CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (page 4)
Page 4 of 6 — CVEs classified under CWE-1321, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-36059 | High | 8.2 | 2023-03-28 | matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 19.4.0 events sent with special strings in key places can t… |
CVE-2023-26113 | High | 7.5 | 2023-03-18 | Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js… |
CVE-2023-26106 | High | 7.5 | 2023-03-06 | All versions of the package dot-lens are vulnerable to Prototype Pollution via the set() function in index.js file. |
CVE-2023-26105 | High | 7.5 | 2023-02-28 | All versions of the package utilities are vulnerable to Prototype Pollution via the _mix function. |
CVE-2023-26102 | High | 7.5 | 2023-02-24 | All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function uses recursive merg… |
CVE-2023-23917 | High | 8.8 | 2023-02-23 | A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create thei… |
CVE-2022-3901 | High | 7.2 | 2023-02-20 | Prototype Pollution in Visioweb.js 1.10.6 allows attackers to execute XSS on the client system. |
CVE-2021-4307 | Medium | 6.3 | 2023-01-07 | A vulnerability was found in Yomguithereal Baobab up to 2.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. Th… |
CVE-2022-4742 | Medium | 6.3 | 2022-12-26 | A vulnerability, which was classified as critical, has been found in json-pointer up to 0.6.1. Affected by this issue is the function set of the file index.js… |
CVE-2021-4279 | Medium | 6.3 | 2022-12-25 | A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulat… |
CVE-2020-36632 | Medium | 6.3 | 2022-12-25 | A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipula… |
CVE-2021-4278 | Medium | 5.5 | 2022-12-25 | A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x. This affects an unknown part. The manipulation leads to improperly co… |
CVE-2022-46175 | High | 7.1 | 2022-12-24 | JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the J… |
CVE-2022-2200 | High | 8.8 | 2022-12-22 | If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading to privileged code e… |
CVE-2022-1802 | High | 8.8 | 2022-12-22 | If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-control… |
CVE-2022-1529 | High | 8.8 | 2022-12-22 | An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype polluti… |
CVE-2021-4264 | Medium | 6.3 | 2022-12-21 | A vulnerability was found in LinkedIn dustjs up to 2.x and classified as problematic. Affected by this issue is some unknown functionality. The manipulation le… |
CVE-2022-25904 | High | 7.5 | 2022-12-20 | All versions of package safe-eval are vulnerable to Prototype Pollution which allows an attacker to add or modify properties of the Object.prototype.Consolidat… |
CVE-2020-36618 | Medium | 6.3 | 2022-12-19 | A vulnerability classified as critical has been found in Furqan node-whois. Affected is an unknown function of the file index.coffee. The manipulation leads to… |
CVE-2021-4245 | Medium | 5.5 | 2022-12-15 | A vulnerability classified as problematic has been found in chbrown rfc6902. This affects an unknown part of the file pointer.ts. The manipulation leads to imp… |
CVE-2022-24999 | High | 7.5 | 2022-11-26 | qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ p… |
CVE-2022-41878 | High | 7.2 | 2022-11-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.2 or 4.10.19, keywords that ar… |
CVE-2022-41879 | High | 7.2 | 2022-11-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.3 or 4.10.20, a compromised Pa… |
CVE-2022-39396 | Critical | 9.8 | 2022-11-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.18, and prior to 5.3.1 on the 5… |
CVE-2022-42743 | Medium | 5.3 | 2022-11-03 | deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correct… |
CVE-2022-41714 | Medium | 5.3 | 2022-11-03 | fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the application does not corre… |
CVE-2022-41713 | Medium | 5.3 | 2022-11-03 | deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not proper… |
CVE-2022-37623 | Critical | 9.8 | 2022-10-31 | Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the shimPath variable in resolve-shims.js. |
CVE-2022-37621 | Critical | 9.8 | 2022-10-28 | Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the fullPath variable in resolve-shims.js. |
CVE-2022-39357 | High | 8.1 | 2022-10-26 | Winter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2.0 is vuln… |
CVE-2022-29823 | Critical | 10.0 | 2022-10-26 | Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution (RC… |
CVE-2022-37598 | Critical | 9.8 | 2022-10-20 | Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an i… |
CVE-2022-37602 | Critical | 9.8 | 2022-10-14 | Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js. |
