CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (page 5)
Page 5 of 6 — CVEs classified under CWE-1321, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-23460 | High | 7.5 | 2022-01-21 | The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types. |
CVE-2021-23594 | Critical | 9.8 | 2022-01-10 | All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector. |
CVE-2021-23568 | High | 7.3 | 2022-01-10 | The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge. |
CVE-2021-23543 | Critical | 9.8 | 2022-01-10 | All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector. |
CVE-2021-43852 | High | 8.8 | 2022-01-04 | OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into exist… |
CVE-2021-23574 | High | 7.5 | 2021-12-24 | All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of [CVE-2020-28442](h… |
CVE-2021-23450 | High | 7.5 | 2021-12-17 | All versions of package dojo are vulnerable to Prototype Pollution via the setObject function. |
CVE-2021-23700 | Medium | 6.5 | 2021-12-10 | All versions of package merge-deep2 are vulnerable to Prototype Pollution via the mergeDeep() function. |
CVE-2021-23663 | Medium | 6.5 | 2021-12-10 | All versions of package sey are vulnerable to Prototype Pollution via the deepmerge() function. |
CVE-2021-23561 | Medium | 6.5 | 2021-12-10 | All versions of package comb are vulnerable to Prototype Pollution via the deepMerge() function. |
CVE-2021-3815 | Critical | 9.8 | 2021-12-08 | utils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') |
CVE-2021-43787 | Critical | 9.0 | 2021-11-29 | Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user… |
CVE-2021-23433 | Medium | 5.9 | 2021-11-19 | The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchPara… |
CVE-2021-3918 | Critical | 9.8 | 2021-11-13 | json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') |
CVE-2021-23452 | High | 8.6 | 2021-10-20 | This affects all versions of package x-assign. The global proto object can be polluted using the __proto__ object. |
CVE-2021-23449 | Critical | 9.8 | 2021-10-18 | This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host machine. |
CVE-2021-23448 | Medium | 6.5 | 2021-10-11 | All versions of package config-handler are vulnerable to Prototype Pollution when loading config files. |
CVE-2021-41097 | Critical | 9.1 | 2021-09-27 | aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in aurelia-path before… |
CVE-2021-39227 | Medium | 6.2 | 2021-09-17 | ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src… |
CVE-2021-23442 | High | 8.6 | 2021-09-17 | This affects all versions of package @cookiex/deep. The global proto object can be polluted using the __proto__ object. |
CVE-2021-3805 | High | 7.5 | 2021-09-17 | object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') |
CVE-2021-39205 | Medium | 6.8 | 2021-09-15 | Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting proper… |
CVE-2021-3666 | Critical | 9.8 | 2021-09-13 | body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') |
CVE-2021-3645 | Critical | 9.8 | 2021-09-10 | merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') |
CVE-2021-3766 | Critical | 9.8 | 2021-09-06 | objection.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') |
CVE-2021-3757 | Critical | 9.8 | 2021-09-02 | immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') |
CVE-2021-23421 | Medium | 5.6 | 2021-08-11 | All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function. |
CVE-2021-23419 | High | 7.3 | 2021-08-08 | This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a __proto__… |
CVE-2021-32811 | High | 7.5 | 2021-08-02 | Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affect… |
CVE-2021-32807 | Medium | 4.4 | 2021-07-30 | The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications. Restricted code is any code that resides… |
CVE-2021-23417 | Medium | 5.6 | 2021-07-28 | All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function. |
CVE-2021-23408 | Medium | 5.4 | 2021-07-21 | This affects the package com.graphhopper:graphhopper-web-bundle before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked into adding or modify… |
CVE-2021-25953 | Critical | 9.8 | 2021-07-14 | Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code executi… |
CVE-2021-25952 | Critical | 9.8 | 2021-07-07 | Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lead to remote code e… |
CVE-2021-23403 | High | 7.3 | 2021-07-02 | All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge() function due to lack of validation input. |
CVE-2021-23402 | High | 7.3 | 2021-07-02 | All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality. |
CVE-2021-32736 | High | 7.5 | 2021-06-30 | think-helper defines a set of helper functions for ThinkJS. In versions of think-helper prior to 1.1.3, the software receives input from an upstream component… |
