Modification of Assumed-Immutable Data (MAID)

Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that may result in remot

• pre-auth RCE
• Prototype pollution

utils-extend project · utils-extend3 апр. 2020 г.

Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further

• Без аутентификации
• SQL-инъекция
• Prototype pollution

typeorm · typeorm18 сент. 2020 г.

Arbitrary Code Execution

• pre-auth RCE

vm2 project · vm221 дек. 2022 г.

Azure Active Directory Elevation of Privilege Vulnerability

microsoft · azure active directory6 авг. 2026 г.

Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties

• Без аутентификации
• Prototype pollution

nodejs · node.js24 февр. 2022 г.

hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge'

hapijs · hoek30 мар. 2018 г.

mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious use

mixin-deep project · mixin-deep6 июн. 2018 г.

merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious use

merge-deep project · merge-deep6 июн. 2018 г.

defaults-deep node module before 0.2.4 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious

defaults-deep project · defaults-deep6 июн. 2018 г.

assign-deep node module before 0.4.7 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious us

assign-deep project · assign-deep6 июн. 2018 г.

IBM Aspera Faspex data modification

ibm · aspera faspex22 мая 2025 г.

Prototype Pollution in highlight.js

• Prototype pollution

highlightjs · highlight.js24 нояб. 2020 г.

Application is vulnerable to Privilege escalation

abb · anc30 апр. 2025 г.

An issue was discovered in Exasol JDBC driver before 24.2.1 (2024-12-10).

• pre-auth RCE

exasol · jdbc driver19 мар. 2025 г.

Mutable pending intent in Google Play services SDK

google · google play services software development kit12 авг. 2022 г.

Prototype Pollution in json-logic-js

• Prototype pollution

npm · json-logic-js12 нояб. 2020 г.

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbi

• Без аутентификации
• Prototype pollution

dot-prop project · dot-prop4 февр. 2020 г.

Prototype pollution vulnerability in json8-merge-patch npm package < 1.0.3 may allow attackers to inject or modify methods and properties of

• Без аутентификации
• Prototype pollution

json8-merge-patch project · json8-merge-patch9 нояб. 2020 г.

The External Visitor Manager portal of HID’s SAFE versions 5.8.0 through 5.11.3 are vulnerable to manipulation within web fields in the appl

hidglobal · safe7 июн. 2023 г.

Prototype Pollution in handlebars

• Без аутентификации
• Prototype pollution

npm · handlebars5 июн. 2019 г.

Nautobot: GitRepository.current_head field should not be writable through REST API

networktocode · nautobot28 мая 2026 г.

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mer

lodash · lodash6 июн. 2018 г.

Modification of Assumed-Immutable Data (MAID) in RDT400 in SICK APU allows an unprivileged remote attacker to make the site unable to load

• Без аутентификации

sick · apu0200 firmware9 окт. 2023 г.

The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin acce

neo4j · neo4j7 мая 2024 г.

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2).

• Без аутентификации

siemens · sinema remote connect server14 сент. 2021 г.