CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
540 vulnerabilities with CWE-1321
CVE-2022-31106
HIGH
Underscore.deep <0.5.3 - Prototype Pollution
CVSS 8.3
CVE-2022-21231
HIGH
deep-get-set - Prototype Pollution via 'deep' Function
CVSS 7.5
CVE-2022-25871
MEDIUM
querymen - Prototype Pollution via Unsanitized Handler Function Parameters
CVSS 5.9
CVE-2022-21213
HIGH
mout < 1.2.4 - Prototype Pollution via deepFillIn and deepMixIn Functions
CVSS 7.5
CVE-2022-25878
HIGH
protobufjs < 6.11.3 - Prototype Pollution via util.setProperty or ReflectionObject.setParsedOption
CVSS 8.2
CVE-2022-25862
MEDIUM
sds - Prototype Pollution via set Function
CVSS 4.0
CVE-2022-21190
HIGH
convict < 6.2.3 - Prototype Pollution via Bypass of CVE-2022-22143 Fix
CVSS 7.5
CVE-2022-25324
HIGH
bignum - Denial of Service via .powm Function Type-Check Exception
CVSS 7.5
CVE-2022-25301
HIGH
jsgui-lang-essentials - Prototype Pollution via Object Attribute Manipulation
CVSS 7.7
CVE-2022-25645
MEDIUM
dset < 3.1.2 - Prototype Pollution via Malicious Object Bypass
CVSS 6.5
CVE-2022-22143
HIGH
convict <6.2.2 - Prototype Pollution
CVSS 7.5
CVE-2022-21189
HIGH
dexie < 3.2.2 and 4.0.0-alpha.1-4.0.0-alpha.3 - Prototype Pollution via setByKeyPath Function
CVSS 7.3
CVE-2022-24279
HIGH
madlib-object-utils <0.1.8 - Prototype Pollution
CVSS 7.5
CVE-2022-21803
HIGH
nconf < 0.11.4 - Prototype Pollution via .set() Function
CVSS 7.3
CVE-2022-1295
CRITICAL
fullpage < 4.0.2 - Prototype Pollution
CVSS 9.8
CVE-2022-24802
HIGH
deepmerge-ts < 4.0.2 - Prototype Pollution via defaultMergeRecords Function
CVSS 8.1
CVE-2022-26260
CRITICAL
Simple-Plist <1.3.0 - Info Disclosure
CVSS 9.8
CVE-2022-25354
HIGH
set-in < 2.0.3 - Prototype Pollution via setIn Method
CVSS 8.6
CVE-2022-25352
HIGH
libnested < 1.5.2 - Prototype Pollution via set Function
CVSS 7.5
CVE-2022-25296
MEDIUM
bodymen < 1.1.1 - Prototype Pollution via Handler Function
CVSS 6.3
CVE-2022-24760
CRITICAL
Parse Server < 4.10.7 - Remote Code Execution via Prototype Pollution in DatabaseController.js
CVSS 10.0
CVE-2022-23395
MEDIUM
jquery.cookie 1.4.1 - Prototype Pollution leading to DOM Cross-Site Scripting
CVSS 6.1
CVE-2022-21824
HIGH
Node.js 12.0.0-12.22.8 and 17.0.0-17.3.0 - Prototype Pollution via console.table() Properties Parameter
CVSS 8.2
CVE-2022-22912
CRITICAL
plist < 3.0.4 - Prototype Pollution via .parse()
CVSS 9.8
CVE-2022-23631
CRITICAL
blitzjs superjson < 1.8.1 - Unauthenticated Remote Code Execution via Prototype Pollution
CVSS 9.0
Details
Vulnerabilities
540