Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
443 results · page 4 of 9
Jul 1, 2024akbr patch-into v1.0.1 was discovered to contain a prototype pollution via the function patchInto.CVE-2024-38991 · Other software · akbr · reported by MITREHigh 8.8
akbr patch-into v1.0.1 was discovered to contain a prototype pollution via the function patchInto. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- Product
- patch-into
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 1, 2024Tada5hi sp-common v0.5.4 was discovered to contain a prototype pollution via the function mergeDeep.CVE-2024-38990 · Other software · tada5hi · reported by MITREMedium 6.3
Tada5hi sp-common v0.5.4 was discovered to contain a prototype pollution via the function mergeDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- Product
- sp_common
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 1, 2024aofl cli-lib v3.14.0 was discovered to contain a prototype pollution via the component defaultsDeep.CVE-2024-38987 · Other software · ageoflearning · reported by MITREMedium 6.3
aofl cli-lib v3.14.0 was discovered to contain a prototype pollution via the component defaultsDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- Product
- cli-lib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jun 17, 2024akbr update 1.0.0 is vulnerable to Prototype Pollution via update/index.js.CVE-2024-36578 · Other software · akbr · reported by MITREMedium 5.9
akbr update 1.0.0 is vulnerable to Prototype Pollution via update/index.js.
- Product
- update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 17, 2024apphp js-object-resolver < 3.1.1 is vulnerable to Prototype Pollution via Module.setNestedProperty.CVE-2024-36577 · Other software · apphp · reported by MITREHigh 8.3
apphp js-object-resolver < 3.1.1 is vulnerable to Prototype Pollution via Module.setNestedProperty.
- Product
- apphp_js-object-resolver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 17, 2024A Prototype Pollution issue in getsetprop 1.1.0 allows an attacker to execute arbitrary code via global.accessor.CVE-2024-36575 · Other software · notabotai · reported by MITRECritical 9.8
A Prototype Pollution issue in getsetprop 1.1.0 allows an attacker to execute arbitrary code via global.accessor.
- Product
- getsetprop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 17, 2024A Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON (flatten-json/index.js:42)CVE-2024-36574 · Other software · amirziai · reported by MITREMedium 6.3
A Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON (flatten-json/index.js:42)
- Product
- flatten_json
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 17, 2024almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@almela/obx/build/indexCVE-2024-36573 · Other software · almela · reported by MITRECritical 9.8
almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@almela/obx/build/index.js:470), Object.set (obx/build/index.js:269) component.
- Product
- obx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 17, 2024alexbinary object-deep-assign 1.0.11 is vulnerable to Prototype Pollution via the extend() method of Module.deepAssign (/src/index.js)CVE-2024-36582 · Other software · alykoshin · reported by MITRECritical 9.8
alexbinary object-deep-assign 1.0.11 is vulnerable to Prototype Pollution via the extend() method of Module.deepAssign (/src/index.js)
- Product
- mini-deep-assign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 17, 2024A Prototype Pollution issue in abw badger-database 1.2.1 allows an attacker to execute arbitrary code via dist/badger-database.esm.CVE-2024-36581 · Other software · prototype_solution · reported by MITREHigh 7.6
A Prototype Pollution issue in abw badger-database 1.2.1 allows an attacker to execute arbitrary code via dist/badger-database.esm.
- Product
- abw_badger_database
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 17, 2024A Prototype Pollution issue in byondreal accessor <= 1.0.0 allows an attacker to execute arbitrary code via @byondreal/accessor/index.CVE-2024-36583 · Other software · byondreal · reported by MITREHigh 8.1
A Prototype Pollution issue in byondreal accessor <= 1.0.0 allows an attacker to execute arbitrary code via @byondreal/accessor/index.
- Product
- accessor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 17, 2024A Prototype Pollution issue in cdr0 sg 1.0.10 allows an attacker to execute arbitrary code.CVE-2024-36580 · Other software · cdr0 · reported by MITRECritical 9.8
A Prototype Pollution issue in cdr0 sg 1.0.10 allows an attacker to execute arbitrary code.
- Product
- sg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
May 29, 2024Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when usingCVE-2024-21512 · Other software · mysql2 · reported by report@snyk.ioHigh 8.2
Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.
- Product
- mysql2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
May 20, 2024A Prototype Pollution issue in API Dev Tools json-schema-ref-parser v.11.0.0 and v.11.1.0 allows a remote attacker to execute arbitrary code via the bundle()`, CVE-2024-29651 · Other software · apidevtools · reported by MITREHigh 8.1
A Prototype Pollution issue in API Dev Tools json-schema-ref-parser v.11.0.0 and v.11.1.0 allows a remote attacker to execute arbitrary code via the bundle()`, `parse()`, `resolve()`, `dereference() functions.
- Product
- json-schema-ref-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
May 20, 2024A Prototype Pollution issue in MiguelCastillo @bit/loader v.10.0.3 allows an attacker to execute arbitrary code via the M function e argument in index.js.CVE-2024-24293 · Other software · miguelcastillo · reported by MITREHigh 8.8
A Prototype Pollution issue in MiguelCastillo @bit/loader v.10.0.3 allows an attacker to execute arbitrary code via the M function e argument in index.js.
