CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (page 6)
Page 6 of 6 — CVEs classified under CWE-1321, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-25915 | Critical | 9.8 | 2021-03-09 | Prototype pollution vulnerability in 'changeset' versions 0.0.1 through 0.2.5 allows an attacker to cause a denial of service and may lead to remote code execu… |
CVE-2021-25914 | Critical | 9.8 | 2021-03-01 | Prototype pollution vulnerability in 'object-collider' versions 1.0.0 through 1.0.3 allows attacker to cause a denial of service and may lead to remote code ex… |
CVE-2021-21297 | High | 7.7 | 2021-02-26 | Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in… |
CVE-2021-27582 | Critical | 9.1 | 2021-02-23 | org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment… |
CVE-2021-25913 | Critical | 9.8 | 2021-02-08 | Prototype pollution vulnerability in 'set-or-get' version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code exec… |
CVE-2021-21304 | High | 7.2 | 2021-02-08 | Dynamoose is an open-source modeling tool for Amazon's DynamoDB. In Dynamoose from version 2.0.0 and before version 2.7.0 there was a prototype pollution vulne… |
CVE-2021-25912 | Critical | 9.8 | 2021-02-02 | Prototype pollution vulnerability in 'dotty' versions 0.0.1 through 0.1.0 allows attackers to cause a denial of service and may lead to remote code execution. |
CVE-2021-23329 | High | 7.5 | 2021-01-31 | The package nested-object-assign before 1.0.4 are vulnerable to Prototype Pollution via the default function, as demonstrated by running the PoC below. |
CVE-2020-7771 | High | 7.5 | 2021-01-04 | The package asciitable.js before 1.0.3 are vulnerable to Prototype Pollution via the main function. |
CVE-2020-28460 | Medium | 5.6 | 2020-12-22 | This affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the constructor.proto object as part of an array… |
CVE-2020-28448 | Medium | 5.6 | 2020-12-22 | This affects the package multi-ini before 2.1.1. It is possible to pollute an object's prototype by specifying the proto object as part of an array. |
CVE-2020-28458 | High | 7.3 | 2020-12-16 | All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806. |
CVE-2020-7792 | High | 7.5 | 2020-12-11 | This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn 'mixes objects int… |
CVE-2020-7788 | High | 7.3 | 2020-12-11 | This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the p… |
CVE-2020-7774 | High | 7.3 | 2020-11-17 | The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution. |
CVE-2020-28268 | High | 7.5 | 2020-11-15 | Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code e… |
CVE-2020-28271 | Critical | 9.8 | 2020-11-12 | Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution. |
CVE-2020-28270 | Critical | 9.8 | 2020-11-12 | Prototype pollution vulnerability in 'object-hierarchy-access' versions 0.2.0 through 0.32.0 allows attacker to cause a denial of service and may lead to remot… |
CVE-2020-28269 | Critical | 9.8 | 2020-11-12 | Prototype pollution vulnerability in 'field' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution. |
CVE-2020-7770 | Medium | 6.5 | 2020-11-12 | This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the… |
CVE-2020-7768 | High | 7.5 | 2020-11-11 | The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition. |
CVE-2020-7766 | High | 7.3 | 2020-11-10 | This affects all versions of package json-ptr. The issue occurs in the set operation (https://flitbit.github.io/json-ptr/classes/_src_pointer_.jsonpointer.html… |
CVE-2020-7746 | High | 7.5 | 2020-10-29 | This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the exist… |
CVE-2020-7751 | Medium | 6.0 | 2020-10-26 | pathval before version 1.1.1 is vulnerable to prototype pollution. |
CVE-2020-7748 | Medium | 5.6 | 2020-10-20 | This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Dependin… |
CVE-2020-7743 | High | 7.3 | 2020-10-13 | The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates. |
CVE-2020-7709 | Medium | 6.0 | 2020-10-05 | This affects the package json-pointer before 0.6.1. Multiple reference of object using slash is supported. |
CVE-2020-7737 | High | 7.3 | 2020-10-02 | All versions of package safetydance are vulnerable to Prototype Pollution via the set function. |
CVE-2020-7736 | High | 7.3 | 2020-10-02 | The package bmoor before 0.8.12 are vulnerable to Prototype Pollution via the set function. |
