Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
442 results · page 5 of 9
Dec 22, 2022An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollutioCVE-2022-1529 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript executing in the privileged parent process. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1.
- Product
- Firefox ESR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 21, 2022The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method.CVE-2022-25893 · Other software · Vm2 Project · reported by report@snyk.ioCritical 9.8
The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.
- Product
- Vm2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2022All versions of package safe-eval are vulnerable to Prototype Pollution which allows an attacker to add or modify properties of the Object.prototype.ConsolidateCVE-2022-25904 · Other software · Safe-eval Project · reported by report@snyk.ioHigh 7.5
All versions of package safe-eval are vulnerable to Prototype Pollution which allows an attacker to add or modify properties of the Object.prototype.Consolidate when using the function safeEval. This is because the function uses vm variable, leading an attacker to modify properties of the Object.prototype.
- Product
- Safe-eval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.snyk.io
Oct 31, 2022Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the shimPath variable in resolve-shims.js.CVE-2022-37623 · Other software · Browserify-shim Project · reported by MITRECritical 9.8
Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the shimPath variable in resolve-shims.js.
- Product
- Browserify-shim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the fullPath variable in resolve-shims.js.CVE-2022-37621 · Other software · Browserify-shim Project · reported by MITRECritical 9.8
Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the fullPath variable in resolve-shims.js.
- Product
- Browserify-shim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2022Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js.CVE-2022-37598 · Other software · Uglifyjs Project · reported by MITRECritical 9.8
Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.
- Product
- Uglifyjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022When running in prototype mode, the h2 webconsole module (accessible from the Prototype menu) is automatically made available with the ability to directly queryCVE-2022-42467 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
When running in prototype mode, the h2 webconsole module (accessible from the Prototype menu) is automatically made available with the ability to directly query the database. It was felt that it is safer to require the developer to explicitly enable this capability. As of 2.0.0-M8, this can now be done using the 'isis.prototyping.h2-console.web-allow-remote-access' configuration property; the web console will be unavailable without setting this configuration. As an additional safeguard, the new 'isis.prototyping.h2-console.generate-random-web-admin-password' configuration parameter (enabled by default) requires that the administrator use a randomly generated password to use the console. The password is printed to the log, as "webAdminPass: xxx" (where "xxx") is the password. To revert to the original behaviour, the administrator would therefore need to set these configuration parameter: isis.prototyping.h2-console.web-allow-remote-access=true isis.prototyping.h2-console.generate-random-web-admin-password=false Note also that the h2 webconsole is never available in production mode, so these safeguards are only to ensure that the webconsole is secured by default also in prototype mod
- Product
- Apache Isis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Oct 14, 2022Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js.CVE-2022-37602 · Other software · Grunt-karma Project · reported by MITRECritical 9.8
Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js.
- Product
- Grunt-karma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2022Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js.CVE-2022-37601 · Other software · Webpack.js · reported by MITRECritical 9.8
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.
- Product
- Loader-utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordusers.encs.concordia.cadl.acm.org
Oct 12, 2022Prototype pollution vulnerability in function enable in mockery.js in mfncooper mockery commit 822f0566fd6d72af8c943ae5ca2aa92e516aa2cf via the key variable in CVE-2022-37614 · Other software · Mockery Project · reported by MITRECritical 9.8
Prototype pollution vulnerability in function enable in mockery.js in mfncooper mockery commit 822f0566fd6d72af8c943ae5ca2aa92e516aa2cf via the key variable in mockery.js.
- Product
- Mockery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022Prototype pollution vulnerability in tschaub gh-pages 3.1.0 via the partial variable in util.js.CVE-2022-37611 · Other software · Gh-pages Project · reported by MITRECritical 9.8
Prototype pollution vulnerability in tschaub gh-pages 3.1.0 via the partial variable in util.js.
- Product
- Gh-pages
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the k variable in resolve-shims.js.CVE-2022-37617 · Other software · Browserify-shim Project · reported by MITRECritical 9.8
Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the k variable in resolve-shims.js.
- Product
- Browserify-shim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022Prototype pollution vulnerability in beautify-web js-beautify 1.13.7 via the name variable in options.js.CVE-2022-37609 · Other software · Js-beautify Project · reported by MITRECritical 9.8
Prototype pollution vulnerability in beautify-web js-beautify 1.13.7 via the name variable in options.js.
- Product
- Js-beautify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the pCVE-2022-37616 · Other software · Xmldom Project · reported by MITRECritical 9.8
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."
- Product
- Xmldom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordusers.encs.concordia.cadl.acm.org
Sep 26, 2022The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitizaCVE-2022-21169 · Other software · Express XSS Sanitizer Project · reported by report@snyk.ioHigh 7.3
The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.
- Product
- Express XSS Sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.CVE-2020-36604 · Other software · Hapijs · reported by MITREHigh 8.1
hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.
- Product
- Hoek
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.snyk.io
Sep 20, 2022Prototype pollution vulnerability in stealjs steal 2.2.4 via the alias variable in babel.js.CVE-2022-37265 · Other software · Stealjs · reported by MITRECritical 9.8
Prototype pollution vulnerability in stealjs steal 2.2.4 via the alias variable in babel.js.
