Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code exe

• Girişsiz RCE
• Prototype pollution

apache · struts14 Eyl 2020

Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)

• RCE
• Prototype pollution

adobe · acrobat dc11 Nis 2026

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

• Kimlik doğrulamasız
• Prototype pollution

y18n project · y18n17 Kas 2020

In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes c

• Kimlik doğrulamasız
• Prototype pollution

rpyc project · rpyc3 Eki 2019

Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser

• Girişsiz RCE
• Prototype pollution

parseplatform · parse-server9 Kas 2022

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototyp

• Kimlik doğrulamasız
• Prototype pollution

jquery · jquery19 Nis 2019

Prototype Pollution in automattic/mongoose

• Kimlik doğrulamasız
• Prototype pollution

mongoosejs · mongoose28 Tem 2022

All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.

• Kimlik doğrulamasız
• Prototype pollution

linuxfoundation · dojo17 Ara 2021

Kibana arbitrary code execution via prototype pollution

• Girişsiz RCE
• Prototype pollution

elastic · kibana6 May 2025

If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution

• Kimlik doğrulamasız
• Prototype pollution

mozilla · firefox22 Ara 2022

If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading t

• Kimlik doğrulamasız
• Prototype pollution

mozilla · firefox22 Ara 2022

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache

• Girişsiz RCE
• Prototype pollution

fasterxml · jackson-databind29 Tem 2019

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution.

• Girişsiz RCE
• Prototype pollution

handlebars.js project · handlebars.js20 Ara 2019

This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host

• Girişsiz RCE
• Prototype pollution

vm2 project · vm218 Eki 2021

Beaker before 0.8.9 allows a sandbox escape, enabling system access and code execution.

• Kimlik doğrulamasız
• Prototype pollution

beakerbrowser · beaker23 Nis 2020

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.

• Kimlik doğrulamasız
• Prototype pollution

agoric · realms-shim10 Oca 2022

An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading t

• Kimlik doğrulamasız
• Prototype pollution

mozilla · firefox22 Ara 2022

This affects the package express-fileupload before 1.1.8.

• Girişsiz RCE
• Prototype pollution

express-fileupload project · express-fileupload30 Tem 2020

This affects the package chart.js before 2.9.4.

• Kimlik doğrulamasız
• Prototype pollution

chartjs · chart.js29 Eki 2020

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

• Kimlik doğrulamasız
• Prototype pollution

substack · minimist17 Mar 2022

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates comi

• Kimlik doğrulamasız
• Prototype pollution

handlebarsjs · handlebars4 May 2021

Prototype pollution vulnerability in 'set-or-get' version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead

• Girişsiz RCE
• Prototype pollution

set-or-get project · set-or-get8 Şub 2021

Prototype pollution vulnerability in 'field' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remot

• Girişsiz RCE
• Prototype pollution

exodus · field12 Kas 2020

The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition.

• Kimlik doğrulamasız
• Prototype pollution

grpc · grpc11 Kas 2020

This affects the package convict before 6.2.3.

• Kimlik doğrulamasız
• Prototype pollution

mozilla · convict13 May 2022