CWE-1321: Prototype Pollution
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Also known as Improperly Controlled Modification of Object Prototype Attributes.
A kind of CWE-915 Mass Assignment.
From the CWE List. © The MITRE Corporation.
Newest
- 2o3t 2o3t-utility2o3t-utility v0.1.2 was discovered to contain a prototype pollution via the function extend. This...9.8 Critical
- robinweser fast-loopsrobinweser fast-loops vulnerable to prototype pollution10.0 Critical
- amoyjs commonamoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function...7.3 High
- ag-grid, ag-grid ag-grid-enterprise, ag charts +2 moreag-grid packages vulnerable to Prototype Pollution6.3 Medium
- adolphdudu ratio-swiper, swiperjs swiper +1 moreadolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function...6.5 Medium
- jrburke requirejsjrburke requirejs vulnerable to prototype pollution10.0 Critical
- adolphdudu ratio-swiper, swiperjs swiper +1 moreadolph_dudu ratio-swiper was discovered to contain a prototype pollution via the function extendDefaults6.5 Medium
- ag-grid, ag-grid ag-grid-enterprise +1 morePrototype pollution in ag-grid-community via the _.mergeDeep function9.8 Critical
- amoyjs common@amoy/common v was discovered to contain a prototype pollution via the function extend7.3 High
- richardrodger jsonic, rjrodger jsonic-next +1 morejsonic was discovered to contain a prototype pollution via the function empty.9.8 Critical
- airvert thuan frappejsfrappejs was discovered to contain a prototype pollution via the function registerView8.8 High
- akbr patch-intoakbr patch-into was discovered to contain a prototype pollution via the function patchInto8.8 High
- ageoflearning cli-lib@aofl/cli-lib Prototype Pollution vulnerability6.3 Medium
- byondreal accessorA Prototype Pollution issue in byondreal accessor <= 1.0.0 allows an attacker to execute...8.1 High
- alykoshin mini-deep-assignobject-deep-assign Prototype Pollution9.8 Critical
- prototype solution abw badger databaseBadger Database Prototype Pollution7.6 High
- cdr0 sg@cdr0/sg Prototype Pollution9.8 Critical
- akbr update@akbr/update Prototype Pollution5.9 Medium
- apphp js-object-resolverObject Resolver Prototype Pollution8.3 High
- amirziai flatten jsonflatten-json Prototype Pollution6.3 Medium
- almela obxobx Prototype Pollution9.8 Critical
- mysql2mysql2 vulnerable to Prototype Pollution8.2 High
- miguelcastillo bit-loaderMiguelCastillo @bit/loader Prototype Pollution issue8.8 High
- apidevtools json-schema-ref-parserjson-schema-ref-parser Prototype Pollution issue8.1 High
- blackprint engineBlackprint @blackprint/engine Prototype Pollution issue9.8 Critical
- jwtk njwtnjwt Prototype Pollution vulnerability5.9 Medium
- freescoutPrototype Pollution in getQueryParam Function (URL Query Parser)4.6 Medium
- jenkins, jenkins subversion partial release manager, jenkins project subversion partial release manager plugin +2 moreJenkins Subversion Partial Release Manager Plugin programmatically disables the fix for CVE-2016-37216.8 Medium
ejsnpm,node-ejsDebian,@rootio/ejsRoot +2 moreejs lacks certain pollution protection4.0 Medium- edmundhung conformConform contains Prototype Pollution Vulnerability in `parseWith...` function8.6 High
- andrei-tatar nora-firebase-common@andrei-tatar/nora-firebase-common Prototype Pollution vulnerability9.8 Critical
derbynpmPrototype pollution in emit functionNo score- mysqljs mysql2mysql2 vulnerable to Prototype Poisoning6.5 Medium
- web3 web3-utilsweb3-utils Prototype Pollution vulnerability7.5 High
- thi-ng paths@thi.ng/paths Prototype Pollution vulnerability9.8 Critical
- friendlyelec friendlywrtCryptographic key in plain text vulnerability in FriendlyElec's FriendlyWrt5.2 Medium
- jsonataJSONata expression can pollute the "Object" prototype9.8 Critical
- elijahharry hoolockhoolock does not block Prototype pollution with object-path related utilities6.3 Medium
- qnap qts, quts hero +1 moreQTS, QuTS hero7.5 High
- plotly plotly.jsplotly.js prototype pollution vulnerability9.8 Critical
- mockjs mock.jsmockjs vulnerable to Prototype Pollution via the Util.extend function8.2 High
- robinbuschmann robinbuschmann/sequelize-typescript, sequelizejs sequelize-typescript +1 morePrototype Pollution in robinbuschmann/sequelize-typescript7.5 High
- clickbar dot-diverPrototype Pollution vulnerability in @clickbar/dot-diver7.3 High
- bitrix24Bitrix24 Cross-Site Scripting (XSS) via Client-side Prototype Pollution9.6 Critical
- myshopkit winters, winters - wordpress blog theme +1 moreWinters <= 1.4.3 - Prototype Pollution to Reflected Cross-Site Scripting6.1 Medium
- wiloke your journeyYour Journey <= 1.9.8 - Prototype Pollution to Reflected Cross-Site Scripting6.1 Medium
- saleswizard nsc, national show centre nsc wordpress theme +1 morensc <= 1.0 - Prototype Pollution to Reflected Cross-Site Scripting6.1 Medium
- relative synchronyPrototype pollution vulnerability leading to arbitrary code execution in synchrony deobfuscator8.2 High
@seal-security/mongoose-fixednpmPrototype Pollution in ali-security/mongoose10.0 Critical- nasa openmctPrototype Pollution in NASA Open MCT7.5 High
- Show moreLoading…