CWE-1321: Prototype Pollution
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Also known as Improperly Controlled Modification of Object Prototype Attributes.
A kind of CWE-915 Mass Assignment.
From the CWE List. © The MITRE Corporation.
Newest
- feather js feathers-sequalize, feathersjs feathers-sequelize +1 moreFeathers - Query “__proto__” is converted to real prototype10.0 Critical
- uglifyjs project uglifyjsPrototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the...9.8 Critical
- grunt-karma project grunt-karmaGrunt-karma vulnerable to prototype pollution9.8 Critical
- mockery project mockerymockery is vulnerable to prototype pollution9.8 Critical
- gh-pages project gh-pagestschaub gh-pages vulnerable to prototype pollution9.8 Critical
- webpack.js loader-utils, debian linux +1 morePrototype pollution in webpack loader-utils9.8 Critical
- browserify-shim project browserify-shimthlorenz browserify-shim vulnerable to prototype pollution9.8 Critical
- xmldom project xmldom, debian linux +1 moreWithdrawn: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @xmldom/xmldom and xmldom9.8 Critical
- js-beautify project js-beautifyPrototype pollution vulnerability in beautify-web js-beautify 1.13.7 via the name variable in...9.8 Critical
- ahmedadelfahim express-xss-sanitizer, express xss sanitizer project xss sanitizer +1 morePrototype Pollution7.3 High
- hapijs hoekhoek subject to prototype pollution via the clone function.8.1 High
- stealjs stealsteal vulnerable to Prototype Pollution via alias variable9.8 Critical
- stealjs stealsteal vulnerable to Prototype Pollution9.8 Critical
- stealjs stealsteal vulnerable to Prototype Pollution via optionName variable9.8 Critical
- stealjs stealsteal vulnerable to Prototype Pollution via requestedVersion variable9.8 Critical
- stealjs stealsteal vulnerable to Prototype Pollution via key variable in babel.js9.8 Critical
- matrix-org matrix-js-sdk, matrix javascript sdk +1 morePrototype pollution in matrix-js-sdk8.2 High
- postgresql, fedoraproject fedora, redhat enterprise linux +2 moreA vulnerability found in postgresql. On this security issue an attack requires permission to...8.0 High
- typescript deep merge project deep mergePrototype Pollution7.5 High
- automattic automattic/mongoose, mongoosejs mongoose +1 morePrototype Pollution in automattic/mongoose7.0 High
- set-deep-prop project set-deep-propPrototype Pollution7.5 High
- merge project mergePrototype Pollution5.6 Medium
- ion-parser project ion-parserPrototype Pollution7.3 High
- js-ini project js-iniPrototype Pollution7.3 High
- conf-cfg-ini project conf-cfg-iniPrototype Pollution7.3 High
- properties-reader project properties-readerPrototype Pollution7.3 High
- grunt-util-property project grunt-util-propertyPrototype Pollution4.0 Medium
- deep.assign project deep.assignPrototype Pollution in deep.assign9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreIf an object prototype was corrupted by an attacker, they would have been able to set undesired...8.8 High
- clever underscore.deepPrototype Pollution in underscore.deep8.3 High
- deep-get-set project deep-get-setPrototype Pollution7.5 High
- querymen project querymenPrototype Pollution5.9 Medium
- moutjs moutPrototype Pollution7.5 High
- protobufjs project protobufjsPrototype Pollution8.2 High
- mozilla firefox, firefox esr, firefox for android +1 more +3 moreIf an attacker was able to corrupt the methods of an Array object in JavaScript via prototype...8.8 High
- mozilla firefox, firefox esr, firefox for android +1 more +3 moreAn attacker could have sent a message to the parent process where the contents were used to...8.8 High
- moxa sdsPrototype Pollution4.0 Medium
- mozilla convictPrototype Pollution7.5 High
- ramdajs ramdaPrototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to...9.1 Critical
- bignum project bignumDenial of Service (DoS)7.5 High
- jsgui-lang-essentials project jsgui-lang-essentialsPrototype Pollution7.7 High
- dset project dsetPrototype Pollution6.5 Medium
- dexiePrototype Pollution7.3 High
- mozilla convictPrototype Pollution7.5 High
- springtree madlib-object-utilsPrototype Pollution7.5 High
- nconf project nconfPrototype Pollution7.3 High
- alvarotrigo alvarotrigo/fullpage.js, fullpage project fullpage +1 morePrototype Pollution in alvarotrigo/fullpage.js7.3 High
- async project async, fedoraproject fedora +1 morePrototype Pollution in async7.8 High
- deepmerge-ts project deepmerge-tsPrototype Pollution in deepmerge-ts8.1 High
- simple-plist project simple-plistPrototype Pollution in simple-plist9.8 Critical
- Show moreLoading…