Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code exe

• RCE без входа
• Prototype pollution

apache · struts14 сент. 2020 г.

Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)

• RCE
• Prototype pollution

adobe · acrobat dc11 апр. 2026 г.

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

• Без аутентификации
• Prototype pollution

y18n project · y18n17 нояб. 2020 г.

In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes c

• Без аутентификации
• Prototype pollution

rpyc project · rpyc3 окт. 2019 г.

Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser

• RCE без входа
• Prototype pollution

parseplatform · parse-server9 нояб. 2022 г.

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototyp

• Без аутентификации
• Prototype pollution

jquery · jquery19 апр. 2019 г.

Prototype Pollution in automattic/mongoose

• Без аутентификации
• Prototype pollution

mongoosejs · mongoose28 июл. 2022 г.

All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.

• Без аутентификации
• Prototype pollution

linuxfoundation · dojo17 дек. 2021 г.

Kibana arbitrary code execution via prototype pollution

• RCE без входа
• Prototype pollution

elastic · kibana6 мая 2025 г.

If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution

• Без аутентификации
• Prototype pollution

mozilla · firefox22 дек. 2022 г.

If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading t

• Без аутентификации
• Prototype pollution

mozilla · firefox22 дек. 2022 г.

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache

• RCE без входа
• Prototype pollution

fasterxml · jackson-databind29 июл. 2019 г.

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution.

• RCE без входа
• Prototype pollution

handlebars.js project · handlebars.js20 дек. 2019 г.

This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host

• RCE без входа
• Prototype pollution

vm2 project · vm218 окт. 2021 г.

Beaker before 0.8.9 allows a sandbox escape, enabling system access and code execution.

• Без аутентификации
• Prototype pollution

beakerbrowser · beaker23 апр. 2020 г.

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.

• Без аутентификации
• Prototype pollution

agoric · realms-shim10 янв. 2022 г.

An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading t

• Без аутентификации
• Prototype pollution

mozilla · firefox22 дек. 2022 г.

This affects the package express-fileupload before 1.1.8.

• RCE без входа
• Prototype pollution

express-fileupload project · express-fileupload30 июл. 2020 г.

This affects the package chart.js before 2.9.4.

• Без аутентификации
• Prototype pollution

chartjs · chart.js29 окт. 2020 г.

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

• Без аутентификации
• Prototype pollution

substack · minimist17 мар. 2022 г.

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates comi

• Без аутентификации
• Prototype pollution

handlebarsjs · handlebars4 мая 2021 г.

Prototype pollution vulnerability in 'set-or-get' version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead

• RCE без входа
• Prototype pollution

set-or-get project · set-or-get8 февр. 2021 г.

Prototype pollution vulnerability in 'field' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remot

• RCE без входа
• Prototype pollution

exodus · field12 нояб. 2020 г.

The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition.

• Без аутентификации
• Prototype pollution

grpc · grpc11 нояб. 2020 г.

This affects the package convict before 6.2.3.

• Без аутентификации
• Prototype pollution

mozilla · convict13 мая 2022 г.