CVSS: 10.0EPSS: 15%CPEs: 3EXPL: 2CVE-2022-37601 – loader-utils (JS package) < 2.0.3 - Prototype Pollution
https://notcve.org/view.php?id=CVE-2022-37601
12 Oct 2022 — Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3. Una vulnerabilidad de contaminación de prototipos en la función parseQuery en el archivo parseQuery.js en webpack loader-utils 2.0.0 por medio de la variable name en parseQuery.js A prototype pollution vulnerability was found in the parseQuery function in parseQuery.js in the webpack loader-utils via the name variable in... • http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf • CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 7.8EPSS: 3%CPEs: 3EXPL: 0CVE-2022-37599 – loader-utils (JS package) < 3.2.1 - Regular Expression Denial of Service
https://notcve.org/view.php?id=CVE-2022-37599
11 Oct 2022 — A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js. Se ha encontrado un fallo de Denegación de Servicio de Expresión Regular (ReDoS) en la función interpolateName en el archivo interpolateName.js en webpack loader-utils 2.0.0 por medio de la variable resourcePath en el archivo interpolateName.js A flaw was found in the interpolateName function in interpolateName.js i... • https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 2CVE-2022-37603 – loader-utils (JS package) < 3.2.1 - Regular Expression Denial of Service
https://notcve.org/view.php?id=CVE-2022-37603
11 Oct 2022 — A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js. Se ha encontrado un fallo de denegación de servicio de expresión Regular (ReDoS) en la función interpolateName en el archivo interpolateName.js en webpack loader-utils 2.0.0 por medio de la variable url en interpolateName.js A flaw was found in loader-utils webpack library. When the url variable from interpolateName is set, ... • https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L107 • CWE-185: Incorrect Regular Expression CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •