Skip to content
Noroxi

CWE-471 · 40 records

Modification of Assumed-Immutable Data (MAID)

CVEs in this class

40 records

  • CVE-2020-8147
    40Plan

    Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that may result in remot

    CriticalCVSS 9.8No exploitEPSS 3%

    utils-extend project · utils-extendApr 3, 2020

  • CVE-2020-8158
    40Plan

    Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    typeorm · typeormSep 18, 2020

  • CVE-2022-25893
    39Monitor

    Arbitrary Code Execution

    CriticalCVSS 9.8No exploitEPSS 1%

    vm2 project · vm2Dec 21, 2022

  • CVE-2026-50481
    39Monitor

    Azure Active Directory Elevation of Privilege Vulnerability

    CriticalCVSS 9.9No exploitEPSS 0%

    microsoft · azure active directoryAug 7, 2026

  • CVE-2022-21824
    38Monitor

    Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties

    HighCVSS 8.2No exploitEPSS 21%

    nodejs · node.jsFeb 24, 2022

  • CVE-2018-3728
    36Monitor

    hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge'

    HighCVSS 8.8No exploitEPSS 4%

    hapijs · hoekMar 30, 2018

  • CVE-2018-3719
    36Monitor

    mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious use

    HighCVSS 8.8No exploitEPSS 2%

    mixin-deep project · mixin-deepJun 6, 2018

  • CVE-2018-3722
    36Monitor

    merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious use

    HighCVSS 8.8No exploitEPSS 2%

    merge-deep project · merge-deepJun 6, 2018

  • CVE-2018-3723
    36Monitor

    defaults-deep node module before 0.2.4 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious

    HighCVSS 8.8No exploitEPSS 2%

    defaults-deep project · defaults-deepJun 6, 2018

  • CVE-2018-3720
    36Monitor

    assign-deep node module before 0.4.7 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious us

    HighCVSS 8.8No exploitEPSS 1%

    assign-deep project · assign-deepJun 6, 2018

  • CVE-2025-33136
    35Monitor

    IBM Aspera Faspex data modification

    HighCVSS 8.8No exploitEPSS 0%

    ibm · aspera faspexMay 22, 2025

  • CVE-2020-26237
    34Monitor

    Prototype Pollution in highlight.js

    HighCVSS 8.7No exploitEPSS 1%

    highlightjs · highlight.jsNov 24, 2020

  • CVE-2024-9876
    34Monitor

    Application is vulnerable to Privilege escalation

    HighCVSS 8.5No exploitEPSS 0%

    abb · ancApr 30, 2025

  • CVE-2024-55551
    33Monitor

    An issue was discovered in Exasol JDBC driver before 24.2.1 (2024-12-10).

    HighCVSS 8.3No exploitEPSS 0%

    exasol · jdbc driverMar 19, 2025

  • CVE-2022-2390
    33Monitor

    Mutable pending intent in Google Play services SDK

    HighCVSS 8.4No exploitEPSS 0%

    google · google play services software development kitAug 12, 2022

  • CVE-2020-8116
    30Monitor

    Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbi

    HighCVSS 7.3No exploitEPSS 3%

    dot-prop project · dot-propFeb 4, 2020

  • CVE-2020-8268
    30Monitor

    Prototype pollution vulnerability in json8-merge-patch npm package < 1.0.3 may allow attackers to inject or modify methods and properties of

    HighCVSS 7.5No exploitEPSS 1%

    json8-merge-patch project · json8-merge-patchNov 9, 2020

  • CVE-2023-2904
    29Monitor

    The External Visitor Manager portal of HID’s SAFE versions 5.8.0 through 5.11.3 are vulnerable to manipulation within web fields in the appl

    HighCVSS 7.3No exploitEPSS 0%

    hidglobal · safeJun 7, 2023

  • GHSA-q42p-pg8m-cqh6
    29Monitor

    Prototype Pollution in handlebars

    HighCVSS 7.3No exploit

    npm · handlebarsJun 5, 2019

  • CVE-2026-44798
    28Monitor

    Nautobot: GitRepository.current_head field should not be writable through REST API

    HighCVSS 7.1No exploitEPSS 0%

    networktocode · nautobotMay 28, 2026

  • CVE-2018-3721
    27Monitor

    lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mer

    MediumCVSS 6.5No exploitEPSS 2%

    lodash · lodashJun 6, 2018

  • CVE-2023-43697
    26Monitor

    Modification of Assumed-Immutable Data (MAID) in RDT400 in SICK APU allows an unprivileged remote attacker to make the site unable to load

    MediumCVSS 6.5No exploitEPSS 0%

    sick · apu0200 firmwareOct 9, 2023

  • CVE-2024-34517
    26Monitor

    The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin acce

    MediumCVSS 6.5No exploitEPSS 0%

    neo4j · neo4jMay 7, 2024

  • CVE-2021-37177
    26Monitor

    A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2).

    MediumCVSS 6.5No exploitEPSS 0%

    siemens · sinema remote connect serverSep 14, 2021

  • CVE-2026-103001
    26Monitor

    PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

    MediumCVSS 6.5No exploitEPSS 0%

    pyjwt project · pyjwtSep 30, 2026

All vulnerability classes