CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
540 vulnerabilities with CWE-1321
CVE-2020-7699
HIGH
express-fileupload < 1.1.8 - Denial of Service and Remote Code Execution via Corrupt HTTP Request
CVSS 7.5
CVE-2020-15366
MEDIUM
ajv < 6.12.3 - Prototype Pollution via Crafted JSON Schema
CVSS 5.6
CVE-2020-8203
HIGH
lodash < 4.17.20 - Prototype Pollution via _.zipObjectDeep
CVSS 7.4
CVE-2020-7679
HIGH
casperjs - Prototype Pollution via mergeObjects Utility Function
CVSS 7.3
CVE-2020-11066
HIGH
TYPO3 CMS >=9.0.0 <9.5.17, >=10.0.0 <10.4.2 - Code Injection
CVSS 8.7
CVE-2020-7644
HIGH
fun-map < 3.3.1 - Prototype Pollution via assocInM Function
CVSS 8.1
CVE-2020-7643
MEDIUM
paypal-adaptive <= 0.4.2 - Prototype Pollution via __proto__ Payload
CVSS 5.3
CVE-2020-12079
CRITICAL
Beaker < 0.8.9 - Remote Code Execution via Prototype Pollution
CVSS 10.0
CVE-2020-7618
MEDIUM
sds < 3.2.0 - Prototype Pollution via set Function
CVSS 5.3
CVE-2020-7616
MEDIUM
express-mock-middleware <= 0.0.6 - Prototype Pollution via Exported Functions
CVSS 5.3
CVE-2020-7639
MEDIUM
eivindfjeldstad-dot < 1.0.3 - Prototype Pollution via 'set' Function
CVSS 5.3
CVE-2020-7638
MEDIUM
confinit < 0.3.0 - Prototype Pollution via setDeepProperty Function
CVSS 5.3
CVE-2020-7637
MEDIUM
class-transformer < 0.3.1 - Prototype Pollution via classToPlainFromExist
CVSS 5.3
CVE-2020-7617
MEDIUM
ini-parser <= 0.0.2 - Prototype Pollution via __proto__ Payload
CVSS 4.4
CVE-2020-7608
MEDIUM
yargs-parser < 5.0.1 and 6.0.0-13.1.2 - Prototype Pollution via __proto__ Payload
CVSS 5.3
CVE-2020-7600
MEDIUM
querymen < 2.1.4 - Prototype Pollution via Unsanitized Handler Parameters
CVSS 5.3
CVE-2020-7598
MEDIUM
minimist < 1.2.2 - Prototype Pollution via Constructor or __proto__ Payload
CVSS 5.6
CVE-2020-5258
HIGH
dojo < 1.11.10 - Prototype Pollution via deepCopy Method
CVSS 7.7
CVE-2020-8116
HIGH
dot-prop <4.2.1, <5.1.1 - Prototype Pollution
CVSS 7.3
CVE-2019-0230
CRITICAL
Apache Struts 2.0.0-2.5.20 - Remote Code Execution via Forced Double OGNL Evaluation
CVSS 9.8
CVE-2019-10808
HIGH
utilitify < 1.0.3 - Prototype Pollution via Merge Method
CVSS 8.8
CVE-2019-10806
MEDIUM
vega < 1.13.1 - Prototype Pollution via vega.mergeConfig
CVSS 4.3
CVE-2019-19919
CRITICAL
handlebars.js - Prototype Pollution leading to Remote Code Execution
CVSS 9.8
CVE-2019-10768
HIGH
AngularJS < 1.7.9 - Prototype Pollution via merge() Function
CVSS 7.5
CVE-2019-17317
HIGH
SugarCRM 7.9.0.0-7.9.5.0 - Authenticated PHP Object Injection via UpgradeWizard Module
CVSS 7.2
Details
Vulnerabilities
540