CWE-471: Modification of Assumed-Immutable Data (MAID)
The product does not properly protect an assumed-immutable element from being modified by an attacker.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- cure53 dompurifyDOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig5.1 Medium
- fast-uri, red hat cluster observability operator 1.5.0, confidential compute attestation +53 more +55 morefast-uri vulnerable to host confusion via percent-encoded authority delimiters7.5 High
- fast-uri, red hat cluster observability operator 1.5.0, confidential compute attestation +32 more +34 morefast-uri vulnerable to path traversal via percent-encoded dot segments7.5 High
- chimurai http-proxy-middlewarehttp-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass6.9 Medium
- cure53 dompurifyDOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content6.3 Medium
- cure53 dompurifyDOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM6.1 Medium
- cure53 dompurifyDOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks6.1 Medium
- cure53 dompurifyDOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)6.0 Medium
- cure53 dompurifyDOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode6.8 Medium
- cure53 dompurifyDOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback6.9 Medium
- chimurai http-proxy-middlewareArbitrary Code Execution in handlebars4.0 Medium
- chimurai http-proxy-middlewareArbitrary Code Execution in handlebars4.0 Medium
- cure53 dompurifyArbitrary Code Execution in handlebars4.5 Medium
- cure53 dompurifyDOMPurify nesting-based mXSS10.0 Critical
- cure53 dompurifyTampering by prototype polution in DOMPurify7.3 High
- log4js-node, log4js project log4js, debian linux +2 moreIncorrect Default Permissions in log4js-node5.5 Medium
- handlebarsjs handlebars, netapp e-series performance analyzer +1 morePrototype Pollution5.6 Medium
- handlebarsjs handlebarsRemote Code Execution (RCE)5.6 Medium
- handlebarsjs handlebarsArbitrary Code Execution in handlebars8.1 High
- handlebars.js project handlebars.js, tenable tenable.sc +1 moreArbitrary Code Execution in handlebars9.8 Critical
- defaults-deep project defaults-deep, hackerone defaults-deep node module +1 morePrototype Pollution in defaults-deep8.8 High
- hackerone merge-deep node module, merge-deep project merge-deep +1 morePrototype Pollution in merge-deep8.8 High
- hackerone lodash node module, lodash, netapp active iq unified manager +1 more +3 morePrototype Pollution in lodash6.5 Medium
- assign-deep project assign-deep, hackerone assign-deep node module +1 morePrototype Pollution in assign-deep8.8 High
- hackerone mixin-deep node module, mixin-deep project mixin-deep +1 morePrototype Pollution in mixin-deep8.8 High
- hapi hoek node module, hapijs hoek +1 morePrototype Pollution in hoek8.8 High
- handlebars.js project handlebars.jsArbitrary Code Execution in handlebars6.1 Medium
- moodleMoodle Allows Modification of Constants5.0 Medium