CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (page 4)
Page 4 of 7 — CVEs classified under CWE-1321, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-39018 | Medium | 6.3 | 2024-07-01 | harvey-woo cat5th/key-serializer v0.2.5 was discovered to contain a prototype pollution via the function "query". This vulnerability allows attackers to execut… |
CVE-2024-39016 | High | 8.1 | 2024-07-01 | che3vinci c3/utils-1 1.0.131 was discovered to contain a prototype pollution via the function assign. This vulnerability allows attackers to execute arbitrary… |
CVE-2024-39014 | Critical | 9.8 | 2024-07-01 | ahilfoley cahil/utils v2.3.2 was discovered to contain a prototype pollution via the function set. This vulnerability allows attackers to execute arbitrary cod… |
CVE-2024-39013 | Critical | 9.8 | 2024-07-01 | 2o3t-utility v0.1.2 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary code or c… |
CVE-2024-39008 | Critical | 10.0 | 2024-07-01 | robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep. This vulnerability allows attackers to execute a… |
CVE-2024-39003 | High | 7.3 | 2024-07-01 | amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function setValue. This vulnerability allows attackers to execute arbitrary… |
CVE-2024-39001 | Medium | 6.3 | 2024-07-01 | ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability allows attackers to e… |
CVE-2024-39000 | Medium | 6.5 | 2024-07-01 | adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function parse. This vulnerability allows attackers to execute arbitrar… |
CVE-2024-38999 | Critical | 10.0 | 2024-07-01 | jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execut… |
CVE-2024-38997 | Medium | 6.5 | 2024-07-01 | adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function extendDefaults. This vulnerability allows attackers to execute… |
CVE-2024-38996 | Critical | 9.8 | 2024-07-01 | ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allo… |
CVE-2024-38994 | High | 7.3 | 2024-07-01 | amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary co… |
CVE-2024-38992 | High | 8.8 | 2024-07-01 | airvertco frappejs v0.0.11 was discovered to contain a prototype pollution via the function registerView. This vulnerability allows attackers to execute arbitr… |
CVE-2024-38991 | High | 8.8 | 2024-07-01 | akbr patch-into v1.0.1 was discovered to contain a prototype pollution via the function patchInto. This vulnerability allows attackers to execute arbitrary cod… |
CVE-2024-38987 | Medium | 6.3 | 2024-07-01 | aofl cli-lib v3.14.0 was discovered to contain a prototype pollution via the component defaultsDeep. This vulnerability allows attackers to execute arbitrary c… |
CVE-2024-36578 | Medium | 5.9 | 2024-06-17 | akbr update 1.0.0 is vulnerable to Prototype Pollution via update/index.js. |
CVE-2024-36577 | High | 8.3 | 2024-06-17 | apphp js-object-resolver < 3.1.1 is vulnerable to Prototype Pollution via Module.setNestedProperty. |
CVE-2024-36574 | Medium | 6.3 | 2024-06-17 | A Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON (flatten-json/index.js:42) |
CVE-2024-36573 | Critical | 9.8 | 2024-06-17 | almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@almela/obx/build/inde… |
CVE-2024-36582 | Critical | 9.8 | 2024-06-17 | alexbinary object-deep-assign 1.0.11 is vulnerable to Prototype Pollution via the extend() method of Module.deepAssign (/src/index.js) |
CVE-2024-36583 | High | 8.1 | 2024-06-17 | A Prototype Pollution issue in byondreal accessor <= 1.0.0 allows an attacker to execute arbitrary code via @byondreal/accessor/index. |
CVE-2024-36580 | Critical | 9.8 | 2024-06-17 | A Prototype Pollution issue in cdr0 sg 1.0.10 allows an attacker to execute arbitrary code. |
CVE-2024-21512 | High | 8.2 | 2024-05-29 | Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when usin… |
CVE-2024-29651 | High | 8.1 | 2024-05-20 | A Prototype Pollution issue in API Dev Tools json-schema-ref-parser v.11.0.0 and v.11.1.0 allows a remote attacker to execute arbitrary code via the bundle()`… |
CVE-2024-24293 | High | 8.8 | 2024-05-20 | A Prototype Pollution issue in MiguelCastillo @bit/loader v.10.0.3 allows an attacker to execute arbitrary code via the M function e argument in index.js. |
CVE-2024-34273 | Medium | 5.9 | 2024-05-16 | njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method. |
CVE-2024-34698 | Medium | 4.6 | 2024-05-14 | FreeScout is a free, self-hosted help desk and shared mailbox. Versions of FreeScout prior to 1.8.139 contain a Prototype Pollution vulnerability in the `/publ… |
CVE-2024-34148 | Medium | 6.8 | 2024-05-02 | Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically disables the fix for CVE-2016-3721 whenever a build is triggered from a re… |
CVE-2024-32866 | High | 8.6 | 2024-04-23 | Conform, a type-safe form validation library, allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this… |
