38 matches found
CVE-2021-24238
The Realteo WordPress plugin (pre-1.2.4), used by the Findeo Theme, is vulnerable due to a missing ownership check when deleting a property. An authenticated user can tamper with the property_id parameter to delete properties belonging to others, enabling an IDOR-like impact. The issue is tied to...
Prototype Pollution
hellojs is vulnerable to prototype pollution. An attacker is able to exploit the vulnerability to inject arbitrary properties into hello.utils.extend construct prototypes and modify attributes such as proto, constructor and prototype...
Prototype Pollution
total.js is vulnerable to prototype pollution. The keys of the path being set are not properly sanitized, allowing for injection of arbitrary properties into existing construct prototypes and modification of attributes such as proto, constructor and prototype...
Prototype Pollution
merge-deep is vulnerable to prototype pollution attacks. An attacker is able to inject and overwrite arbitrary properties such as proto, constructor or prototype, resulting in privilege escalation, denial of service or potential arbitrary code execution...
Prototype Pollution
asciitable.js is vulnerable to prototype pollution. An attacker is able to exploit the vulnerability in the default function in main to inject arbitrary properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...
Prototype Pollution
set-object-value is vulnerable to prototype pollution. An attacker is able to exploit the vulnerability to inject arbitrary properties into existing construct prototypes and modify attributes such as proto, constructor and prototype causing a denial of service and may lead to remote code executio...
Prototype Pollution
js-data is vulnerable to pollution prototype. An attacker is able to exploit the vulnerability to inject arbitrary properties into existing construct prototypes and modify attributes such as proto, constructor and prototype via the deepMixIn function...
Prototype Pollution
controlled-merge is vulnerable to prototype pollution. Lack of validation allows an attacker to inject arbitrary properties into proto or constructor to crash the application and potentially obtain remote code execution...
Prototype Pollution
object-hierarchy-access is vulnerable to prototype pollution. An attacker is able to inject arbitrary properties into proto and crash the application or potentially obtain arbitrary code execution...
Prototype Pollution
object-hierarchy-access is vulnerable to prototype pollution. An attacker is able to inject arbitrary properties into proto and crash the application or potentially obtain arbitrary code execution...
Prototype Pollution
field is vulnerable to Prototype Pollution. Failure to sanitize the field in the levelUp function and moveUp function allows for injection of arbitrary properties into existing construct prototypes and modification of attributes such as proto, constructor and prototype...
Prototype Pollution
json-ptr is vulnerable to prototype pollution. An attacker is able to inject arbitrary properties into existing construct prototypes...
Prototype Pollution
casperjs is vulnerable to prototype pollution. The mergeObjects function in utils.js does not validate object types and allows an attacker to inject arbitrary properties to overwrite proto or constructor attributes...
Prototype Pollution
just-extend is vulnerable to prototype pollution. An attacker is able to inject arbitrary properties into Object.prototype to add or modify existing properties due to a lack of object validation...
CVE-2018-16490
A prototype pollution vulnerability was found in module mpath 0.5.1 that allows an attacker to inject arbitrary properties onto Object.prototype...
CVE-2018-16492
A prototype pollution vulnerability was found in module extend 2.0.2, 3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype...
