CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (page 5)
Page 5 of 7 — CVEs classified under CWE-1321, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-29823 | Critical | 10.0 | 2022-10-26 | Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution (RC… |
CVE-2022-37598 | Critical | 9.8 | 2022-10-20 | Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an i… |
CVE-2022-37602 | Critical | 9.8 | 2022-10-14 | Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js. |
CVE-2022-37601 | Critical | 9.8 | 2022-10-12 | Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all vers… |
CVE-2022-37614 | Critical | 9.8 | 2022-10-12 | Prototype pollution vulnerability in function enable in mockery.js in mfncooper mockery commit 822f0566fd6d72af8c943ae5ca2aa92e516aa2cf via the key variable in… |
CVE-2022-37611 | Critical | 9.8 | 2022-10-12 | Prototype pollution vulnerability in tschaub gh-pages 3.1.0 via the partial variable in util.js. |
CVE-2022-37617 | Critical | 9.8 | 2022-10-11 | Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the k variable in resolve-shims.js. |
CVE-2022-37609 | Critical | 9.8 | 2022-10-11 | Prototype pollution vulnerability in beautify-web js-beautify 1.13.7 via the name variable in options.js. |
CVE-2022-37616 | Critical | 9.8 | 2022-10-11 | A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the… |
CVE-2022-21169 | High | 7.3 | 2022-09-26 | The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitiz… |
CVE-2020-36604 | High | 8.1 | 2022-09-23 | hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function. |
CVE-2022-37265 | Critical | 9.8 | 2022-09-20 | Prototype pollution vulnerability in stealjs steal 2.2.4 via the alias variable in babel.js. |
CVE-2022-37258 | Critical | 9.8 | 2022-09-16 | Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convert.js. |
CVE-2022-37264 | Critical | 9.8 | 2022-09-15 | Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js. |
CVE-2022-37266 | Critical | 9.8 | 2022-09-15 | Prototype pollution vulnerability in function extend in babel.js in stealjs steal 2.2.4 via the key variable in babel.js. |
CVE-2022-37257 | Critical | 9.8 | 2022-09-15 | Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the requestedVersion variable in npm-convert.js. |
CVE-2022-2625 | High | 8.0 | 2022-08-18 | A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait fo… |
CVE-2022-25907 | High | 7.5 | 2022-08-09 | The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function. |
CVE-2022-2564 | Critical | 9.8 | 2022-07-28 | Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6. |
CVE-2021-23397 | Medium | 5.6 | 2022-07-25 | All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @generates/merger inste… |
CVE-2021-23373 | High | 7.5 | 2022-07-25 | All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality. |
CVE-2020-28471 | High | 7.3 | 2022-07-25 | This affects the package properties-reader before 2.2.0. |
CVE-2020-28462 | High | 7.3 | 2022-07-25 | This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute th… |
CVE-2020-28461 | High | 7.3 | 2022-07-25 | This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the p… |
CVE-2020-28441 | High | 7.3 | 2022-07-25 | This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute… |
CVE-2020-7641 | Medium | 4.0 | 2022-07-17 | This affects all versions of package grunt-util-property. The function call could be tricked into adding or modifying properties of Object.prototype using a __… |
CVE-2021-40663 | Critical | 9.8 | 2022-06-30 | deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). |
CVE-2022-31106 | High | 8.3 | 2022-06-28 | Underscore.deep is a collection of Underscore mixins that operate on nested objects. Versions of `underscore.deep` prior to version 0.5.3 are vulnerable to a p… |
CVE-2022-21231 | High | 7.5 | 2022-06-24 | All versions of package deep-get-set are vulnerable to Prototype Pollution via the 'deep' function. **Note:** This vulnerability derives from an incomplete fix… |
CVE-2022-25871 | Medium | 5.9 | 2022-06-17 | All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be controlled by user… |
CVE-2022-21213 | High | 7.5 | 2022-06-17 | This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn mixes objects into… |
CVE-2022-25878 | High | 8.2 | 2022-05-27 | The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This v… |
CVE-2022-25862 | Medium | 4.0 | 2022-05-13 | This affects the package sds from 0.0.0. The library could be tricked into adding or modifying properties of the Object.prototype by abusing the set function l… |
