CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (page 7)
Page 7 of 7 — CVEs classified under CWE-1321, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-7608 | Medium | 5.3 | 2020-03-16 | yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload. |
CVE-2020-7600 | Medium | 5.3 | 2020-03-12 | querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users withou… |
CVE-2020-7598 | Medium | 5.6 | 2020-03-11 | minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload. |
CVE-2019-10808 | High | 8.8 | 2020-03-11 | utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototyp… |
CVE-2020-5258 | High | 7.7 | 2020-03-10 | In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject prope… |
CVE-2019-10806 | Medium | 4.3 | 2020-03-09 | vega-util prior to 1.13.1 allows manipulation of object prototype. The 'vega.mergeConfig' method within vega-util could be tricked into adding or modifying pro… |
CVE-2020-8116 | High | 7.3 | 2020-02-04 | Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to… |
CVE-2019-19919 | Critical | 9.8 | 2019-12-20 | Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __d… |
CVE-2019-10768 | High | 7.5 | 2019-11-19 | In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload. |
CVE-2019-17317 | High | 7.2 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard module by an Admin user. |
CVE-2019-17316 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a Regular user. |
CVE-2019-17315 | High | 7.2 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module by an Admin user. |
CVE-2019-16328 | High | 7.5 | 2019-10-03 | In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC ser… |
CVE-2019-10745 | High | 7.5 | 2019-08-20 | assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying… |
CVE-2019-14379 | Critical | 9.8 | 2019-07-29 | SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manage… |
CVE-2019-10744 | Critical | 9.1 | 2019-07-26 | Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of… |
CVE-2019-11358 | Medium | 6.1 | 2019-04-20 | jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an… |
CVE-2019-9061 | High | 8.8 | 2019-03-26 | An issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action.installmodule.php), it is possible to reach an unserialize ca… |
CVE-2019-9058 | High | 7.2 | 2019-03-26 | An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the sel_groups… |
CVE-2018-19274 | High | 7.2 | 2018-11-17 | Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization w… |
CVE-2018-19296 | High | 8.8 | 2018-11-16 | PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack. |
CVE-2018-3721 | Medium | 6.5 | 2018-06-07 | lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, w… |
CVE-2018-11135 | High | 8.8 | 2018-05-31 | The script '/adminui/error_details.php' in the Quest KACE System Management Appliance 8.0.318 allows authenticated users to conduct PHP object injection attack… |
CVE-2018-6195 | High | 7.2 | 2018-01-30 | admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator… |