- Product
- Steal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2022Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convert.js.CVE-2022-37258 · Other software · Stealjs · reported by MITRECritical 9.8
Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convert.js.
- Product
- Steal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2022Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js.CVE-2022-37264 · Other software · Stealjs · reported by MITRECritical 9.8
Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js.
- Product
- Steal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2022Prototype pollution vulnerability in function extend in babel.js in stealjs steal 2.2.4 via the key variable in babel.js.CVE-2022-37266 · Other software · Stealjs · reported by MITRECritical 9.8
Prototype pollution vulnerability in function extend in babel.js in stealjs steal 2.2.4 via the key variable in babel.js.
- Product
- Steal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2022Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the requestedVersion variable in npm-convert.js.CVE-2022-37257 · Other software · Stealjs · reported by MITRECritical 9.8
Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the requestedVersion variable in npm-convert.js.
- Product
- Steal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2022The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function.CVE-2022-25907 · Other software · Typescript Deep Merge Project · reported by report@snyk.ioHigh 7.5
The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function.
- Product
- Typescript Deep Merge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2022Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.CVE-2022-2564 · Other software · automattic · reported by security@huntr.devCritical 9.8
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.
- Product
- automattic/mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2022All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function.CVE-2021-23397 · Other software · Merge Project · reported by report@snyk.ioMedium 5.6
All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @generates/merger instead.
- Product
- Merge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.snyk.iosecurity.snyk.io
Jul 25, 2022All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality.CVE-2021-23373 · Other software · Set-deep-prop Project · reported by report@snyk.ioHigh 7.5
All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality.
- Product
- Set-deep-prop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.snyk.iosecurity.snyk.io
Jun 30, 2022deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').CVE-2021-40663 · Other software · Deep.assign Project · reported by MITRECritical 9.8
deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').
- Product
- Deep.assign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
Jun 24, 2022All versions of package deep-get-set are vulnerable to Prototype Pollution via the 'deep' function.CVE-2022-21231 · Other software · Deep-get-set Project · reported by report@snyk.ioHigh 7.5
All versions of package deep-get-set are vulnerable to Prototype Pollution via the 'deep' function. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-7715](https://security.snyk.io/vuln/SNYK-JS-DEEPGETSET-598666)
- Product
- Deep-get-set
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2022All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be controlled by usersCVE-2022-25871 · Other software · Querymen Project · reported by report@snyk.ioMedium 5.9
All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. Note: This vulnerability derives from an incomplete fix of [CVE-2020-7600](https://security.snyk.io/vuln/SNYK-JS-QUERYMEN-559867).
- Product
- Querymen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_array_prototype_sort at src/njs_array.c.CVE-2022-29780 · Websites & servers · Nginx · reported by MITREMedium 5.5
Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_array_prototype_sort at src/njs_array.c.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2022The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype.CVE-2022-25878 · Other software · Protobufjs Project · reported by report@snyk.ioHigh 8.2
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files
- Product
- Protobufjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022A buffer overflow in ecma_builtin_typedarray_prototype_filter() in JerryScript version fe3a5c0 allows an attacker to construct a fake object or a fake arraybuffCVE-2021-42863 · Other software · Jerryscript · reported by MITRECritical 9.8
A buffer overflow in ecma_builtin_typedarray_prototype_filter() in JerryScript version fe3a5c0 allows an attacker to construct a fake object or a fake arraybuffer with unlimited size.
- Product
- Jerryscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2022Prototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to compromise integrity or availability of application via supplying CVE-2021-42581 · Other software · Ramdajs · reported by MITRECritical 9.1
Prototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to compromise integrity or availability of application via supplying a crafted object (that contains an own property "__proto__") as an argument to the function. NOTE: the vendor disputes this because the observed behavior only means that a user can create objects that the user didn't know would contain custom prototypes
- Product
- Ramda
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comjsfiddle.net
May 1, 2022All versions of package jsgui-lang-essentials are vulnerable to Prototype Pollution due to allowing all Object attributes to be altered, including their magicalCVE-2022-25301 · Other software · Jsgui-lang-essentials Project · reported by report@snyk.ioHigh 7.7
All versions of package jsgui-lang-essentials are vulnerable to Prototype Pollution due to allowing all Object attributes to be altered, including their magical attributes such as proto, constructor and prototype.
- Product
- Jsgui-lang-essentials
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2022All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if tCVE-2022-25645 · Other software · Dset Project · reported by report@snyk.ioMedium 6.5
All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains __proto__, constructor or protorype. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution.
- Product
- Dset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2022The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey.CVE-2022-22143 · Computers, phones & browsers · Mozilla · reported by report@snyk.ioHigh 7.5
The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. **Note:** This vulnerability derives from an incomplete fix of another [vulnerability](https://security.snyk.io/vuln/SNYK-JS-CONVICT-1062508)
- Product
- Convict
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2022The package dexie before 3.2.2, from 4.0.0-alpha.1 and before 4.0.0-alpha.3 are vulnerable to Prototype Pollution in the Dexie.setByKeyPath(obj, keyPath, value)CVE-2022-21189 · Other software · Dexie · reported by report@snyk.ioHigh 7.3
The package dexie before 3.2.2, from 4.0.0-alpha.1 and before 4.0.0-alpha.3 are vulnerable to Prototype Pollution in the Dexie.setByKeyPath(obj, keyPath, value) function which does not properly check the keys being set (like __proto__ or constructor). This can allow an attacker to add/modify properties of the Object.prototype leading to prototype pollution vulnerability. **Note:** This vulnerability can occur in multiple ways, for example when modifying a collection with untrusted user input.
- Product
- Dexie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2022The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes CVE-2022-24279 · Other software · Springtree · reported by report@snyk.ioHigh 7.5
The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix of [CVE-2020-7701](https://security.snyk.io/vuln/SNYK-JS-MADLIBOBJECTUTILS-598676)
- Product
- Madlib-object-utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022Prototype Pollution in GitHub repository alvarotrigo/fullpage.js prior to 4.0.2.CVE-2022-1295 · Other software · alvarotrigo · reported by security@huntr.devCritical 9.8
Prototype Pollution in GitHub repository alvarotrigo/fullpage.js prior to 4.0.2.
- Product
- alvarotrigo/fullpage.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2022Buffer overflow vulnerability in file ecma-builtin-array-prototype.c:909 in function ecma_builtin_array_prototype_object_slice in Jerryscript before commit e1ceCVE-2021-41751 · Other software · Jerryscript · reported by MITRECritical 9.8
Buffer overflow vulnerability in file ecma-builtin-array-prototype.c:909 in function ecma_builtin_array_prototype_object_slice in Jerryscript before commit e1ce7dd7271288be8c0c8136eea9107df73a8ce2 on Oct 20, 2021.
- Product
- Jerryscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2022Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse().CVE-2022-26260 · Other software · Simple-plist Project · reported by MITRECritical 9.8
Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse().
- Product
- Simple-plist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2022Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).CVE-2021-44906 · Other software · Substack · reported by MITRECritical 9.8
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
- Product
- Minimist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2022The package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it.CVE-2022-25354 · Other software · Set-in Project · reported by report@snyk.ioHigh 8.6
The package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-28273](https://security.snyk.io/vuln/SNYK-JS-SETIN-1048049)
- Product
- Set-in
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2022The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js.CVE-2022-25352 · Other software · Libnested Project · reported by report@snyk.ioHigh 7.5
The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. **Note:** This vulnerability derives from an incomplete fix for [CVE-2020-28283](https://security.snyk.io/vuln/SNYK-JS-LIBNESTED-1054930)
- Product
- Libnested
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2022The package bodymen from 0.0.0 are vulnerable to Prototype Pollution via the handler function which could be tricked into adding or modifying properties of ObjeCVE-2022-25296 · Other software · Bodymen Project · reported by report@snyk.ioMedium 6.3
The package bodymen from 0.0.0 are vulnerable to Prototype Pollution via the handler function which could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. **Note:** This vulnerability derives from an incomplete fix to [CVE-2019-10792](https://security.snyk.io/vuln/SNYK-JS-BODYMEN-548897)
- Product
- Bodymen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2022SailsJS Sails.js <=1.4.0 is vulnerable to Prototype Pollution via controller/load-action-modules.js, function loadActionModules().CVE-2021-44908 · Other software · Sailsjs · reported by MITRECritical 9.8
SailsJS Sails.js <=1.4.0 is vulnerable to Prototype Pollution via controller/load-action-modules.js, function loadActionModules().
- Product
- Sails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2022jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).CVE-2022-23395 · Other software · Jquery.cookie Project · reported by MITREMedium 6.1
jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).
- Product
- Jquery.cookie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comsnyk.io
Feb 18, 2022The package object-extend from 0.0.0 are vulnerable to Prototype Pollution via object-extend.CVE-2021-23702 · Other software · Object-extend Project · reported by report@snyk.ioHigh 7.6
The package object-extend from 0.0.0 are vulnerable to Prototype Pollution via object-extend.
- Product
- Object-extend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2022Prototype pollution vulnerability via .parse() in Plist before v3.0.4 allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution.CVE-2022-22912 · Other software · Plist Project · reported by MITRECritical 9.8
Prototype pollution vulnerability via .parse() in Plist before v3.0.4 allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution.
- Product
- Plist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022njs through 0.7.1, used in NGINX, was discovered to contain a segmentation violation via njs_object_set_prototype in /src/njs_object.c.CVE-2021-46462 · Network & remote access · F5 · reported by MITREHigh 7.5
njs through 0.7.1, used in NGINX, was discovered to contain a segmentation violation via njs_object_set_prototype in /src/njs_object.c.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into CVE-2021-23507 · Other software · Skratchdot · reported by report@snyk.ioHigh 7.5
The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-OBJECTPATHSET-607908
- Product
- Object-path-set
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.