CWE-915: Mass Assignment
The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Also known as Improperly Controlled Modification of Dynamically-Determined Object Attributes, AutoBinding, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- irrelon irrelon-path, \@irrelon\/path +1 morePrototype Pollution9.8 Critical
- property-expr project property-exprPrototype Pollution9.8 Critical
- connie-lang project connie-langPrototype Pollution9.8 Critical
- nis-utils project nis-utilsPrototype Pollution9.8 Critical
- templ8 project templ8Prototype Pollution9.8 Critical
- springtree madlib-object-utilsPrototype Pollution9.8 Critical
- express-fileupload project express-fileupload, netapp max data +1 morePrototype Pollution7.5 High
- ajv.js ajvPrototype Pollution in Ajv5.6 Medium
- casperjsPrototype Pollution7.3 High
- typo3, typo3 cms +1 moreImproperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMS8.7 High
- fun-map project fun-mapUncontrolled Resource Consumption in fun-map8.1 High
- bluetrace opentraceThe Cloud Functions subsystem in OpenTrace 1.0 might allow fabrication attacks by making billions...7.5 High
- moxa sdsPrototype Pollution in sds5.3 Medium
- express-mock-middleware project express-mock-middlewareImproperly Controlled Modification of Dynamically-Determined Object Attributes in express-mock-middleware5.3 Medium
- dot project doteivindfjeldstad-dot contains prototype pollution vulnerability5.3 Medium
- confinit project confinitconfinit vulnerable to prototype pollution5.3 Medium
- class-transformer project class-transformerPrototype pollution in class-transformer5.3 Medium
- ini-parser project ini-parserPrototype Pollution4.4 Medium
- yargs yargs-parseryargs-parser Vulnerable to Prototype Pollution5.3 Medium
- querymen project querymenImproperly Controlled Modification of Dynamically-Determined Object Attributes in querymen5.3 Medium
- xcritical.software utilitifyImproperly Controlled Modification of Dynamically-Determined Object Attributes in utilitify8.8 High
- vega project vegaImproperly Controlled Modification of Dynamically-Determined Object Attributes in vega-util4.3 Medium
- assign-deep project assign-deepassign-deep Vulnerable to Prototype Pollution7.5 High
- fasterxml jackson-databind, apple xcode, debian linux +21 more +23 moreDeserialization of untrusted data in FasterXML jackson-databind9.8 Critical
- angularjsCross-Site Scripting via JSONP7.5 High
- cmsmadesimple cms made simpleAn issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm...7.2 High
- cmsmadesimple cms made simpleAn issue was discovered in CMS Made Simple 2.2.8. In the module FilePicker, it is possible to...8.8 High
- phpmailer project phpmailer, debian linux, fedoraproject fedora +1 more +3 morePhar object injection in PHPMailer8.8 High
- quest kace system management applianceThe script '/adminui/error_details.php' in the Quest KACE System Management Appliance 8.0.318...8.8 High
- splashing images project imagesadmin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images)...7.2 High