CVE-2022-37601 | Critical | 9.8 | 2022-10-12 | Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all vers… |
CVE-2022-37614 | Critical | 9.8 | 2022-10-12 | Prototype pollution vulnerability in function enable in mockery.js in mfncooper mockery commit 822f0566fd6d72af8c943ae5ca2aa92e516aa2cf via the key variable in… |
CVE-2022-37611 | Critical | 9.8 | 2022-10-12 | Prototype pollution vulnerability in tschaub gh-pages 3.1.0 via the partial variable in util.js. |
CVE-2022-37617 | Critical | 9.8 | 2022-10-11 | Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the k variable in resolve-shims.js. |
CVE-2022-37609 | Critical | 9.8 | 2022-10-11 | Prototype pollution vulnerability in beautify-web js-beautify 1.13.7 via the name variable in options.js. |
CVE-2022-37616 | Critical | 9.8 | 2022-10-11 | A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the… |
CVE-2022-21169 | High | 7.3 | 2022-09-26 | The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitiz… |
CVE-2020-36604 | High | 8.1 | 2022-09-23 | hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function. |
CVE-2022-37265 | Critical | 9.8 | 2022-09-20 | Prototype pollution vulnerability in stealjs steal 2.2.4 via the alias variable in babel.js. |
CVE-2022-37258 | Critical | 9.8 | 2022-09-16 | Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convert.js. |
CVE-2022-37264 | Critical | 9.8 | 2022-09-15 | Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js. |
CVE-2022-37266 | Critical | 9.8 | 2022-09-15 | Prototype pollution vulnerability in function extend in babel.js in stealjs steal 2.2.4 via the key variable in babel.js. |
CVE-2022-37257 | Critical | 9.8 | 2022-09-15 | Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the requestedVersion variable in npm-convert.js. |
CVE-2022-2625 | High | 8.0 | 2022-08-18 | A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait fo… |
CVE-2022-25907 | High | 7.5 | 2022-08-09 | The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function. |
CVE-2022-2564 | Critical | 9.8 | 2022-07-28 | Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6. |
CVE-2021-23397 | Medium | 5.6 | 2022-07-25 | All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @generates/merger inste… |
CVE-2021-23373 | High | 7.5 | 2022-07-25 | All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality. |
CVE-2020-28471 | High | 7.3 | 2022-07-25 | This affects the package properties-reader before 2.2.0. |
CVE-2020-28462 | High | 7.3 | 2022-07-25 | This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute th… |
CVE-2020-28461 | High | 7.3 | 2022-07-25 | This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the p… |
CVE-2020-28441 | High | 7.3 | 2022-07-25 | This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute… |
CVE-2020-7641 | Medium | 4.0 | 2022-07-17 | This affects all versions of package grunt-util-property. The function call could be tricked into adding or modifying properties of Object.prototype using a __… |
CVE-2021-40663 | Critical | 9.8 | 2022-06-30 | deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). |
CVE-2022-31106 | High | 8.3 | 2022-06-28 | Underscore.deep is a collection of Underscore mixins that operate on nested objects. Versions of `underscore.deep` prior to version 0.5.3 are vulnerable to a p… |
CVE-2022-21231 | High | 7.5 | 2022-06-24 | All versions of package deep-get-set are vulnerable to Prototype Pollution via the 'deep' function. **Note:** This vulnerability derives from an incomplete fix… |
CVE-2022-25871 | Medium | 5.9 | 2022-06-17 | All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be controlled by user… |
CVE-2022-21213 | High | 7.5 | 2022-06-17 | This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn mixes objects into… |
CVE-2022-25878 | High | 8.2 | 2022-05-27 | The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This v… |
CVE-2022-25862 | Medium | 4.0 | 2022-05-13 | This affects the package sds from 0.0.0. The library could be tricked into adding or modifying properties of the Object.prototype by abusing the set function l… |
CVE-2022-21190 | High | 7.5 | 2022-05-13 | This affects the package convict before 6.2.3. This is a bypass of [CVE-2022-22143](https://security.snyk.io/vuln/SNYK-JS-CONVICT-2340604). The [fix](https://g… |
CVE-2021-42581 | Critical | 9.1 | 2022-05-10 | Prototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to compromise integrity or availability of application via supplying… |
CVE-2022-25324 | High | 7.5 | 2022-05-06 | All versions of package bignum are vulnerable to Denial of Service (DoS) due to a type-check exception in V8, when verifying the type of the second argument to… |