CVE-2022-21190 | High | 7.5 | 2022-05-13 | This affects the package convict before 6.2.3. This is a bypass of [CVE-2022-22143](https://security.snyk.io/vuln/SNYK-JS-CONVICT-2340604). The [fix](https://g… |
CVE-2021-42581 | Critical | 9.1 | 2022-05-10 | Prototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to compromise integrity or availability of application via supplying… |
CVE-2022-25324 | High | 7.5 | 2022-05-06 | All versions of package bignum are vulnerable to Denial of Service (DoS) due to a type-check exception in V8, when verifying the type of the second argument to… |
CVE-2022-25301 | High | 7.7 | 2022-05-01 | All versions of package jsgui-lang-essentials are vulnerable to Prototype Pollution due to allowing all Object attributes to be altered, including their magica… |
CVE-2022-25645 | Medium | 6.5 | 2022-05-01 | All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if… |
CVE-2022-22143 | High | 7.5 | 2022-05-01 | The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. **Note:** This vulnerab… |
CVE-2022-21189 | High | 7.3 | 2022-05-01 | The package dexie before 3.2.2, from 4.0.0-alpha.1 and before 4.0.0-alpha.3 are vulnerable to Prototype Pollution in the Dexie.setByKeyPath(obj, keyPath, value… |
CVE-2022-24279 | High | 7.5 | 2022-04-15 | The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes… |
CVE-2022-21803 | High | 7.3 | 2022-04-12 | This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set… |
CVE-2022-1295 | Critical | 9.8 | 2022-04-11 | Prototype Pollution in GitHub repository alvarotrigo/fullpage.js prior to 4.0.2. |
CVE-2021-43138 | High | 7.8 | 2022-04-06 | In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterato… |
CVE-2022-24802 | High | 8.1 | 2022-04-01 | deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. deepmerge-ts is vulnerable to Prototype Pollution via file… |
CVE-2022-26260 | Critical | 9.8 | 2022-03-22 | Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse(). |
CVE-2021-44906 | Critical | 9.8 | 2022-03-17 | Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95). |
CVE-2022-25354 | High | 8.6 | 2022-03-17 | The package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. **Note… |
CVE-2022-25352 | High | 7.5 | 2022-03-17 | The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. **Note:** This vulnerability derives from an incompl… |
CVE-2022-25296 | Medium | 6.3 | 2022-03-17 | The package bodymen from 0.0.0 are vulnerable to Prototype Pollution via the handler function which could be tricked into adding or modifying properties of Obj… |
CVE-2021-44908 | Critical | 9.8 | 2022-03-17 | SailsJS Sails.js <=1.4.0 is vulnerable to Prototype Pollution via controller/load-action-modules.js, function loadActionModules(). |
CVE-2021-23771 | Medium | 6.5 | 2022-03-17 | This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. T… |
CVE-2021-43956 | Medium | 6.1 | 2022-03-16 | The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a protot… |
CVE-2022-24760 | Critical | 10.0 | 2022-03-12 | Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This… |
CVE-2022-23395 | Medium | 6.1 | 2022-03-02 | jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS). |
CVE-2022-21824 | High | 8.2 | 2022-02-24 | Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while s… |
CVE-2021-23702 | High | 7.6 | 2022-02-18 | The package object-extend from 0.0.0 are vulnerable to Prototype Pollution via object-extend. |
CVE-2022-22912 | Critical | 9.8 | 2022-02-17 | Prototype pollution vulnerability via .parse() in Plist before v3.0.4 allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution. |
CVE-2021-23682 | High | 7.3 | 2022-02-16 | This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string… |
CVE-2021-23597 | High | 7.5 | 2022-02-11 | This affects the package fastify-multipart before 5.3.1. By providing a name=constructor property it is still possible to crash the application. **Note:** This… |
CVE-2022-23631 | Critical | 9.0 | 2022-02-09 | superjson is a program to allow JavaScript expressions to be serialized to a superset of JSON. In versions prior to 1.8.1 superjson allows input to run arbitra… |
CVE-2022-23624 | High | 8.1 | 2022-02-07 | Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 and integration with… |
CVE-2022-23623 | High | 8.1 | 2022-02-07 | Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `valida… |
CVE-2021-23507 | High | 7.5 | 2022-02-04 | The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into… |
