CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (page 3)
Page 3 of 6 — CVEs classified under CWE-1321, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-57066 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.deep function of @ndhoule/defaults v2.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57065 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.createPath function of utile v0.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57064 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.setValue function of @syncfusion/ej2-spreadsheet v27.2.2 allows attackers to cause a Denial of Service (DoS) via supplying a c… |
CVE-2024-57063 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib function of php-date-formatter v1.3.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-56059 | Critical | 9.8 | 2024-12-18 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in farinspace Partners partners allows Object Injection… |
CVE-2024-21548 | High | 7.5 | 2024-12-18 | Versions of the package bun after 0.0.12 and before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An attacker can exploit th… |
CVE-2024-54156 | Medium | 4.2 | 2024-12-04 | In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack |
CVE-2024-52810 | | 2024-11-29 | @intlify/shared is a shared library for the intlify project. The latest version of @intlify/shared (10.0.4) is vulnerable to Prototype Pollution through the en… | |
CVE-2023-0163 | High | 8.4 | 2024-11-26 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Mozilla Convict. This allows an attacker to inject… |
CVE-2024-52441 | Critical | 9.8 | 2024-11-20 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Rajesh Thanoch Quick Learn quick-learn allows Object… |
CVE-2024-48910 | Critical | 9.1 | 2024-10-31 | DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability… |
CVE-2024-45277 | Medium | 4.3 | 2024-10-08 | The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 is impacted by Prototype Pollution vulnerability allowing an attacker to add arbitrary p… |
CVE-2024-21489 | High | 8.2 | 2024-10-01 | Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves… |
CVE-2024-45815 | Medium | 6.5 | 2024-09-17 | Backstage is an open framework for building developer portals. A malicious actor with authenticated access to a Backstage instance with the catalog backend plu… |
CVE-2024-45801 | High | 7.3 | 2024-09-16 | DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting tec… |
CVE-2024-21529 | High | 8.2 | 2024-09-11 | Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability… |
CVE-2024-21528 | Medium | 5.9 | 2024-09-10 | All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to improper user input sani… |
CVE-2024-45435 | Critical | 9.8 | 2024-08-29 | Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. |
CVE-2024-37287 | Critical | 9.1 | 2024-08-13 | A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to in… |
CVE-2024-38989 | Critical | 9.8 | 2024-08-12 | izatop bunt v0.29.19 was discovered to contain a prototype pollution via the component /esm/qs.js. This vulnerability allows attackers to execute arbitrary cod… |
CVE-2024-38983 | Critical | 9.8 | 2024-07-30 | Prototype Pollution in alykoshin mini-deep-assign v0.0.8 allows an attacker to execute arbitrary code or cause a Denial of Service (DoS) and cause other impact… |
CVE-2024-39012 | Critical | 9.8 | 2024-07-30 | ais-ltd strategyen v0.4.0 was discovered to contain a prototype pollution via the function mergeObjects. This vulnerability allows attackers to execute arbitra… |
CVE-2024-39011 | Critical | 9.8 | 2024-07-30 | Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via… |
CVE-2024-39010 | Critical | 9.8 | 2024-07-30 | chase-moskal snapstate v0.0.9 was discovered to contain a prototype pollution via the function attemptNestedProperty. This vulnerability allows attackers to ex… |
CVE-2024-38986 | Critical | 9.8 | 2024-07-30 | Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via merge me… |
CVE-2024-38984 | Critical | 9.8 | 2024-07-30 | Prototype Pollution in lukebond json-override 0.2.0 allows attackers to to execute arbitrary code or cause a Denial of Service (DoS) via the __proto__ property. |
CVE-2024-36572 | Critical | 9.8 | 2024-07-30 | Prototype pollution in allpro form-manager 0.7.4 allows attackers to run arbitrary code and cause other impacts via the functions setDefaults, mergeBranch, and… |
CVE-2024-33519 | High | 7.2 | 2024-07-24 | A vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote attacker to conduc… |
CVE-2024-22443 | High | 7.2 | 2024-07-24 | A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a server-side… |
CVE-2024-39853 | Medium | 6.5 | 2024-07-01 | adolph_dudu ratio-swiper 0.0.2 was discovered to contain a prototype pollution via the function parse. This vulnerability allows attackers to execute arbitrary… |
CVE-2024-39018 | Medium | 6.3 | 2024-07-01 | harvey-woo cat5th/key-serializer v0.2.5 was discovered to contain a prototype pollution via the function "query". This vulnerability allows attackers to execut… |
