CWE-1321: Prototype Pollution
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Also known as Improperly Controlled Modification of Object Prototype Attributes.
A kind of CWE-915 Mass Assignment.
From the CWE List. © The MITRE Corporation.
Newest
- client jointjsPrototype Pollution5.6 Medium
mixmenpmPrototype Pollution in mixmeNo score- baidu zrenderFix prototype pollution in the zrender merge and clone helper methods6.2 Medium
- cookiex-deep project cookiex-deepPrototype Pollution8.6 High
- mariocasciaro mariocasciaro/object-path, object-path project object-path, debian linux +2 morePrototype Pollution in mariocasciaro/object-path7.5 High
- 8x8 jitsi meet, jitsi jitsi-meet +1 moreDOM-based XSS/Content Spoofing via Prototype Pollution6.8 Medium
- fiznool fiznool/body-parser-xml, xml body parser project body parser +1 morePrototype Pollution in fiznool/body-parser-xml7.6 High
- set-value project set-value, oracle communications cloud native core policy +1 morePrototype Pollution7.3 High
- merge project merge, viking04 viking04/merge +1 morePrototype Pollution in viking04/merge6.8 Medium
- objection project objection, vincit vincit/objection.js +1 morePrototype Pollution in vincit/objection.js7.5 High
- immer project immer, immerjs immerjs/immer +1 morePrototype Pollution in immerjs/immer7.5 High
- immer project immerPrototype Pollution5.6 Medium
- proto project protoPrototype Pollution5.6 Medium
- mariocasciaro object-path, debian linux +1 morePrototype Pollution5.6 Medium
- mootools project mootoolsPrototype Pollution5.4 Medium
- merge-change project merge-changePrototype Pollution5.6 Medium
- open-graph project open-graphPrototype Pollution7.3 High
think-confignpmImproperly Controlled Modification of Object Prototype Attributes7.5 High- zope, zope accesscontrol +1 moreRemote Code Execution via Script (Python) objects under Python 37.5 High
- zope accesscontrolRemote Code Execution via unsafe classes in otherwise permitted modules4.4 Medium
- deepmergefn project deepmergefnPrototype Pollution5.6 Medium
- jszip project jszipDenial of Service (DoS)5.3 Medium
- graphhopperPrototype Pollution5.4 Medium
- putil-merge project putil-mergePrototype Pollution in putil-merge9.8 Critical
- just-safe-set project just-safe-setPrototype polluation in just-safe-set9.8 Critical
- ts-nodash project ts-nodashPrototype Pollution7.3 High
- record-like-deep-assign project record-like-deep-assignPrototype Pollution7.3 High
- naturalintelligence fast xml parserfast-xml-parser vulnerable to Prototype Pollution through tag or attribute name6.5 Medium
- apache druidApache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended6.5 Medium
- thinkjs think-helperImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in think-helper7.5 High
- lutils project lutilsPrototype Pollution5.6 Medium
- stampit supermixerPrototype pollution in supermixer7.5 High
- nedb project nedbPrototype Pollution7.3 High
- set-getter project set-getterset-getter Prototype Pollution Vulnerability9.8 Critical
- expand-hash project expand-hashPrototype Pollution9.8 Critical
- nestie project nestiePrototype pollution in nestie9.8 Critical
- merge-deep project merge-deep, netapp e-series performance analyzer +1 morePrototype pollution in Merge-deep9.8 Critical
- js-extend project js-extendPrototype pollution vulnerability in js-extend9.8 Critical
- nconf-toml project nconf-tomlPrototype pollution in nconf-toml9.8 Critical
- deep-defaults project deep-defaultsdeep-defaults vulnerable to prototype pollution9.8 Critical
- deep-override project deep-overridePrototype Pollution in deep-override9.8 Critical
- 101 project 101Prototype pollution in 1019.8 Critical
- adaltas mixmePrototype Pollution in mixme9.1 Critical
- manta safe-objPrototype pollution in safe-obj9.8 Critical
- safe-flat project safe-flatPrototype pollution in safe-flat9.8 Critical
- jquery-plugin-query-object project jquery-plugin-query-objectjquery-plugin-query-object contains prototype pollution vulnerability8.8 High
- backbone-query-parameters project backbone-query-parametersPrototype Pollution in backbone-query-parameters8.8 High
- purl project purlImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in purl...8.8 High
- jquery-bbq project jquery-bbqPrototype Pollution in jquery-bbq8.8 High
- acemetrix jquery-deparamPrototype Pollution in jquery-deparam8.8 High
- Show moreLoading…