CVE-2021-23396 | Medium | 5.6 | 2021-06-17 | All versions of package lutils are vulnerable to Prototype Pollution via the main (merge) function. |
CVE-2020-24939 | High | 7.5 | 2021-06-16 | Prototype pollution in Stampit supermixer 1.0.3 allows an attacker to modify the prototype of a base object which can vary in severity depending on the impleme… |
CVE-2021-23395 | High | 7.3 | 2021-06-15 | This affects all versions of package nedb. The library could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructo… |
CVE-2021-25949 | Critical | 9.8 | 2021-06-10 | Prototype pollution vulnerability in 'set-getter' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution. |
CVE-2021-25948 | Critical | 9.8 | 2021-06-10 | Prototype pollution vulnerability in 'expand-hash' versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code exe… |
CVE-2021-25947 | Critical | 9.8 | 2021-06-03 | Prototype pollution vulnerability in 'nestie' versions 0.0.0 through 1.0.0 allows an attacker to cause a denial of service and may lead to remote code executio… |
CVE-2021-26707 | Critical | 9.8 | 2021-06-02 | The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties… |
CVE-2021-25945 | Critical | 9.8 | 2021-05-26 | Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code executio… |
CVE-2021-25946 | Critical | 9.8 | 2021-05-25 | Prototype pollution vulnerability in `nconf-toml` versions 0.0.1 through 0.0.2 allows an attacker to cause a denial of service and may lead to remote code exec… |
CVE-2021-25944 | Critical | 9.8 | 2021-05-25 | Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code exec… |
CVE-2021-25943 | Critical | 9.8 | 2021-05-14 | Prototype pollution vulnerability in '101' versions 1.0.0 through 1.6.3 allows an attacker to cause a denial of service and may lead to remote code execution. |
CVE-2021-25941 | Critical | 9.8 | 2021-05-14 | Prototype pollution vulnerability in 'deep-override' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code e… |
CVE-2021-23383 | Medium | 5.6 | 2021-05-04 | The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untruste… |
CVE-2021-28860 | Critical | 9.1 | 2021-05-03 | In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The pollute… |
CVE-2021-25928 | Critical | 9.8 | 2021-04-26 | Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execut… |
CVE-2021-25927 | Critical | 9.8 | 2021-04-26 | Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execu… |
CVE-2021-20089 | High | 8.8 | 2021-04-23 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in purl 2.3.2 allows a malicious user to inject properties into Objec… |
CVE-2021-20086 | High | 8.8 | 2021-04-23 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-bbq 1.2.1 allows a malicious user to inject properties into… |
CVE-2021-20085 | High | 8.8 | 2021-04-23 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in backbone-query-parameters 0.4.0 allows a malicious user to inject… |
CVE-2021-20083 | High | 8.8 | 2021-04-23 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-plugin-query-object 2.2.3 allows a malicious user to inject… |
CVE-2021-20088 | High | 8.8 | 2021-04-23 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in mootools-more 1.6.0 allows a malicious user to inject properties i… |
CVE-2021-20087 | High | 8.8 | 2021-04-23 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-deparam 0.5.1 allows a malicious user to inject properties… |
CVE-2021-20084 | High | 8.8 | 2021-04-23 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-sparkle 1.5.2-beta allows a malicious user to inject proper… |
CVE-2021-25916 | Critical | 9.8 | 2021-03-16 | Prototype pollution vulnerability in 'patchmerge' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code exec… |
CVE-2021-21368 | Medium | 6.7 | 2021-03-12 | msgpack5 is a msgpack v5 implementation for node.js and the browser. In msgpack5 before versions 3.6.1, 4.5.1, and 5.2.1 there is a "Prototype Poisoning" vulne… |
CVE-2021-25915 | Critical | 9.8 | 2021-03-09 | Prototype pollution vulnerability in 'changeset' versions 0.0.1 through 0.2.5 allows an attacker to cause a denial of service and may lead to remote code execu… |
CVE-2021-25914 | Critical | 9.8 | 2021-03-01 | Prototype pollution vulnerability in 'object-collider' versions 1.0.0 through 1.0.3 allows attacker to cause a denial of service and may lead to remote code ex… |
CVE-2021-21297 | High | 7.7 | 2021-02-26 | Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in… |
CVE-2021-27582 | Critical | 9.1 | 2021-02-23 | org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment… |
CVE-2021-25913 | Critical | 9.8 | 2021-02-08 | Prototype pollution vulnerability in 'set-or-get' version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code exec… |