CVE-2024-39016 | High | 8.1 | 2024-07-01 | che3vinci c3/utils-1 1.0.131 was discovered to contain a prototype pollution via the function assign. This vulnerability allows attackers to execute arbitrary… |
CVE-2024-39014 | Critical | 9.8 | 2024-07-01 | ahilfoley cahil/utils v2.3.2 was discovered to contain a prototype pollution via the function set. This vulnerability allows attackers to execute arbitrary cod… |
CVE-2024-39013 | Critical | 9.8 | 2024-07-01 | 2o3t-utility v0.1.2 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary code or c… |
CVE-2024-39008 | Critical | 10.0 | 2024-07-01 | robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep. This vulnerability allows attackers to execute a… |
CVE-2024-39003 | High | 7.3 | 2024-07-01 | amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function setValue. This vulnerability allows attackers to execute arbitrary… |
CVE-2024-39001 | Medium | 6.3 | 2024-07-01 | ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability allows attackers to e… |
CVE-2024-39000 | Medium | 6.5 | 2024-07-01 | adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function parse. This vulnerability allows attackers to execute arbitrar… |
CVE-2024-38999 | Critical | 10.0 | 2024-07-01 | jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execut… |
CVE-2024-38997 | Medium | 6.5 | 2024-07-01 | adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function extendDefaults. This vulnerability allows attackers to execute… |
CVE-2024-38996 | Critical | 9.8 | 2024-07-01 | ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allo… |
CVE-2024-38994 | High | 7.3 | 2024-07-01 | amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary co… |
CVE-2024-38992 | High | 8.8 | 2024-07-01 | airvertco frappejs v0.0.11 was discovered to contain a prototype pollution via the function registerView. This vulnerability allows attackers to execute arbitr… |
CVE-2024-38991 | High | 8.8 | 2024-07-01 | akbr patch-into v1.0.1 was discovered to contain a prototype pollution via the function patchInto. This vulnerability allows attackers to execute arbitrary cod… |
CVE-2024-38987 | Medium | 6.3 | 2024-07-01 | aofl cli-lib v3.14.0 was discovered to contain a prototype pollution via the component defaultsDeep. This vulnerability allows attackers to execute arbitrary c… |
CVE-2024-36578 | Medium | 5.9 | 2024-06-17 | akbr update 1.0.0 is vulnerable to Prototype Pollution via update/index.js. |
CVE-2024-36577 | High | 8.3 | 2024-06-17 | apphp js-object-resolver < 3.1.1 is vulnerable to Prototype Pollution via Module.setNestedProperty. |
CVE-2024-36574 | Medium | 6.3 | 2024-06-17 | A Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON (flatten-json/index.js:42) |
CVE-2024-36573 | Critical | 9.8 | 2024-06-17 | almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@almela/obx/build/inde… |
CVE-2024-36582 | Critical | 9.8 | 2024-06-17 | alexbinary object-deep-assign 1.0.11 is vulnerable to Prototype Pollution via the extend() method of Module.deepAssign (/src/index.js) |
CVE-2024-36583 | High | 8.1 | 2024-06-17 | A Prototype Pollution issue in byondreal accessor <= 1.0.0 allows an attacker to execute arbitrary code via @byondreal/accessor/index. |
CVE-2024-36580 | Critical | 9.8 | 2024-06-17 | A Prototype Pollution issue in cdr0 sg 1.0.10 allows an attacker to execute arbitrary code. |
CVE-2024-21512 | High | 8.2 | 2024-05-29 | Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when usin… |
CVE-2024-29651 | High | 8.1 | 2024-05-20 | A Prototype Pollution issue in API Dev Tools json-schema-ref-parser v.11.0.0 and v.11.1.0 allows a remote attacker to execute arbitrary code via the bundle()`… |
CVE-2024-24293 | High | 8.8 | 2024-05-20 | A Prototype Pollution issue in MiguelCastillo @bit/loader v.10.0.3 allows an attacker to execute arbitrary code via the M function e argument in index.js. |
CVE-2024-34273 | Medium | 5.9 | 2024-05-16 | njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method. |
CVE-2024-34698 | Medium | 4.6 | 2024-05-14 | FreeScout is a free, self-hosted help desk and shared mailbox. Versions of FreeScout prior to 1.8.139 contain a Prototype Pollution vulnerability in the `/publ… |
CVE-2024-34148 | Medium | 6.8 | 2024-05-02 | Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically disables the fix for CVE-2016-3721 whenever a build is triggered from a re… |
CVE-2024-32866 | High | 8.6 | 2024-04-23 | Conform, a type-safe form validation library, allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this… |
CVE-2024-30564 | Critical | 9.8 | 2024-04-18 | An issue inandrei-tatar nora-firebase-common between v.1.0.41 and v.1.12.2 allows a remote attacker to execute arbitrary code via a crafted script to the updat… |
CVE-2024-21509 | Medium | 6.5 | 2024-04-10 | Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization… |
CVE-2024-29650 | Critical | 9.8 | 2024-03-25 | An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe components. |
CVE-2024-21505 | High | 7.5 | 2024-03-25 | Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive… |