CVE-2024-30564 | Critical | 9.8 | 2024-04-18 | An issue inandrei-tatar nora-firebase-common between v.1.0.41 and v.1.12.2 allows a remote attacker to execute arbitrary code via a crafted script to the updat… |
CVE-2024-21509 | Medium | 6.5 | 2024-04-10 | Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization… |
CVE-2024-29650 | Critical | 9.8 | 2024-03-25 | An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe components. |
CVE-2024-21505 | High | 7.5 | 2024-03-25 | Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive… |
CVE-2024-2495 | Medium | 5.2 | 2024-03-15 | Cryptographic key vulnerability encoded in the FriendlyWrt firmware affecting version 2022-11-16.51b3d35. This vulnerability could allow an attacker to comprom… |
CVE-2024-27307 | Critical | 9.8 | 2024-03-06 | JSONata is a JSON query and transformation language. Starting in version 1.4.0 and prior to version 1.8.7 and 2.0.4, a malicious expression can use the transfo… |
CVE-2024-23339 | Medium | 6.3 | 2024-01-22 | hoolock is a suite of lightweight utilities designed to maintain a small footprint when bundled. Starting in version 2.0.0 and prior to version 2.2.1, utility… |
CVE-2023-39296 | High | 7.5 | 2024-01-05 | A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to ov… |
CVE-2023-46308 | Critical | 9.8 | 2024-01-03 | In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty. |
CVE-2023-26920 | Medium | 6.5 | 2023-12-12 | fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution. |
CVE-2023-26158 | High | 8.2 | 2023-12-08 | All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute resolves to the obj… |
CVE-2023-6293 | High | 7.1 | 2023-11-24 | Prototype Pollution in GitHub repository robinbuschmann/sequelize-typescript prior to 2.1.6. |
CVE-2023-45827 | High | 7.3 | 2023-11-06 | Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notatio… |
CVE-2023-1717 | Critical | 9.6 | 2023-11-01 | Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitr… |
CVE-2023-3965 | Medium | 6.1 | 2023-10-20 | The nsc theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.0 due to insufficient i… |
CVE-2023-3962 | Medium | 6.1 | 2023-10-20 | The Winters theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.4.3 due to insuffic… |
CVE-2023-3933 | Medium | 6.1 | 2023-10-20 | The Your Journey theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.9.8 due to ins… |
CVE-2023-45811 | High | 8.1 | 2023-10-17 | Synchrony deobfuscator is a javascript cleaner & deobfuscator. A `__proto__` pollution vulnerability exists in versions before v2.4.4. Successful exploitation… |
CVE-2023-45282 | High | 7.5 | 2023-10-06 | In NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action. |
CVE-2023-38894 | Critical | 9.8 | 2023-08-16 | A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function. |
CVE-2021-26505 | Critical | 9.8 | 2023-08-11 | Prototype pollution vulnerability in MrSwitch hello.js version 1.18.6, allows remote attackers to execute arbitrary code via hello.utils.extend function. |
CVE-2023-26139 | High | 7.5 | 2023-08-01 | Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() function. Exploiting th… |
CVE-2023-3696 | Critical | 9.8 | 2023-07-17 | Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4. |
CVE-2023-36665 | Critical | 9.8 | 2023-07-05 | "protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled prot… |
CVE-2023-26136 | Medium | 6.5 | 2023-07-01 | Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPubli… |
CVE-2023-26135 | High | 7.3 | 2023-06-30 | All versions of the package flatnest are vulnerable to Prototype Pollution via the nest() function in the flatnest/nest.js file. |
CVE-2023-36475 | Critical | 9.8 | 2023-06-28 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use… |
CVE-2023-26133 | High | 8.2 | 2023-06-12 | All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js. |
CVE-2023-26132 | High | 7.5 | 2023-06-10 | Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable i… |
CVE-2023-2972 | Critical | 9.8 | 2023-05-30 | Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3. |
CVE-2023-32305 | High | 8.8 | 2023-05-12 | aiven-extras is a PostgreSQL extension. Versions prior to 1.1.9 contain a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL… |
CVE-2023-2582 | Medium | 6.1 | 2023-05-08 | A prototype pollution vulnerability exists in Strikingly CMS which can result in reflected cross-site scripting (XSS) in affected applications and sites built… |
CVE-2023-30857 | Low | 3.7 | 2023-04-28 | @aedart/support is the support package for Ion, a monorepo for JavaScript/TypeScript packages. Prior to version `0.6.1`, there is a possible prototype pollutio… |
CVE-2023-30363 | Critical | 9.8 | 2023-04-26 | vConsole v3.15.0 was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions in core.ts. |
CVE-2023-30533 | High | 7.8 | 2023-04-24 | SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file. In other words. 0.19.2 and earlier are affected, whereas 0.19.3 and late… |
