CWE-471: Modification of Assumed-Immutable Data (MAID)
The product does not properly protect an assumed-immutable element from being modified by an attacker.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- i18next i18next: Shared built-in corruption through inherited-key deepExtend recursion 5.9 Medium
- libredwg LibreDWG: const-input mutation and crash in bit_TV_to_utf8 error handling 3.3 Low
- mcollina msgpack5 msgpack5: Decoding negative int64 values mutates the input buffer 3.7 Low
- jpadilla pyjwt PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse 6.5 Medium
- patriksimek vm2 vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor 6.3 Medium
- jenkins project gitlab plugin Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection... 5.4 Medium
- spring cloud function, vmware spring cloud function +1 more Composition lookup can potentially poison base function in Spring Cloud Function 3.1 Low
- microsoft azure active directory Azure Active Directory Elevation of Privilege Vulnerability 9.9 Critical
- angular Angular Client Hydration DOM Clobbering & Response-Cache Poisoning 8.6 High
- drupal translate drupal with gtranslate, gtranslate +1 more Translate Drupal with GTranslate - Less critical - DOM clobbering / link manipulation - SA-CONTRIB-2026-035 2.7 Low
- nautobot Nautobot: GitRepository.current_head field should not be writable through REST API 7.1 High
- emilstenstrom justhtml justhtml before 1.17.0 Multiple Cross-Site Scripting Vulnerabilities 5.1 Medium
- emilstenstrom justhtml justhtml before 1.16.0 Multiple Security Issues via Sanitization 9.3 Critical
- No product listed An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, proto, and Object.assign components. NOTE: this is disputed by the Supplier who do… 5.7 Medium
- ibm aspera faspex IBM Aspera Faspex data modification 7.1 High
- abb anc, anc-l, anc-mini +2 more Application is vulnerable to Privilege escalation 8.5 High
- exasol jdbc driver An issue was discovered in Exasol jdbc driver 24.2.0. Attackers can inject malicious parameters... 8.3 High
- ibm security verify bridge IBM Security Verify Bridge data manipulation 6.0 Medium
- ibm qradar wincollect agent, qradar wincollect +1 more IBM QRadar WinCollect Agent data manipulation 4.0 Medium
- neo4j Neo4j Cypher component mishandles IMMUTABLE privileges 6.5 Medium
- matter-labs era-compiler-vyper, zkvyper +1 more era-compiler-vyper First Immutable Variable Initialization vulnerability 5.3 Medium
- sick apu0200, apu0200 firmware +1 more Modification of Assumed-Immutable Data (MAID) in RDT400 in SICK APU allows an unprivileged... 6.5 Medium
- hid global safe CVE-2023-2904 7.3 High
- patriksimek vm2 Arbitrary Code Execution 9.8 Critical
- gitlab A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to... 3.5 Low
- google llc play services sdk, google play services software development kit +1 more Mutable pending intent in Google Play services SDK 6.1 Medium
- krakend, krakend krakend-ce, krakend-ee +2 more +4 more Crafted backend URLs in Lura Project 4.0 Medium
- nodejs node, node.js, debian linux +9 more +11 more Due to the formatting logic of the "console.table()" function it was not safe to allow user... 8.2 High
- meta platforms, inc ray-ban® stories smart glasses, ray-ban stories rw4002 601\/71 50-22 firmware, stories rw4003 65582v 48-23 firmware +2 more +4 more A logic flaw in Ray-Ban® Stories device software allowed some parameters like video capture... 5.3 Medium
- digitalbazaar forge Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store 3.7 Low
- azeotech daqfactory AzeoTech DAQFactory 5.0 Medium
- siemens sinema remote connect server A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). An... 4.3 Medium
- siemens sinema remote connect server A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2).... 6.5 Medium
- immer project immer Prototype Pollution 7.5 High
- google tensorflow Write to immutable memory region in TensorFlow 4.4 Medium
- sebhildebrandt systeminformation Prototype Pollution leading to Command Injection in systeminformation 8.1 High
- highlightjs highlight.js, debian linux, oracle mysql enterprise monitor +2 more Prototype Pollution in highlight.js 5.8 Medium
-
json-logic-jsnpm Prototype Pollution in json-logic-js No score - json8-merge-patch project json8-merge-patch Prototype pollution in json8-merge-patch 7.5 High
- mariocasciaro object-path Prototype pollution in object-path 7.7 High
- typeorm TypeORM vulnerable to MAID and Prototype Pollution 9.8 Critical
- utils-extend project utils-extend Prototype Pollution 9.8 Critical
- dot-prop project dot-prop dot-prop Prototype Pollution vulnerability 7.3 High
- cure53 dompurify DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING 5.1 Medium
- cure53 dompurify DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization 5.3 Medium
- cure53 dompurify DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES 5.1 Medium
- cure53 dompurify DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR 5.1 Medium
- cure53 dompurify DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS 5.1 Medium
- cure53 dompurify DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags 5.3 Medium
- cure53 dompurify DOMPurify before 3.4.9 Trusted Types Policy State Contamination 5.1 Medium
- Show olderLoading…