CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
540 vulnerabilities with CWE-1321
CVE-2023-0163
HIGH
Mozilla Convict - Prototype Pollution
CVSS 8.4
CVE-2023-39296
HIGH
QNAP QTS and QuTS hero - Prototype Pollution via Network Request
CVSS 7.5
CVE-2023-46308
CRITICAL
plotly.js < 2.25.2 - Prototype Pollution via expandObjectPaths or nestedProperty
CVSS 9.8
CVE-2023-26920
MEDIUM
fast-xml-parser <4.1.2 - Info Disclosure
CVSS 6.5
CVE-2023-26158
HIGH
mock.js < 1.1.0 - Prototype Pollution via Util.extend Function
CVSS 8.2
CVE-2023-6293
HIGH
robinbuschmann/sequelize-typescript <2.1.6 - Info Disclosure
CVSS 7.1
CVE-2023-45827
HIGH
clickbar/dot-diver < 1.0.2 - Prototype Pollution via setByPath Function
CVSS 7.3
CVE-2023-1717
CRITICAL
Bitrix24 22.0.300 - Prototype Pollution leading to Cross-Site Scripting and Potential Remote Code Execution
CVSS 9.6
CVE-2023-3965
MEDIUM
National Show Centre NSC WordPress Theme <= 1.0 - Unauthenticated Reflected Cross-Site Scripting via Prototype Pollution
CVSS 6.1
CVE-2023-3962
MEDIUM
Winters - WordPress Blog Theme <= 1.4.3 - Unauthenticated Reflected Cross-Site Scripting via Prototype Pollution
CVSS 6.1
CVE-2023-3933
MEDIUM
Your Journey < 1.9.8 - Unauthenticated Reflected Cross-Site Scripting via Prototype Pollution
CVSS 6.1
CVE-2023-45811
HIGH
Synchrony < 2.4.4 - Prototype Pollution via LiteralMap Transformer
CVSS 8.1
CVE-2023-45282
HIGH
NASA Open MCT < 3.1.0 - Prototype Pollution via Import Action
CVSS 7.5
CVE-2023-38894
CRITICAL
tree-kit < 0.7.4 - Prototype Pollution via extend Function
CVSS 9.8
CVE-2023-26139
HIGH
underscore-keypath <0.0.11 - Prototype Pollution
CVSS 7.5
CVE-2023-3696
CRITICAL
mongoose < 5.13.20 and 7.0.0-7.3.3 - Prototype Pollution
CVSS 9.8
CVE-2023-36665
CRITICAL
protobuf.js <7.2.5 - Prototype Pollution
CVSS 9.8
CVE-2023-26136
MEDIUM
Tough-Cookie <4.1.3 - Prototype Pollution
CVSS 6.5
CVE-2023-26135
HIGH
flatnest - Prototype Pollution via nest() Function
CVSS 7.3
CVE-2023-36475
CRITICAL
Parse Server < 5.5.2 - Remote Code Execution via Prototype Pollution
CVSS 9.8
CVE-2023-26133
HIGH
progressbar.js < 1.1.1 - Prototype Pollution via extend() Function
CVSS 8.2
CVE-2023-26132
HIGH
Package dottie <2.0.4 - Info Disclosure
CVSS 7.5
CVE-2023-2972
CRITICAL
antfu/utils < 0.7.3 - Prototype Pollution
CVSS 9.8
CVE-2023-32305
HIGH
aiven-extras < 1.1.9 - Privilege Escalation via Unqualified Function Name Collision
CVSS 8.8
CVE-2023-2582
MEDIUM
Strikingly CMS - Prototype Pollution leading to Reflected Cross-Site Scripting via URL Fragment Parsing
CVSS 6.1
Details
Vulnerabilities
540