CVE-2023-26122 | High | 8.8 | 2023-04-11 | All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived from prototype pollutio… |
CVE-2023-26121 | High | 7.5 | 2023-04-11 | All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content. |
CVE-2023-0842 | Medium | 5.3 | 2023-04-05 | xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly valida… |
CVE-2023-28427 | High | 8.2 | 2023-03-28 | matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can t… |
CVE-2023-28103 | High | 8.2 | 2023-03-28 | matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key l… |
CVE-2022-36060 | High | 8.2 | 2023-03-28 | matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede the matri… |
CVE-2022-36059 | High | 8.2 | 2023-03-28 | matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 19.4.0 events sent with special strings in key places can t… |
CVE-2023-26113 | High | 7.5 | 2023-03-18 | Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js… |
CVE-2023-26106 | High | 7.5 | 2023-03-06 | All versions of the package dot-lens are vulnerable to Prototype Pollution via the set() function in index.js file. |
CVE-2023-26105 | High | 7.5 | 2023-02-28 | All versions of the package utilities are vulnerable to Prototype Pollution via the _mix function. |
CVE-2023-26102 | High | 7.5 | 2023-02-24 | All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function uses recursive merg… |
CVE-2023-23917 | High | 8.8 | 2023-02-23 | A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create thei… |
CVE-2022-3901 | High | 7.2 | 2023-02-20 | Prototype Pollution in Visioweb.js 1.10.6 allows attackers to execute XSS on the client system. |
CVE-2021-4307 | Medium | 6.3 | 2023-01-07 | A vulnerability was found in Yomguithereal Baobab up to 2.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. Th… |
CVE-2022-4742 | Medium | 6.3 | 2022-12-26 | A vulnerability, which was classified as critical, has been found in json-pointer up to 0.6.1. Affected by this issue is the function set of the file index.js… |
CVE-2021-4279 | Medium | 6.3 | 2022-12-25 | A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulat… |
CVE-2020-36632 | Medium | 6.3 | 2022-12-25 | A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipula… |
CVE-2021-4278 | Medium | 5.5 | 2022-12-25 | A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x. This affects an unknown part. The manipulation leads to improperly co… |
CVE-2022-46175 | High | 7.1 | 2022-12-24 | JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the J… |
CVE-2022-2200 | High | 8.8 | 2022-12-22 | If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading to privileged code e… |
CVE-2022-1802 | High | 8.8 | 2022-12-22 | If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-control… |
CVE-2022-1529 | High | 8.8 | 2022-12-22 | An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype polluti… |
CVE-2021-4264 | Medium | 6.3 | 2022-12-21 | A vulnerability was found in LinkedIn dustjs up to 2.x and classified as problematic. Affected by this issue is some unknown functionality. The manipulation le… |
CVE-2022-25904 | High | 7.5 | 2022-12-20 | All versions of package safe-eval are vulnerable to Prototype Pollution which allows an attacker to add or modify properties of the Object.prototype.Consolidat… |
CVE-2020-36618 | Medium | 6.3 | 2022-12-19 | A vulnerability classified as critical has been found in Furqan node-whois. Affected is an unknown function of the file index.coffee. The manipulation leads to… |
CVE-2021-4245 | Medium | 5.5 | 2022-12-15 | A vulnerability classified as problematic has been found in chbrown rfc6902. This affects an unknown part of the file pointer.ts. The manipulation leads to imp… |
CVE-2022-24999 | High | 7.5 | 2022-11-26 | qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ p… |
CVE-2022-41878 | High | 7.2 | 2022-11-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.2 or 4.10.19, keywords that ar… |
CVE-2022-41879 | High | 7.2 | 2022-11-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.3 or 4.10.20, a compromised Pa… |
CVE-2022-39396 | Critical | 9.8 | 2022-11-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.18, and prior to 5.3.1 on the 5… |
CVE-2022-42743 | Medium | 5.3 | 2022-11-03 | deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correct… |
CVE-2022-41714 | Medium | 5.3 | 2022-11-03 | fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the application does not corre… |
CVE-2022-41713 | Medium | 5.3 | 2022-11-03 | deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not proper… |
CVE-2022-37623 | Critical | 9.8 | 2022-10-31 | Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the shimPath variable in resolve-shims.js. |
CVE-2022-37621 | Critical | 9.8 | 2022-10-28 | Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the fullPath variable in resolve-shims.js. |
CVE-2022-39357 | High | 8.1 | 2022-10-26 | Winter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2.0 is vuln… |