc458fbad1c382a2e3ca6d62e66ede3d92849ca"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/flitbit/json-ptr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/flitbit/json-ptr%23security-vulnerabilities-resolved"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JS-JSONPTR-1577291"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Prototype Pollution in json-ptr"
}

No mitigation information available for this CWE.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list