CVE-2021-23497 | High | 7.5 | 2022-02-04 | This affects the package @strikeentco/set before 1.0.2. It allows an attacker to cause a denial of service and may lead to remote code execution. **Note:** Thi… |
CVE-2021-23470 | High | 8.2 | 2022-02-04 | This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious… |
CVE-2022-0432 | Medium | 6.1 | 2022-02-02 | Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0. |
CVE-2021-23760 | Medium | 5.6 | 2022-01-28 | The package keyget from 0.0.0 are vulnerable to Prototype Pollution via the methods set, push, and at which could allow an attacker to cause a denial of servic… |
CVE-2021-23558 | High | 7.3 | 2022-01-28 | The package bmoor before 0.10.1 are vulnerable to Prototype Pollution due to missing sanitization in set function. **Note:** This vulnerability derives from an… |
CVE-2021-23518 | High | 7.3 | 2022-01-21 | The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in… |
CVE-2021-23460 | High | 7.5 | 2022-01-21 | The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types. |
CVE-2021-23594 | Critical | 9.8 | 2022-01-10 | All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector. |
CVE-2021-23568 | High | 7.3 | 2022-01-10 | The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge. |
CVE-2021-23543 | Critical | 9.8 | 2022-01-10 | All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector. |
CVE-2021-43852 | High | 8.8 | 2022-01-04 | OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into exist… |
CVE-2021-23574 | High | 7.5 | 2021-12-24 | All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of [CVE-2020-28442](h… |
CVE-2021-23450 | High | 7.5 | 2021-12-17 | All versions of package dojo are vulnerable to Prototype Pollution via the setObject function. |
CVE-2021-23700 | Medium | 6.5 | 2021-12-10 | All versions of package merge-deep2 are vulnerable to Prototype Pollution via the mergeDeep() function. |
CVE-2021-23663 | Medium | 6.5 | 2021-12-10 | All versions of package sey are vulnerable to Prototype Pollution via the deepmerge() function. |
CVE-2021-23561 | Medium | 6.5 | 2021-12-10 | All versions of package comb are vulnerable to Prototype Pollution via the deepMerge() function. |
CVE-2021-3815 | Critical | 9.8 | 2021-12-08 | utils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') |
CVE-2021-43787 | Critical | 9.0 | 2021-11-29 | Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user… |
CVE-2021-23433 | Medium | 5.9 | 2021-11-19 | The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchPara… |
CVE-2021-3918 | Critical | 9.8 | 2021-11-13 | json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') |
CVE-2021-23452 | High | 8.6 | 2021-10-20 | This affects all versions of package x-assign. The global proto object can be polluted using the __proto__ object. |
CVE-2021-23449 | Critical | 9.8 | 2021-10-18 | This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host machine. |
CVE-2021-23448 | Medium | 6.5 | 2021-10-11 | All versions of package config-handler are vulnerable to Prototype Pollution when loading config files. |
CVE-2021-41097 | Critical | 9.1 | 2021-09-27 | aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in aurelia-path before… |
CVE-2021-39227 | Medium | 6.2 | 2021-09-17 | ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src… |
CVE-2021-23442 | High | 8.6 | 2021-09-17 | This affects all versions of package @cookiex/deep. The global proto object can be polluted using the __proto__ object. |
CVE-2021-3805 | High | 7.5 | 2021-09-17 | object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') |
CVE-2021-39205 | Medium | 6.8 | 2021-09-15 | Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting proper… |
CVE-2021-3666 | Critical | 9.8 | 2021-09-13 | body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') |
CVE-2021-3645 | Critical | 9.8 | 2021-09-10 | merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') |
CVE-2021-3766 | Critical | 9.8 | 2021-09-06 | objection.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') |
CVE-2021-3757 | Critical | 9.8 | 2021-09-02 | immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') |
CVE-2021-23421 | Medium | 5.6 | 2021-08-11 | All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function. |
CVE-2021-23419 | High | 7.3 | 2021-08-08 | This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a __proto__… |
CVE-2021-32811 | High | 7.5 | 2021-08-02 | Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affect… |
CVE-2021-32807 | Medium | 4.4 | 2021-07-30 | The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications. Restricted code is any code that resides… |