CVE-2022-25301 | High | 7.7 | 2022-05-01 | All versions of package jsgui-lang-essentials are vulnerable to Prototype Pollution due to allowing all Object attributes to be altered, including their magica… |
CVE-2022-25645 | Medium | 6.5 | 2022-05-01 | All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if… |
CVE-2022-22143 | High | 7.5 | 2022-05-01 | The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. **Note:** This vulnerab… |
CVE-2022-21189 | High | 7.3 | 2022-05-01 | The package dexie before 3.2.2, from 4.0.0-alpha.1 and before 4.0.0-alpha.3 are vulnerable to Prototype Pollution in the Dexie.setByKeyPath(obj, keyPath, value… |
CVE-2022-24279 | High | 7.5 | 2022-04-15 | The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes… |
CVE-2022-21803 | High | 7.3 | 2022-04-12 | This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set… |
CVE-2022-1295 | Critical | 9.8 | 2022-04-11 | Prototype Pollution in GitHub repository alvarotrigo/fullpage.js prior to 4.0.2. |
CVE-2021-43138 | High | 7.8 | 2022-04-06 | In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterato… |
CVE-2022-24802 | High | 8.1 | 2022-04-01 | deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. deepmerge-ts is vulnerable to Prototype Pollution via file… |
CVE-2022-26260 | Critical | 9.8 | 2022-03-22 | Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse(). |
CVE-2021-44906 | Critical | 9.8 | 2022-03-17 | Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95). |
CVE-2022-25354 | High | 8.6 | 2022-03-17 | The package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. **Note… |
CVE-2022-25352 | High | 7.5 | 2022-03-17 | The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. **Note:** This vulnerability derives from an incompl… |
CVE-2022-25296 | Medium | 6.3 | 2022-03-17 | The package bodymen from 0.0.0 are vulnerable to Prototype Pollution via the handler function which could be tricked into adding or modifying properties of Obj… |
CVE-2021-44908 | Critical | 9.8 | 2022-03-17 | SailsJS Sails.js <=1.4.0 is vulnerable to Prototype Pollution via controller/load-action-modules.js, function loadActionModules(). |
CVE-2021-23771 | Medium | 6.5 | 2022-03-17 | This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. T… |
CVE-2021-43956 | Medium | 6.1 | 2022-03-16 | The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a protot… |
CVE-2022-24760 | Critical | 10.0 | 2022-03-12 | Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This… |
CVE-2022-23395 | Medium | 6.1 | 2022-03-02 | jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS). |
CVE-2022-21824 | High | 8.2 | 2022-02-24 | Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while s… |
CVE-2021-23702 | High | 7.6 | 2022-02-18 | The package object-extend from 0.0.0 are vulnerable to Prototype Pollution via object-extend. |
CVE-2022-22912 | Critical | 9.8 | 2022-02-17 | Prototype pollution vulnerability via .parse() in Plist before v3.0.4 allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution. |
CVE-2021-23682 | High | 7.3 | 2022-02-16 | This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string… |
CVE-2021-23597 | High | 7.5 | 2022-02-11 | This affects the package fastify-multipart before 5.3.1. By providing a name=constructor property it is still possible to crash the application. **Note:** This… |
CVE-2022-23631 | Critical | 9.0 | 2022-02-09 | superjson is a program to allow JavaScript expressions to be serialized to a superset of JSON. In versions prior to 1.8.1 superjson allows input to run arbitra… |
CVE-2022-23624 | High | 8.1 | 2022-02-07 | Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 and integration with… |
CVE-2022-23623 | High | 8.1 | 2022-02-07 | Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `valida… |
CVE-2021-23507 | High | 7.5 | 2022-02-04 | The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into… |
CVE-2021-23497 | High | 7.5 | 2022-02-04 | This affects the package @strikeentco/set before 1.0.2. It allows an attacker to cause a denial of service and may lead to remote code execution. **Note:** Thi… |
CVE-2021-23470 | High | 8.2 | 2022-02-04 | This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious… |
CVE-2022-0432 | Medium | 6.1 | 2022-02-02 | Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0. |
CVE-2021-23760 | Medium | 5.6 | 2022-01-28 | The package keyget from 0.0.0 are vulnerable to Prototype Pollution via the methods set, push, and at which could allow an attacker to cause a denial of servic… |
CVE-2021-23558 | High | 7.3 | 2022-01-28 | The package bmoor before 0.10.1 are vulnerable to Prototype Pollution due to missing sanitization in set function. **Note:** This vulnerability derives from an… |
CVE-2021-23518 | High | 7.3 | 2022-01-21 | The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in… |