CWE-915: Mass Assignment
The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Also known as Improperly Controlled Modification of Dynamically-Determined Object Attributes, AutoBinding, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- gravitl netmakerNetmaker Privilige Escalation Vulnerability8.8 High
- huawei emui, harmonyos +1 moreThe recovery mode for updates has a vulnerability that causes arbitrary disk modification....7.5 High
- ghost sqlite3, ghost foundation node-sqlite3 +1 moresqlite vulnerable to code execution due to Object coercion8.1 High
- yugabyte yugabytedb managed, yugabytedb anywhere +1 moreServer-Side Request Forgery6.8 Medium
- librenms, librenms librenms/librenms +1 moreImproperly Controlled Modification of Dynamically-Determined Object Attributes in librenms/librenms7.6 High
- postgresql, fedoraproject fedora, redhat enterprise linux +2 moreA vulnerability found in postgresql. On this security issue an attack requires permission to...8.0 High
- clever underscore.deepPrototype Pollution in underscore.deep8.3 High
- deepmerge-ts project deepmerge-tsPrototype Pollution in deepmerge-ts8.1 High
- algolia algoliasearch-helperPrototype Pollution5.9 Medium
- json-schema project json-schema, kriszyp kriszyp/json-schema, debian linux +2 morePrototype Pollution in kriszyp/json-schema9.8 Critical
- binaryops x-assignPrototype Pollution8.6 High
- patriksimek vm2Sandbox Bypass9.8 Critical
- aurelia path, bluespire aurelia-path +1 morePrototype pollution in aurelia-path9.1 Critical
- baidu zrenderFix prototype pollution in the zrender merge and clone helper methods6.2 Medium
- cookiex-deep project cookiex-deepPrototype Pollution8.6 High
- mariocasciaro mariocasciaro/object-path, object-path project object-path, debian linux +2 morePrototype Pollution in mariocasciaro/object-path7.5 High
- fiznool fiznool/body-parser-xml, xml body parser project body parser +1 morePrototype Pollution in fiznool/body-parser-xml7.6 High
- merge project merge, viking04 viking04/merge +1 morePrototype Pollution in viking04/merge6.8 Medium
- objection project objection, vincit vincit/objection.js +1 morePrototype Pollution in vincit/objection.js7.5 High
- immer project immer, immerjs immerjs/immer +1 morePrototype Pollution in immerjs/immer7.5 High
- merge-change project merge-changePrototype Pollution5.6 Medium
- open-graph project open-graphPrototype Pollution7.3 High
- zope, zope accesscontrol +1 moreRemote Code Execution via Script (Python) objects under Python 37.5 High
- zope accesscontrolRemote Code Execution via unsafe classes in otherwise permitted modules4.4 Medium
- deepmergefn project deepmergefnPrototype Pollution5.6 Medium
- just-safe-set project just-safe-setPrototype polluation in just-safe-set9.8 Critical
- ts-nodash project ts-nodashPrototype Pollution7.3 High
- record-like-deep-assign project record-like-deep-assignPrototype Pollution7.3 High
- thinkjs think-helperImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in think-helper7.5 High
- set-getter project set-getterset-getter Prototype Pollution Vulnerability9.8 Critical
- expand-hash project expand-hashPrototype Pollution9.8 Critical
- js-extend project js-extendPrototype pollution vulnerability in js-extend9.8 Critical
- mcollina msgpack5Prototype poisoning6.7 Medium
- qcubedqcubed PHP object injection9.8 Critical
- fork-cms fork cmsPHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an...8.8 High
- node-redPrototype Pollution in Node-Red7.7 High
- mitreid connectAutobinding vulnerability in MITREid Connect9.1 Critical
- brikcss mergePrototype Pollution7.3 High
- dynamoosePrototype Pollution in Dynamoose7.2 High
- y18n project y18n, oracle graalvm, siemens sinec infrastructure network services +2 morePrototype Pollution7.3 High
- sharpred deephasPrototype Pollution in deephas9.8 Critical
- mjpclab object-hierarchy-accessPrototype pollution in object-hierarchy-access9.8 Critical
- exodus fieldPrototype Pollution in field9.8 Critical
- google grpcPrototype Pollution7.5 High
- chartjs chart.jsPrototype Pollution7.5 High
- ts.ed project ts.edPrototype Pollution5.6 Medium
- josdejong mathjsPrototype Pollution7.3 High
- apache struts, oracle communications policy management, financial services data integration hub +2 more +4 moreImproperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts9.8 Critical
- digital bazaar node-forge, digitalbazaar forge +1 morePrototype Pollution9.8 Critical
- locutusPrototype Pollution9.8 Critical
- Show moreLoading…