Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

CVEs (572)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-7718 1Gammautils Project 1Gammautils Jun 17, 2026 Sep 1, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 All versions of package gammautils are vulnerable to Prototype Pollution via the deepSet and deepMerge functions.
CVE-2020-7717 1Dot Notes Project 1Dot Notes Jun 17, 2026 Sep 1, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 All versions of package dot-notes are vulnerable to Prototype Pollution via the create function.
CVE-2020-7716 1Invertase 1Deeps Jun 17, 2026 Sep 1, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 All versions of package deeps are vulnerable to Prototype Pollution via the set function.
CVE-2020-7715 1Deep Get Set Project 1Deep Get Set Jun 17, 2026 Sep 1, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function.
CVE-2020-7714 1Realseriousgames 1Confucious Jun 17, 2026 Sep 1, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 All versions of package confucious are vulnerable to Prototype Pollution via the set function.
CVE-2020-7713 1Arr Flatten Unflatten Project 1Arr Flatten Unflatten Jun 17, 2026 Sep 1, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 All versions of package arr-flatten-unflatten are vulnerable to Prototype Pollution via the constructor.
CVE-2020-7708 1Irrelon 2@irrelon/path Irrelon Path Jun 17, 2026 Aug 18, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The package irrelon-path before 4.7.0; the package @irrelon/path before 4.7.0 are vulnerable to Prototype Pollution via the set, unSet, pushVal and pullVal functions.
CVE-2020-7707 1Property Expr Project 1Property Expr Jun 17, 2026 Aug 18, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function.
CVE-2020-7706 1Connie Lang Project 1Connie Lang Jun 17, 2026 Aug 18, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The package connie-lang before 0.1.1 are vulnerable to Prototype Pollution in the configuration language library used by connie.
CVE-2020-7704 1Linux Cmdline Project 1Linux Cmdline Jun 17, 2026 Aug 17, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The package linux-cmdline before 1.0.1 are vulnerable to Prototype Pollution via the constructor.
CVE-2020-7703 1Nis Utils Project 1Nis Utils Jun 17, 2026 Aug 17, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 All versions of package nis-utils are vulnerable to Prototype Pollution via the setValue function.
CVE-2020-7702 1Templ8 Project 1Templ8 Jun 17, 2026 Aug 17, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 All versions of package templ8 are vulnerable to Prototype Pollution via the parse function.
CVE-2020-7701 1Springtree 1Madlib Object Utils Jun 17, 2026 Aug 14, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.
CVE-2020-7700 1Php.js Project 1Php.js Jun 17, 2026 Aug 14, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 All versions of phpjs are vulnerable to Prototype Pollution via parse_str.
CVE-2020-7699 2Express Fileupload Project Netapp 2Express Fileupload Max Data Jun 17, 2026 Jul 30, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution.
CVE-2020-15366 1Ajv.js 1Ajv Jun 17, 2026 Jul 15, 2020 N/A· v4 5.6 MEDIUM· v3 6.8 MEDIUM· v2 An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted...Show more An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)Show less
CVE-2020-8203 2Lodash Oracle 18Banking Corporate Lending Process Management Banking Credit Facilities Process ManagementBanking Extensibility Workbench+15 more Jun 17, 2026 Jul 15, 2020 N/A· v4 7.4 HIGH· v3 5.8 MEDIUM· v2 Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
CVE-2020-7679 1Casperjs 1Casperjs Jun 17, 2026 Jun 19, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In all versions of package casperjs, the mergeObjects utility function is susceptible to Prototype Pollution.
CVE-2020-11066 1Typo3 1Typo3 Jun 17, 2026 May 14, 2020 N/A· v4 10.0 CRITICAL· v3 6.4 MEDIUM· v2 In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, calling unserialize() on malicious user-submitted content can lead to modification of dynamically...Show more In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, calling unserialize() on malicious user-submitted content can lead to modification of dynamically-determined object attributes and result in triggering deletion of an arbitrary directory in the file system, if it is writable for the web server. It can also trigger message submission via email using the identity of the web site (mail relay). Another insecure deserialization vulnerability is required to actually exploit mentioned aspects. This has been fixed in 9.5.17 and 10.4.2.Show less
CVE-2020-7644 1Fun Map Project 1Fun Map Jun 17, 2026 Apr 28, 2020 N/A· v4 8.1 HIGH· v3 6.8 MEDIUM· v2 fun-map through 3.3.1 is vulnerable to Prototype Pollution. The function assocInM could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.

Previous 1...25 262728 29 Next