CVE-2020-8158 | Critical | 9.8 | 2020-09-18 | Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service o… |
CVE-2019-0230 | Critical | 9.8 | 2020-09-14 | Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. |
CVE-2020-7727 | Critical | 9.8 | 2020-09-01 | All versions of package gedi are vulnerable to Prototype Pollution via the set function. |
CVE-2020-7726 | Critical | 9.8 | 2020-09-01 | All versions of package safe-object2 are vulnerable to Prototype Pollution via the setter function. |
CVE-2020-7725 | Critical | 9.8 | 2020-09-01 | All versions of package worksmith are vulnerable to Prototype Pollution via the setValue function. |
CVE-2020-7724 | Critical | 9.8 | 2020-09-01 | All versions of package tiny-conf are vulnerable to Prototype Pollution via the set function. |
CVE-2020-7723 | Critical | 9.8 | 2020-09-01 | All versions of package promisehelpers are vulnerable to Prototype Pollution via the insert function. |
CVE-2020-7722 | Critical | 9.8 | 2020-09-01 | All versions of package nodee-utils are vulnerable to Prototype Pollution via the deepSet function. |
CVE-2020-7721 | Critical | 9.8 | 2020-09-01 | All versions of package node-oojs are vulnerable to Prototype Pollution via the setPath function. |
CVE-2020-7720 | Critical | 9.8 | 2020-09-01 | The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the… |
CVE-2020-7719 | Critical | 9.8 | 2020-09-01 | Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function. |
CVE-2020-7718 | Critical | 9.8 | 2020-09-01 | All versions of package gammautils are vulnerable to Prototype Pollution via the deepSet and deepMerge functions. |
CVE-2020-7717 | Critical | 9.8 | 2020-09-01 | All versions of package dot-notes are vulnerable to Prototype Pollution via the create function. |
CVE-2020-7716 | Critical | 9.8 | 2020-09-01 | All versions of package deeps are vulnerable to Prototype Pollution via the set function. |
CVE-2020-7715 | Critical | 9.8 | 2020-09-01 | All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function. |
CVE-2020-7714 | Critical | 9.8 | 2020-09-01 | All versions of package confucious are vulnerable to Prototype Pollution via the set function. |
CVE-2020-7713 | Critical | 9.8 | 2020-09-01 | All versions of package arr-flatten-unflatten are vulnerable to Prototype Pollution via the constructor. |
CVE-2020-7708 | Critical | 9.8 | 2020-08-18 | The package irrelon-path before 4.7.0; the package @irrelon/path before 4.7.0 are vulnerable to Prototype Pollution via the set, unSet, pushVal and pullVal fun… |
CVE-2020-7707 | Critical | 9.8 | 2020-08-18 | The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function. |
CVE-2020-7706 | Critical | 9.8 | 2020-08-18 | The package connie-lang before 0.1.1 are vulnerable to Prototype Pollution in the configuration language library used by connie. |
CVE-2020-7704 | Critical | 9.8 | 2020-08-17 | The package linux-cmdline before 1.0.1 are vulnerable to Prototype Pollution via the constructor. |
CVE-2020-7703 | Critical | 9.8 | 2020-08-17 | All versions of package nis-utils are vulnerable to Prototype Pollution via the setValue function. |
CVE-2020-7702 | Critical | 9.8 | 2020-08-17 | All versions of package templ8 are vulnerable to Prototype Pollution via the parse function. |
CVE-2020-7701 | Critical | 9.8 | 2020-08-14 | madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue. |
CVE-2020-7700 | Critical | 9.8 | 2020-08-14 | All versions of phpjs are vulnerable to Prototype Pollution via parse_str. |
CVE-2020-7699 | High | 7.5 | 2020-07-30 | This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or… |
CVE-2020-15366 | Medium | 5.6 | 2020-07-15 | An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows exec… |
CVE-2020-8203 | High | 7.4 | 2020-07-15 | Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20. |
CVE-2020-7679 | High | 7.3 | 2020-06-19 | In all versions of package casperjs, the mergeObjects utility function is susceptible to Prototype Pollution. |
CVE-2020-11066 | High | 8.7 | 2020-05-14 | In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, calling unserialize() on malicious u… |
CVE-2020-7644 | High | 8.1 | 2020-04-28 | fun-map through 3.3.1 is vulnerable to Prototype Pollution. The function assocInM could be tricked into adding or modifying properties of 'Object.prototype' us… |