- Product
- bit-loader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
May 20, 2024A Prototype Pollution issue in Blackprint @blackprint/engine v.0.9.0 allows an attacker to execute arbitrary code via the _utils.setDeepProperty function of engCVE-2024-24294 · Other software · blackprint · reported by MITRECritical 9.8
A Prototype Pollution issue in Blackprint @blackprint/engine v.0.9.0 allows an attacker to execute arbitrary code via the _utils.setDeepProperty function of engine.min.js.
- Product
- blackprint_engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
May 16, 2024njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method.CVE-2024-34273 · Other software · jwtk · reported by MITREMedium 5.9
njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method.
- Product
- njwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2024Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization pCVE-2024-21509 · Other software · mysqljs · reported by report@snyk.ioMedium 6.5
Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser.js.
- Product
- mysql2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.slonser.infogithub.com
Mar 25, 2024Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive CVE-2024-21505 · Other software · web3 · reported by report@snyk.ioHigh 7.5
Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive merge. An attacker can manipulate an object's prototype, potentially leading to the alteration of the behavior of all objects inheriting from the affected prototype by passing specially crafted input to these functions.
- Product
- web3-utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.snyk.io
Feb 23, 2024SocialDriver: 2024 has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties resulting in a cross-site scripting (XSS) attackCVE-2023-4826 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SocialDriver WordPress theme before version 2024 has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties resulting in a cross-site scripting (XSS) attack.
- Product
- SocialDriver
- Fixed in
- 2024
- What to do
- Update SocialDriver to 2024 or newer.
Full record and what to do →NVD recordsocialdriver.comwpscan.com
Jan 5, 2024A prototype pollution vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-39296 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.5
A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to override existing attributes with ones that have incompatible type, which may lead to a crash via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2023fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.CVE-2023-26920 · Other software · Naturalintelligence · reported by MITREMedium 6.5
fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.
- Product
- Fast XML Parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 8, 2023All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute resolves to the objeCVE-2023-26158 · Other software · Mockjs · reported by report@snyk.ioHigh 8.2
All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute resolves to the object prototype. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). User controlled inputs inside the extend() method of the Mock.Handler, Mock.Random, Mock.RE.Handler or Mock.Util, will allow an attacker to exploit this vulnerability. Workaround By using a denylist of dangerous attributes, this weakness can be eliminated. Add the following line in the Util.extend function: js js if (["__proto__", "constructor", "prototype"].includes(name)) continue js // src/mock/handler.js Util.extend = function extend() { var target = arguments[0] || {}, i = 1, length = arguments.length, options, name, src, copy, clone if (length === 1) { target = this
- Product
- Mock.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.snyk.io
Nov 24, 2023Prototype Pollution in GitHub repository robinbuschmann/sequelize-typescript prior to 2.1.6.CVE-2023-6293 · Other software · robinbuschmann · reported by security@huntr.devHigh 7.1
Prototype Pollution in GitHub repository robinbuschmann/sequelize-typescript prior to 2.1.6.
- Product
- robinbuschmann/sequelize-typescript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2023 Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitraCVE-2023-1717 · Other software · Bitrix24 · reported by info@starlabs.sgCritical 9.6
Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via polluting `__proto__[tag]` and `__proto__[text]`.
- Product
- Bitrix24
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstarlabs.sgstarlabs.sg
Oct 6, 2023In NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action.CVE-2023-45282 · Other software · Nasa · reported by MITREHigh 7.5
In NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action.
- Product
- Openmct
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2023A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function.CVE-2023-38894 · Other software · Tree KIT Project · reported by MITRECritical 9.8
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function.
- Product
- Tree KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comcode-intelligence.com
Aug 11, 2023Prototype pollution vulnerability in MrSwitch hello.js version 1.18.6, allows remote attackers to execute arbitrary code via hello.utils.extend function.CVE-2021-26505 · Other software · Hello.js Project · reported by MITRECritical 9.8
Prototype pollution vulnerability in MrSwitch hello.js version 1.18.6, allows remote attackers to execute arbitrary code via hello.utils.extend function.
- Product
- Hello.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2023Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() function.CVE-2023-26139 · Other software · Underscore-keypath Project · reported by report@snyk.ioHigh 7.5
Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() function. Exploiting this vulnerability is possible due to improper input sanitization which allows the usage of arguments like “__proto__”.
- Product
- Underscore-keypath
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comsecurity.snyk.io
Jul 17, 2023Popup by Supsystic: Has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into ObjectCVE-2023-3186 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Popup by Supsystic WordPress plugin before 1.10.19 has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into Object.prototype.
- Product
- Popup by Supsystic
- Fixed in
- 1.10.19
- What to do
- Update Popup by Supsystic to 1.10.19 or newer.
Jul 16, 2023Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.CVE-2023-3696 · Other software · automattic · reported by security@huntr.devCritical 9.8
Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.
- Product
- automattic/mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2023"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878.CVE-2023-36665 · Other software · Protobufjs Project · reported by MITRECritical 9.8
"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty.
