CWE-471 · Modification of Assumed-Immutable Data (MAID)
36 CVEs classified under CWE-471 (Modification of Assumed-Immutable Data (MAID)). Browse by severity and year.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-25893 | Critical | 9.8 | 2022-12-21 | The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting… |
CVE-2020-8158 | Critical | 9.8 | 2020-09-18 | Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service o… |
CVE-2020-8147 | Critical | 9.8 | 2020-04-03 | Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that may result in remote code execution or… |
CVE-2018-3723 | High | 8.8 | 2018-06-07 | defaults-deep node module before 0.2.4 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the… |
CVE-2018-3722 | High | 8.8 | 2018-06-07 | merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the pro… |
CVE-2018-3720 | High | 8.8 | 2018-06-07 | assign-deep node module before 0.4.7 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the pr… |
CVE-2018-3719 | High | 8.8 | 2018-06-07 | mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the pro… |
CVE-2018-3728 | High | 8.8 | 2018-03-30 | hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefault… |
CVE-2024-55551 | High | 8.3 | 2025-03-19 | An issue was discovered in Exasol JDBC driver before 24.2.1 (2024-12-10). Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injectio… |
CVE-2022-21824 | High | 8.2 | 2022-02-24 | Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while s… |
CVE-2020-26245 | High | 8.1 | 2020-11-27 | npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. The issue was fixed with a rewrite of sh… |
CVE-2020-15256 | High | 7.7 | 2020-10-19 | A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInherit… |
CVE-2020-8268 | High | 7.5 | 2020-11-09 | Prototype pollution vulnerability in json8-merge-patch npm package < 1.0.3 may allow attackers to inject or modify methods and properties of the global object… |
CVE-2024-9876 | High | 7.3 | 2025-04-30 | : Modification of Assumed-Immutable Data (MAID) vulnerability in ABB ANC, ABB ANC-L, ABB ANC-mini.This issue affects ANC: through 1.1.4; ANC-L: through 1.1.4… |
CVE-2023-2904 | High | 7.3 | 2023-06-07 | The External Visitor Manager portal of HID’s SAFE versions 5.8.0 through 5.11.3 are vulnerable to manipulation within web fields in the application programmabl… |
CVE-2020-8116 | High | 7.3 | 2020-02-04 | Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to… |
CVE-2026-44798 | High | 7.1 | 2026-05-28 | Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, a user with access to add/change a GitRepository record could… |
CVE-2025-33136 | High | 7.1 | 2025-05-22 | IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another u… |
CVE-2024-34517 | Medium | 6.5 | 2024-05-07 | The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access. |
CVE-2023-43697 | Medium | 6.5 | 2023-10-09 | Modification of Assumed-Immutable Data (MAID) in RDT400 in SICK APU allows an unprivileged remote attacker to make the site unable to load necessary strings v… |