CVE-2020-7643 | Medium | 5.3 | 2020-04-23 | paypal-adaptive through 0.4.2 manipulation of JavaScript objects resulting in Prototype Pollution. The PayPal function could be tricked into adding or modifyin… |
CVE-2020-12079 | Critical | 10.0 | 2020-04-23 | Beaker before 0.8.9 allows a sandbox escape, enabling system access and code execution. This occurs because Electron context isolation is not used, and therefo… |
CVE-2020-7618 | Medium | 5.3 | 2020-04-07 | sds through 3.2.0 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of the 'Object.prototype' by abusing th… |
CVE-2020-7616 | Medium | 5.3 | 2020-04-07 | express-mock-middleware through 0.0.6 is vulnerable to Prototype Pollution. Exported functions by the package can be tricked into adding or modifying propertie… |
CVE-2020-7639 | Medium | 5.3 | 2020-04-06 | eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function 'set' could be tricked into adding or modifying properties of 'Object.prototy… |
CVE-2020-7638 | Medium | 5.3 | 2020-04-06 | confinit through 0.3.0 is vulnerable to Prototype Pollution.The 'setDeepProperty' function could be tricked into adding or modifying properties of 'Object.prot… |
CVE-2020-7637 | Medium | 5.3 | 2020-04-06 | class-transformer before 0.3.1 allow attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying pro… |
CVE-2020-7617 | Medium | 4.4 | 2020-04-02 | ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.prototype using a '__p… |
CVE-2020-7608 | Medium | 5.3 | 2020-03-16 | yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload. |
CVE-2020-7600 | Medium | 5.3 | 2020-03-12 | querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users withou… |
CVE-2020-7598 | Medium | 5.6 | 2020-03-11 | minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload. |
CVE-2019-10808 | High | 8.8 | 2020-03-11 | utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototyp… |
CVE-2020-5258 | High | 7.7 | 2020-03-10 | In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject prope… |
CVE-2019-10806 | Medium | 4.3 | 2020-03-09 | vega-util prior to 1.13.1 allows manipulation of object prototype. The 'vega.mergeConfig' method within vega-util could be tricked into adding or modifying pro… |
CVE-2020-8116 | High | 7.3 | 2020-02-04 | Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to… |
CVE-2019-19919 | Critical | 9.8 | 2019-12-20 | Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __d… |
CVE-2019-10768 | High | 7.5 | 2019-11-19 | In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload. |
CVE-2019-17317 | High | 7.2 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard module by an Admin user. |
CVE-2019-17316 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a Regular user. |
CVE-2019-17315 | High | 7.2 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module by an Admin user. |
CVE-2019-16328 | High | 7.5 | 2019-10-03 | In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC ser… |
CVE-2019-10745 | High | 7.5 | 2019-08-20 | assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying… |
CVE-2019-14379 | Critical | 9.8 | 2019-07-29 | SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manage… |
CVE-2019-10744 | Critical | 9.1 | 2019-07-26 | Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of… |
CVE-2019-11358 | Medium | 6.1 | 2019-04-20 | jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an… |
CVE-2019-9061 | High | 8.8 | 2019-03-26 | An issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action.installmodule.php), it is possible to reach an unserialize ca… |
CVE-2019-9058 | High | 7.2 | 2019-03-26 | An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the sel_groups… |
CVE-2018-19274 | High | 7.2 | 2018-11-17 | Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization w… |
CVE-2018-19296 | High | 8.8 | 2018-11-16 | PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack. |
CVE-2018-3721 | Medium | 6.5 | 2018-06-07 | lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, w… |
CVE-2018-11135 | High | 8.8 | 2018-05-31 | The script '/adminui/error_details.php' in the Quest KACE System Management Appliance 8.0.318 allows authenticated users to conduct PHP object injection attack… |
CVE-2018-6195 | High | 7.2 | 2018-01-30 | admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator… |