CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
variantThe product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (709)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-34621US | —OT kritisch | KEV | ||
Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerab… | ||||
| CVE-2019-0230US | critical9.8 | Exploit | ||
Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. | ||||
| CVE-2022-24760US | critical10.0 | Exploit | ||
Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects… | ||||
| CVE-2019-11358US | medium6.1 | Exploit | ||
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source ob… | ||||
| CVE-2020-7774US | critical9.8 | — | ||
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution. | ||||
| CVE-2025-25014US | critical9.8 | Exploit | ||
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints. | ||||
| CVE-2022-1802US | high8.8 | Exploit | ||
If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code i… | ||||
| CVE-2022-39396US | critical9.8 | — | ||
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.18, and prior to 5.3.1 on the 5.X branch, are vulnera… | ||||
| CVE-2011-10019US | critical9.8 | Exploit | ||
Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via th… | ||||
| CVE-2021-44906US | critical9.8 | Exploit | ||
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95). | ||||
| CVE-2021-23383US | critical9.8 | Exploit | ||
The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source. | ||||
| CVE-2020-7699US | critical9.8 | Exploit | ||
This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execu… | ||||
| CVE-2019-19919US | critical9.8 | Exploit | ||
Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ propert… | ||||
| CVE-2026-44789US | critical9.9 | Exploit | ||
n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could achieve global… | ||||
| CVE-2023-26136US | critical9.8 | Exploit | ||
Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode.… | ||||
| CVE-2022-2564US | critical9.8 | — | ||
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6. | ||||
| CVE-2021-23450US | critical9.8 | — | ||
All versions of package dojo are vulnerable to Prototype Pollution via the setObject function. | ||||
| CVE-2020-8158US | critical9.8 | Exploit | ||
Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attac… | ||||
| CVE-2026-2964US | critical9.8 | Exploit | ||
A vulnerability was identified in higuma web-audio-recorder-js 0.1/0.1.1. Impacted is the function extend in the library lib/WebAudioRecorder.js of the component Dynamic Config Han… | ||||
| CVE-2024-48910US | critical9.8 | Exploit | ||
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2. | ||||
03
Angriffsmuster (3)
CAPEC-Angriffsmuster, die dies ausnutzen.
04
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan