42 matches found
Prototype Pollution
deep-defaults is vulnerable to prototype pollution. The vulnerability exists as it is possible to overwrite Object.prototype with arbitrary object properties in the deepDefaults function...
CVE-2021-24238
The Realteo WordPress plugin (pre-1.2.4), used by the Findeo Theme, is vulnerable due to a missing ownership check when deleting a property. An authenticated user can tamper with the property_id parameter to delete properties belonging to others, enabling an IDOR-like impact. The issue is tied to...
CVE-2021-24238: Improper Access Control
The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not ensure that the requested property to be deleted belong to the user making the request, allowing any authenticated users to delete arbitrary properties by tampering with the propertyid parameter...
Prototype Pollution
hellojs is vulnerable to prototype pollution. An attacker is able to exploit the vulnerability to inject arbitrary properties into hello.utils.extend construct prototypes and modify attributes such as proto, constructor and prototype...
Prototype Pollution
total.js is vulnerable to prototype pollution. The keys of the path being set are not properly sanitized, allowing for injection of arbitrary properties into existing construct prototypes and modification of attributes such as proto, constructor and prototype...
Prototype Pollution
merge-deep is vulnerable to prototype pollution attacks. An attacker is able to inject and overwrite arbitrary properties such as proto, constructor or prototype, resulting in privilege escalation, denial of service or potential arbitrary code execution...
Prototype Pollution
asciitable.js is vulnerable to prototype pollution. An attacker is able to exploit the vulnerability in the default function in main to inject arbitrary properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...
Prototype Pollution
set-object-value is vulnerable to prototype pollution. An attacker is able to exploit the vulnerability to inject arbitrary properties into existing construct prototypes and modify attributes such as proto, constructor and prototype causing a denial of service and may lead to remote code executio...
Prototype Pollution
js-data is vulnerable to pollution prototype. An attacker is able to exploit the vulnerability to inject arbitrary properties into existing construct prototypes and modify attributes such as proto, constructor and prototype via the deepMixIn function...
Prototype Pollution
controlled-merge is vulnerable to prototype pollution. Lack of validation allows an attacker to inject arbitrary properties into proto or constructor to crash the application and potentially obtain remote code execution...
Prototype Pollution
object-hierarchy-access is vulnerable to prototype pollution. An attacker is able to inject arbitrary properties into proto and crash the application or potentially obtain arbitrary code execution...
Prototype Pollution
object-hierarchy-access is vulnerable to prototype pollution. An attacker is able to inject arbitrary properties into proto and crash the application or potentially obtain arbitrary code execution...
Prototype Pollution
field is vulnerable to Prototype Pollution. Failure to sanitize the field in the levelUp function and moveUp function allows for injection of arbitrary properties into existing construct prototypes and modification of attributes such as proto, constructor and prototype...
Prototype Pollution
json-ptr is vulnerable to prototype pollution. An attacker is able to inject arbitrary properties into existing construct prototypes...
Prototype Pollution
casperjs is vulnerable to prototype pollution. The mergeObjects function in utils.js does not validate object types and allows an attacker to inject arbitrary properties to overwrite proto or constructor attributes...
CVE-2020-8116
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects...
CVE-2020-8116: Modification of Assumed-Immutable Data (MAID)
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects...
Prototype Pollution
just-extend is vulnerable to prototype pollution. An attacker is able to inject arbitrary properties into Object.prototype to add or modify existing properties due to a lack of object validation...