- Product
- Protobufjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2023Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicCVE-2023-26136 · Other software · Salesforce · reported by report@snyk.ioMedium 6.5
Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.
- Product
- Tough-cookie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2023All versions of the package flatnest are vulnerable to Prototype Pollution via the nest() function in the flatnest/nest.js file.CVE-2023-26135 · Other software · Flatnest Project · reported by report@snyk.ioHigh 7.3
All versions of the package flatnest are vulnerable to Prototype Pollution via the nest() function in the flatnest/nest.js file.
- Product
- Flatnest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2023All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js.CVE-2023-26133 · Other software · Progressbar.js Project · reported by report@snyk.ioHigh 8.2
All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js.
- Product
- Progressbar.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2023Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable inCVE-2023-26132 · Other software · Dottie Project · reported by report@snyk.ioHigh 7.5
Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.
- Product
- Dottie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.CVE-2023-2972 · Other software · antfu · reported by security@huntr.devCritical 9.8
Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.
- Product
- antfu/utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Jerryscript 3.0 (commit 05dbbd1) was discovered to contain a heap-buffer-overflow via the component ecma_builtin_typedarray_prototype_sort.CVE-2023-31908 · Other software · Jerryscript · reported by MITREHigh 7.8
Jerryscript 3.0 (commit 05dbbd1) was discovered to contain a heap-buffer-overflow via the component ecma_builtin_typedarray_prototype_sort.
- Product
- Jerryscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023A prototype pollution vulnerability exists in Strikingly CMS which can result in reflected cross-site scripting (XSS) in affected applications and sites built wCVE-2023-2582 · Other software · Strikingly · reported by vulnreport@tenable.comMedium 6.1
A prototype pollution vulnerability exists in Strikingly CMS which can result in reflected cross-site scripting (XSS) in affected applications and sites built with Strikingly. The vulnerability exists because of Strikingly JavaScript library parsing the URL fragment allows access to the __proto__ or constructor properties and the Object prototype. By leveraging an embedded gadget like jQuery, an attacker who convinces a victim to visit a specially crafted link could achieve arbitrary javascript execution in the context of the user's browser.
- Product
- Strikingly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Apr 26, 2023vConsole v3.15.0 was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions in core.ts.CVE-2023-30363 · Other software · Tencent · reported by MITRECritical 9.8
vConsole v3.15.0 was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions in core.ts.
- Product
- Vconsole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Apr 24, 2023SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file.CVE-2023-30533 · Other software · Sheetjs · reported by MITREHigh 7.8
SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file. In other words. 0.19.2 and earlier are affected, whereas 0.19.3 and later are unaffected.
- Product
- Sheetjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcdn.sheetjs.comgit.sheetjs.com
Apr 11, 2023All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content.CVE-2023-26121 · Other software · Safe-eval Project · reported by report@snyk.ioHigh 7.5
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content.
- Product
- Safe-eval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Mar 18, 2023Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js.CVE-2023-26113 · Other software · Collection.js Project · reported by report@snyk.ioHigh 7.5
Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js.
- Product
- Collection.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2023An issue was discovered in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to execute arbitrary code via crafted Object.prototype anonymous funcCVE-2023-25344 · Other software · Swig-templates Project · reported by MITRECritical 9.8
An issue was discovered in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to execute arbitrary code via crafted Object.prototype anonymous function.
- Product
- Swig-templates
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgem-love.com
Mar 6, 2023All versions of the package dot-lens are vulnerable to Prototype Pollution via the set() function in index.js file.CVE-2023-26106 · Other software · Dot-lens Project · reported by report@snyk.ioHigh 7.5
All versions of the package dot-lens are vulnerable to Prototype Pollution via the set() function in index.js file.
- Product
- Dot-lens
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.snyk.io
Feb 28, 2023All versions of the package utilities are vulnerable to Prototype Pollution via the _mix function.CVE-2023-26105 · Other software · Utilities Project · reported by report@snyk.ioHigh 7.5
All versions of the package utilities are vulnerable to Prototype Pollution via the _mix function.
- Product
- Utilities
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.snyk.io
Feb 24, 2023All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function uses recursive mergeCVE-2023-26102 · Other software · Rangy Project · reported by report@snyk.ioHigh 7.5
All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function uses recursive merge which can lead an attacker to modify properties of the Object.prototype
- Product
- Rangy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.snyk.io
Feb 23, 2023A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account.CVE-2023-23917 · Other software · Rocket.chat · reported by support@hackerone.comHigh 8.8
A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create their own server in your cloud and become an admin so this vulnerability could affect the cloud infrastructure. This attack vector also may increase the impact of XSS to RCE which is dangerous for self-hosted users as well.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Feb 20, 2023Prototype Pollution in Visioweb.js 1.10.6 allows attackers to execute XSS on the client system.CVE-2022-3901 · Other software · Visio Globe · reported by csirt@divd.nlHigh 7.2
Prototype Pollution in Visioweb.js 1.10.6 allows attackers to execute XSS on the client system.
- Product
- Visioweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcsirt.divd.nlcsirt.divd.nl
Dec 22, 2022If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading to privileged code exCVE-2022-2200 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading to privileged code execution. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.