CVE-2024-2495 | Medium | 5.2 | 2024-03-15 | Cryptographic key vulnerability encoded in the FriendlyWrt firmware affecting version 2022-11-16.51b3d35. This vulnerability could allow an attacker to comprom… |
CVE-2024-27307 | Critical | 9.8 | 2024-03-06 | JSONata is a JSON query and transformation language. Starting in version 1.4.0 and prior to version 1.8.7 and 2.0.4, a malicious expression can use the transfo… |
CVE-2024-23339 | Medium | 6.3 | 2024-01-22 | hoolock is a suite of lightweight utilities designed to maintain a small footprint when bundled. Starting in version 2.0.0 and prior to version 2.2.1, utility… |
CVE-2023-39296 | High | 7.5 | 2024-01-05 | A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to ov… |
CVE-2023-46308 | Critical | 9.8 | 2024-01-03 | In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty. |
CVE-2023-26920 | Medium | 6.5 | 2023-12-12 | fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution. |
CVE-2023-26158 | High | 8.2 | 2023-12-08 | All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute resolves to the obj… |
CVE-2023-6293 | High | 7.1 | 2023-11-24 | Prototype Pollution in GitHub repository robinbuschmann/sequelize-typescript prior to 2.1.6. |
CVE-2023-45827 | High | 7.3 | 2023-11-06 | Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notatio… |
CVE-2023-1717 | Critical | 9.6 | 2023-11-01 | Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitr… |
CVE-2023-3965 | Medium | 6.1 | 2023-10-20 | The nsc theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.0 due to insufficient i… |
CVE-2023-3962 | Medium | 6.1 | 2023-10-20 | The Winters theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.4.3 due to insuffic… |
CVE-2023-3933 | Medium | 6.1 | 2023-10-20 | The Your Journey theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.9.8 due to ins… |
CVE-2023-45811 | High | 8.1 | 2023-10-17 | Synchrony deobfuscator is a javascript cleaner & deobfuscator. A `__proto__` pollution vulnerability exists in versions before v2.4.4. Successful exploitation… |
CVE-2023-45282 | High | 7.5 | 2023-10-06 | In NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action. |
CVE-2023-38894 | Critical | 9.8 | 2023-08-16 | A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function. |
CVE-2021-26505 | Critical | 9.8 | 2023-08-11 | Prototype pollution vulnerability in MrSwitch hello.js version 1.18.6, allows remote attackers to execute arbitrary code via hello.utils.extend function. |
CVE-2023-26139 | High | 7.5 | 2023-08-01 | Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() function. Exploiting th… |
CVE-2023-3696 | Critical | 9.8 | 2023-07-17 | Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4. |
CVE-2023-36665 | Critical | 9.8 | 2023-07-05 | "protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled prot… |
CVE-2023-26136 | Medium | 6.5 | 2023-07-01 | Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPubli… |
CVE-2023-26135 | High | 7.3 | 2023-06-30 | All versions of the package flatnest are vulnerable to Prototype Pollution via the nest() function in the flatnest/nest.js file. |
CVE-2023-36475 | Critical | 9.8 | 2023-06-28 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use… |
CVE-2023-26133 | High | 8.2 | 2023-06-12 | All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js. |
CVE-2023-26132 | High | 7.5 | 2023-06-10 | Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable i… |
CVE-2023-2972 | Critical | 9.8 | 2023-05-30 | Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3. |
CVE-2023-32305 | High | 8.8 | 2023-05-12 | aiven-extras is a PostgreSQL extension. Versions prior to 1.1.9 contain a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL… |
CVE-2023-2582 | Medium | 6.1 | 2023-05-08 | A prototype pollution vulnerability exists in Strikingly CMS which can result in reflected cross-site scripting (XSS) in affected applications and sites built… |
CVE-2023-30857 | Low | 3.7 | 2023-04-28 | @aedart/support is the support package for Ion, a monorepo for JavaScript/TypeScript packages. Prior to version `0.6.1`, there is a possible prototype pollutio… |
CVE-2023-30363 | Critical | 9.8 | 2023-04-26 | vConsole v3.15.0 was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions in core.ts. |
CVE-2023-30533 | High | 7.8 | 2023-04-24 | SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file. In other words. 0.19.2 and earlier are affected, whereas 0.19.3 and late… |
CVE-2023-26122 | High | 8.8 | 2023-04-11 | All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived from prototype pollutio… |
CVE-2023-26121 | High | 7.5 | 2023-04-11 | All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content. |
CVE-2023-0842 | Medium | 5.3 | 2023-04-05 | xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly valida… |
CVE-2023-28427 | High | 8.2 | 2023-03-28 | matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can t… |
CVE-2023-28103 | High | 8.2 | 2023-03-28 | matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key l… |
CVE-2022-36060 | High | 8.2 | 2023-03-28 | matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede the matri… |