Modification of Assumed-Immutable Data (MAID)

Every one of the 38 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passin…CVE-2022-21824NodeJS · 22% likely

   Node.js

2. hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which…CVE-2018-3728hapi · 4.2% likely
3. Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service o…CVE-2020-8147utils-extend · 3.1% likely
4. Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language…CVE-2020-8116dot-prop · 3.1% likely
5. lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malici…CVE-2018-3721HackerOne · 2.3% likely

   HackerOne

6. Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection atta…CVE-2020-8158typeorm · 2.1% likely
7. mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" v…CVE-2018-3719HackerOne · 2.1% likely

   HackerOne

8. defaults-deep node module before 0.2.4 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object…CVE-2018-3723HackerOne · 2.0% likely

   HackerOne

9. merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" v…CVE-2018-3722HackerOne · 2.0% likely

   HackerOne

10. assign-deep node module before 0.4.7 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object"…CVE-2018-3720HackerOne · 2.0% likely

    HackerOne

11. Prototype pollution in object-pathCVE-2020-15256mariocasciaro · CVSS 7.7 · 1.5% likely
12. Arbitrary Code ExecutionCVE-2022-25893vm2 · CVSS 9.8 · 1.5% likely
13. Prototype Pollution in highlight.jsCVE-2020-26237highlightjs · CVSS 5.8 · 1.3% likely
14. Prototype pollution vulnerability in json8-merge-patch npm package < 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor.CVE-2020-8268json8-merge-patch · 1.3% likely
15. Modification of Assumed-Immutable Data (MAID) in RDT400 in SICK APU allows an unprivileged remote attacker to make the site unable to load necessary strings via changing file path…CVE-2023-43697SICK AG · CVSS 6.5 · 0.9% likely

    SICK AG

16. A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to manipulate pages where the…CVE-2022-3288GitLab · CVSS 3.5 · 0.8% likely

    GitLab

17. Azure Active Directory Elevation of Privilege VulnerabilityCVE-2026-50481Microsoft · CVSS 9.9 · 0.8% likely

    Microsoft

18. A logic flaw in Ray-Ban® Stories device software allowed some parameters like video capture duration limit to be modified through the Facebook View application. This issue affecte…CVE-2021-24046Meta Platforms, Inc · 0.7% likely

    Meta (Facebook)

19. era-compiler-vyper First Immutable Variable Initialization vulnerabilityCVE-2023-46232matter-labs · CVSS 5.3 · 0.7% likely

    Matter-Labs

20. An issue was discovered in Exasol JDBC driver before 24.2.1 (2024-12-10). Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process…CVE-2024-55551Exasol · CVSS 8.3 · 0.6% likely
21. The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access.CVE-2024-34517Neo4j · CVSS 6.5 · 0.6% likely

    Neo4j

22. AzeoTech DAQFactoryCVE-2021-42701AzeoTech · CVSS 5 · 0.6% likely

    AzeoTech

23. Crafted backend URLs in Lura ProjectCVE-2022-1561KrakenD · CVSS 4 · 0.6% likely
24. CVE-2023-2904HID Global · CVSS 7.3 · 0.6% likely

    HID Global

25. A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The status provided by the syslog clients managed by the affected software can be ma…CVE-2021-37177Siemens · CVSS 6.5 · 0.4% likely

    Siemens

26. IBM QRadar WinCollect Agent data manipulationCVE-2024-51462IBM · CVSS 4 · 0.4% likely

    IBM

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.