CVE-2021-21304 | High | 7.2 | 2021-02-08 | Dynamoose is an open-source modeling tool for Amazon's DynamoDB. In Dynamoose from version 2.0.0 and before version 2.7.0 there was a prototype pollution vulne… |
CVE-2021-25912 | Critical | 9.8 | 2021-02-02 | Prototype pollution vulnerability in 'dotty' versions 0.0.1 through 0.1.0 allows attackers to cause a denial of service and may lead to remote code execution. |
CVE-2021-23329 | High | 7.5 | 2021-01-31 | The package nested-object-assign before 1.0.4 are vulnerable to Prototype Pollution via the default function, as demonstrated by running the PoC below. |
CVE-2020-7771 | High | 7.5 | 2021-01-04 | The package asciitable.js before 1.0.3 are vulnerable to Prototype Pollution via the main function. |
CVE-2020-28460 | Medium | 5.6 | 2020-12-22 | This affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the constructor.proto object as part of an array… |
CVE-2020-28448 | Medium | 5.6 | 2020-12-22 | This affects the package multi-ini before 2.1.1. It is possible to pollute an object's prototype by specifying the proto object as part of an array. |
CVE-2020-28458 | High | 7.3 | 2020-12-16 | All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806. |
CVE-2020-7792 | High | 7.5 | 2020-12-11 | This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn 'mixes objects int… |
CVE-2020-7788 | High | 7.3 | 2020-12-11 | This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the p… |
CVE-2020-7774 | High | 7.3 | 2020-11-17 | The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution. |
CVE-2020-28268 | High | 7.5 | 2020-11-15 | Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code e… |
CVE-2020-28271 | Critical | 9.8 | 2020-11-12 | Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution. |
CVE-2020-28270 | Critical | 9.8 | 2020-11-12 | Prototype pollution vulnerability in 'object-hierarchy-access' versions 0.2.0 through 0.32.0 allows attacker to cause a denial of service and may lead to remot… |
CVE-2020-28269 | Critical | 9.8 | 2020-11-12 | Prototype pollution vulnerability in 'field' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution. |
CVE-2020-7770 | Medium | 6.5 | 2020-11-12 | This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the… |
CVE-2020-7768 | High | 7.5 | 2020-11-11 | The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition. |
CVE-2020-7766 | High | 7.3 | 2020-11-10 | This affects all versions of package json-ptr. The issue occurs in the set operation (https://flitbit.github.io/json-ptr/classes/_src_pointer_.jsonpointer.html… |
CVE-2020-7746 | High | 7.5 | 2020-10-29 | This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the exist… |
CVE-2020-7751 | Medium | 6.0 | 2020-10-26 | pathval before version 1.1.1 is vulnerable to prototype pollution. |
CVE-2020-7748 | Medium | 5.6 | 2020-10-20 | This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Dependin… |
CVE-2020-7743 | High | 7.3 | 2020-10-13 | The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates. |
CVE-2020-7709 | Medium | 6.0 | 2020-10-05 | This affects the package json-pointer before 0.6.1. Multiple reference of object using slash is supported. |
CVE-2020-7737 | High | 7.3 | 2020-10-02 | All versions of package safetydance are vulnerable to Prototype Pollution via the set function. |
CVE-2020-7736 | High | 7.3 | 2020-10-02 | The package bmoor before 0.8.12 are vulnerable to Prototype Pollution via the set function. |
CVE-2020-8158 | Critical | 9.8 | 2020-09-18 | Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service o… |
CVE-2019-0230 | Critical | 9.8 | 2020-09-14 | Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. |
CVE-2020-7727 | Critical | 9.8 | 2020-09-01 | All versions of package gedi are vulnerable to Prototype Pollution via the set function. |
CVE-2020-7726 | Critical | 9.8 | 2020-09-01 | All versions of package safe-object2 are vulnerable to Prototype Pollution via the setter function. |
CVE-2020-7725 | Critical | 9.8 | 2020-09-01 | All versions of package worksmith are vulnerable to Prototype Pollution via the setValue function. |
CVE-2020-7724 | Critical | 9.8 | 2020-09-01 | All versions of package tiny-conf are vulnerable to Prototype Pollution via the set function. |
CVE-2020-7723 | Critical | 9.8 | 2020-09-01 | All versions of package promisehelpers are vulnerable to Prototype Pollution via the insert function. |
CVE-2020-7722 | Critical | 9.8 | 2020-09-01 | All versions of package nodee-utils are vulnerable to Prototype Pollution via the deepSet function. |
CVE-2020-7721 | Critical | 9.8 | 2020-09-01 | All versions of package node-oojs are vulnerable to Prototype Pollution via the setPath function. |