TYPE DE FAIBLESSE

Pollution de prototype CWE-1321

181 CVE, des plus récentes aux plus anciennes. Définition MITRE de CWE-1321 (en anglais) →

CVE-2024-52810@intlify/shared is a shared library for the intlify project. The latest version of @intlify/shared (10.0.4) is vulnerable to Prototype Pollution through the entry function(s) lib.d… 6.9 MOYENNE

CVE-2024-45277The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 is impacted by Prototype Pollution vulnerability allowing an attacker to add arbitrary properties to global o… 4.3 MOYENNE

CVE-2024-45815Backstage is an open framework for building developer portals. A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able… 6.5 MOYENNE

CVE-2024-21528All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to improper user input sanitization. 5.9 MOYENNE

CVE-2024-39853adolph_dudu ratio-swiper 0.0.2 was discovered to contain a prototype pollution via the function parse. This vulnerability allows attackers to execute arbitrary code or cause a Deni… 6.5 MOYENNE

CVE-2024-39018harvey-woo cat5th/key-serializer v0.2.5 was discovered to contain a prototype pollution via the function "query". This vulnerability allows attackers to execute arbitrary code or c… 6.3 MOYENNE

CVE-2024-39001ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability allows attackers to execute arbitrary code… 6.3 MOYENNE

CVE-2024-39000adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function parse. This vulnerability allows attackers to execute arbitrary code or cause a Den… 6.5 MOYENNE

CVE-2024-38997adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function extendDefaults. This vulnerability allows attackers to execute arbitrary code or ca… 6.5 MOYENNE

CVE-2024-38987aofl cli-lib v3.14.0 was discovered to contain a prototype pollution via the component defaultsDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial… 6.3 MOYENNE

CVE-2024-36578akbr update 1.0.0 is vulnerable to Prototype Pollution via update/index.js. 5.9 MOYENNE

CVE-2024-36574A Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON (flatten-json/index.js:42) 6.3 MOYENNE

CVE-2024-34273njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method. 5.9 MOYENNE

CVE-2024-34698FreeScout is a free, self-hosted help desk and shared mailbox. Versions of FreeScout prior to 1.8.139 contain a Prototype Pollution vulnerability in the `/public/js/main.js` source… 4.6 MOYENNE

CVE-2024-34148Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically disables the fix for CVE-2016-3721 whenever a build is triggered from a release tag, by setting… 6.8 MOYENNE

CVE-2024-21509Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parser… 6.5 MOYENNE

CVE-2024-2495Cryptographic key vulnerability encoded in the FriendlyWrt firmware affecting version 2022-11-16.51b3d35. This vulnerability could allow an attacker to compromise the confidentiali… 5.2 MOYENNE

CVE-2024-23339hoolock is a suite of lightweight utilities designed to maintain a small footprint when bundled. Starting in version 2.0.0 and prior to version 2.2.1, utility functions related to … 6.3 MOYENNE

CVE-2023-26920fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution. 6.5 MOYENNE

CVE-2023-3965The nsc theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.0 due to insufficient input sanitization and… 6.1 MOYENNE

CVE-2023-3962The Winters theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.4.3 due to insufficient input sanitizati… 6.1 MOYENNE

CVE-2023-3933The Your Journey theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.9.8 due to insufficient input sanit… 6.1 MOYENNE

CVE-2023-26136Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode.… 6.5 MOYENNE

CVE-2023-2582A prototype pollution vulnerability exists in Strikingly CMS which can result in reflected cross-site scripting (XSS) in affected applications and sites built with Strikingly. The … 6.1 MOYENNE

CVE-2023-0842xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys… 5.3 MOYENNE

CVE-2021-4307A vulnerability was found in Yomguithereal Baobab up to 2.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads … 6.3 MOYENNE

CVE-2022-4742A vulnerability, which was classified as critical, has been found in json-pointer up to 0.6.1. Affected by this issue is the function set of the file index.js. The manipulation lea… 6.3 MOYENNE

CVE-2021-4279A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improper… 6.3 MOYENNE

CVE-2020-36632A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipulation leads to imprope… 6.3 MOYENNE

CVE-2021-4278A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x. This affects an unknown part. The manipulation leads to improperly controlled modification… 5.5 MOYENNE

CVE-2021-4264A vulnerability was found in LinkedIn dustjs up to 2.x and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improperly con… 6.3 MOYENNE

CVE-2020-36618A vulnerability classified as critical has been found in Furqan node-whois. Affected is an unknown function of the file index.coffee. The manipulation leads to improperly controlle… 6.3 MOYENNE

CVE-2021-4245A vulnerability classified as problematic has been found in chbrown rfc6902. This affects an unknown part of the file pointer.ts. The manipulation leads to improperly controlled mo… 5.5 MOYENNE

CVE-2022-42743deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incom… 5.3 MOYENNE

CVE-2022-41714fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the inc… 5.3 MOYENNE

CVE-2022-41713deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming … 5.3 MOYENNE

CVE-2021-23397All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @generates/merger instead. 5.6 MOYENNE

CVE-2020-7641This affects all versions of package grunt-util-property. The function call could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. 4.0 MOYENNE

CVE-2022-25871All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be controlled by users without any sanitiz… 5.9 MOYENNE

CVE-2022-25862This affects the package sds from 0.0.0. The library could be tricked into adding or modifying properties of the Object.prototype by abusing the set function located in js/set.js. … 4.0 MOYENNE

CVE-2022-25645All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path co… 6.5 MOYENNE

CVE-2022-25296The package bodymen from 0.0.0 are vulnerable to Prototype Pollution via the handler function which could be tricked into adding or modifying properties of Object.prototype using a… 6.3 MOYENNE

CVE-2021-23771This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to r… 6.5 MOYENNE

CVE-2021-43956The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a prototype pollution vulnera… 6.1 MOYENNE

CVE-2022-23395jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS). 6.1 MOYENNE

CVE-2022-0432Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0. 6.1 MOYENNE

CVE-2021-23760The package keyget from 0.0.0 are vulnerable to Prototype Pollution via the methods set, push, and at which could allow an attacker to cause a denial of service and may lead to rem… 5.6 MOYENNE

CVE-2021-23700All versions of package merge-deep2 are vulnerable to Prototype Pollution via the mergeDeep() function. 6.5 MOYENNE

CVE-2021-23663All versions of package sey are vulnerable to Prototype Pollution via the deepmerge() function. 6.5 MOYENNE

CVE-2021-23561All versions of package comb are vulnerable to Prototype Pollution via the deepMerge() function. 6.5 MOYENNE