Total
272 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-7709 | 1 Smallpdf | 1 Json-pointer | 2023-12-10 | 6.5 MEDIUM | 7.2 HIGH |
| This affects the package json-pointer before 0.6.1. Multiple reference of object using slash is supported. | |||||
| CVE-2021-25912 | 1 Dotty Project | 1 Dotty | 2023-12-10 | 7.5 HIGH | 9.8 CRITICAL |
| Prototype pollution vulnerability in 'dotty' versions 0.0.1 through 0.1.0 allows attackers to cause a denial of service and may lead to remote code execution. | |||||
| CVE-2021-25916 | 1 Patchmerge Project | 1 Patchmerge | 2023-12-10 | 7.5 HIGH | 9.8 CRITICAL |
| Prototype pollution vulnerability in 'patchmerge' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution. | |||||
| CVE-2020-28448 | 1 Multi-ini Project | 1 Multi-ini | 2023-12-10 | 7.5 HIGH | 9.8 CRITICAL |
| This affects the package multi-ini before 2.1.1. It is possible to pollute an object's prototype by specifying the proto object as part of an array. | |||||
| CVE-2021-21304 | 1 Dynamoosejs | 1 Dynamoose | 2023-12-10 | 7.5 HIGH | 9.8 CRITICAL |
| Dynamoose is an open-source modeling tool for Amazon's DynamoDB. In Dynamoose from version 2.0.0 and before version 2.7.0 there was a prototype pollution vulnerability in the internal utility method "lib/utils/object/set.ts". This method is used throughout the codebase for various operations throughout Dynamoose. We have not seen any evidence of this vulnerability being exploited. There is no evidence this vulnerability impacts versions 1.x.x since the vulnerable method was added as part of the v2 rewrite. This vulnerability also impacts v2.x.x beta/alpha versions. Version 2.7.0 includes a patch for this vulnerability. | |||||
| CVE-2020-7770 | 1 Json8 Project | 1 Json8 | 2023-12-10 | 7.5 HIGH | 9.8 CRITICAL |
| This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution. | |||||
| CVE-2021-21368 | 1 Msgpack5 Project | 1 Msgpack5 | 2023-12-10 | 6.5 MEDIUM | 8.8 HIGH |
| msgpack5 is a msgpack v5 implementation for node.js and the browser. In msgpack5 before versions 3.6.1, 4.5.1, and 5.2.1 there is a "Prototype Poisoning" vulnerability. When msgpack5 decodes a map containing a key "__proto__", it assigns the decoded value to __proto__. Object.prototype.__proto__ is an accessor property for the receiver's prototype. If the value corresponding to the key __proto__ decodes to an object or null, msgpack5 sets the decoded object's prototype to that value. An attacker who can submit crafted MessagePack data to a service can use this to produce values that appear to be of other types; may have unexpected prototype properties and methods (for example length, numeric properties, and push et al if __proto__'s value decodes to an Array); and/or may throw unexpected exceptions when used (for example if the __proto__ value decodes to a Map or Date). Other unexpected behavior might be produced for other types. There is no effect on the global prototype. This "prototype poisoning" is sort of a very limited inversion of a prototype pollution attack. Only the decoded value's prototype is affected, and it can only be set to msgpack5 values (though if the victim makes use of custom codecs, anything could be a msgpack5 value). We have not found a way to escalate this to true prototype pollution (absent other bugs in the consumer's code). This has been fixed in msgpack5 version 3.6.1, 4.5.1, and 5.2.1. See the referenced GitHub Security Advisory for an example and more details. | |||||
| CVE-2020-7748 | 1 Ts.ed Project | 1 Ts.ed | 2023-12-10 | 6.8 MEDIUM | 8.1 HIGH |
| This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program. | |||||
| CVE-2020-7751 | 1 Chaijis | 1 Pathval | 2023-12-10 | 6.5 MEDIUM | 7.2 HIGH |
| pathval before version 1.1.1 is vulnerable to prototype pollution. | |||||
| CVE-2020-7788 | 2 Debian, Ini Project | 2 Debian Linux, Ini | 2023-12-10 | 7.5 HIGH | 9.8 CRITICAL |
| This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context. | |||||
| CVE-2020-28271 | 1 Deephas Project | 1 Deephas | 2023-12-10 | 7.5 HIGH | 9.8 CRITICAL |
| Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution. | |||||
| CVE-2021-21297 | 1 Nodered | 1 Node-red | 2023-12-10 | 4.0 MEDIUM | 6.5 MEDIUM |
| Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default behaviour of the Node-RED runtime. The vulnerability is patched in the 1.2.8 release. A workaround is to ensure only authorized users are able to access the editor url. | |||||
| CVE-2020-7736 | 1 Bmoor Project | 1 Bmoor | 2023-12-10 | 7.5 HIGH | 9.8 CRITICAL |
| The package bmoor before 0.8.12 are vulnerable to Prototype Pollution via the set function. | |||||
| CVE-2020-28269 | 1 Exodus | 1 Field | 2023-12-10 | 7.5 HIGH | 9.8 CRITICAL |
| Prototype pollution vulnerability in 'field' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution. | |||||
| CVE-2020-28270 | 1 Mjpclab | 1 Object-hierarchy-access | 2023-12-10 | 7.5 HIGH | 9.8 CRITICAL |
| Prototype pollution vulnerability in 'object-hierarchy-access' versions 0.2.0 through 0.32.0 allows attacker to cause a denial of service and may lead to remote code execution. | |||||
| CVE-2021-25914 | 1 Fireblink | 1 Object-collider | 2023-12-10 | 7.5 HIGH | 9.8 CRITICAL |
| Prototype pollution vulnerability in 'object-collider' versions 1.0.0 through 1.0.3 allows attacker to cause a denial of service and may lead to remote code execution. | |||||
| CVE-2021-25913 | 1 Set-or-get Project | 1 Set-or-get | 2023-12-10 | 7.5 HIGH | 9.8 CRITICAL |
| Prototype pollution vulnerability in 'set-or-get' version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code execution. | |||||
| CVE-2020-7618 | 1 Sds Project | 1 Sds | 2023-12-10 | 5.0 MEDIUM | 5.3 MEDIUM |
| sds through 3.2.0 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of the 'Object.prototype' by abusing the 'set' function located in 'js/set.js'. | |||||
| CVE-2020-7707 | 1 Property-expr Project | 1 Property-expr | 2023-12-10 | 7.5 HIGH | 9.8 CRITICAL |
| The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function. | |||||
| CVE-2020-7702 | 1 Templ8 Project | 1 Templ8 | 2023-12-10 | 7.5 HIGH | 9.8 CRITICAL |
| All versions of package templ8 are vulnerable to Prototype Pollution via the parse function. | |||||