{"id":"EUVD-2022-0644","enisaUuid":"e588075a-bbf4-3566-9e82-8ccaf73c7936","description":"All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.","datePublished":"Dec 17, 2021, 8:05:19 PM","dateUpdated":"Oct 8, 2026, 9:13:57 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P","references":"https://snyk.io/vuln/SNYK-JS-DOJO-1535223\nhttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2313033\nhttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBDOJO-2313034\nhttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2313035\nhttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2313036\nhttps://github.com/dojo/dojo/blob/4c39c14349408fc8274e19b399ffc660512ed07c/_base/lang.js%23L172\nhttps://www.oracle.com/security-alerts/cpuapr2022.html\nhttps://www.oracle.com/security-alerts/cpujul2022.html\nhttps://lists.debian.org/debian-lts-announce/2023/01/msg00030.html\n","aliases":"CVE-2021-23450\nGHSA-m8gw-hjpr-rjv7\n","assigner":"snyk","epss":30.37,"enisaIdProduct":[{"id":"412ff0ec-b0a6-301a-b894-ef5aa9c81fa4","product":{"name":"dojo","vendor":{"name":"pwncollege"}},"product_version":"0 \u003cunspecified"}],"enisaIdVendor":[{"id":"ca3fd520-357a-39d1-a2f3-6cccd63435bf","vendor":{"name":"n/a"}}],"enisaIdVulnerability":[{"id":"21938096-6c8b-331b-8979-d27935ae33cc","vulnerability":{"id":"GHSA-m8gw-hjpr-rjv7","description":"Prototype Pollution in dojo","datePublished":"Jan 5, 2022, 3:01:46 PM","dateUpdated":"Jan 4, 2022, 5:43:26 PM","baseScore":null,"references":"https://nvd.nist.gov/vuln/detail/CVE-2021-23450\nhttps://github.com/dojo/dojo\nhttps://github.com/dojo/dojo/blob/4c39c14349408fc8274e19b399ffc660512ed07c/_base/lang.js%23L172\nhttps://lists.debian.org/debian-lts-announce/2023/01/msg00030.html\nhttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2313036\nhttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2313035\nhttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBDOJO-2313034\nhttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2313033\nhttps://snyk.io/vuln/SNYK-JS-DOJO-1535223\nhttps://www.oracle.com/security-alerts/cpuapr2022.html\nhttps://www.oracle.com/security-alerts/cpujul2022.html\n","enisa_id":"EUVD-2022-0644\n","aliases":"GHSA-m8gw-hjpr-rjv7\nCVE-2021-23450\n","epss":0.0,"dataProcessed":"Apr 21, 2026, 4:03:56 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"6dcebc42-b694-3e99-9fc5-927b7e53c784","vulnerability":{"id":"CVE-2021-23450","description":"All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.","datePublished":"Dec 17, 2021, 8:05:19 PM","dateUpdated":"Oct 8, 2026, 9:13:57 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P","references":"https://snyk.io/vuln/SNYK-JS-DOJO-1535223\nhttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2313033\nhttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBDOJO-2313034\nhttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2313035\nhttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2313036\nhttps://github.com/dojo/dojo/blob/4c39c14349408fc8274e19b399ffc660512ed07c/_base/lang.js%23L172\nhttps://www.oracle.com/security-alerts/cpuapr2022.html\nhttps://www.oracle.com/security-alerts/cpujul2022.html\nhttps://lists.debian.org/debian-lts-announce/2023/01/msg00030.html\n","enisa_id":"EUVD-2022-0644\n","assigner":"snyk","epss":30.37,"dataProcessed":"Nov 9, 2026, 7:12:14 AM","vulnerabilityProduct":[{"id":"2fb19a4e-05ca-381d-83c0-b3abfcac1337","product":{"name":"dojo","vendor":{"name":"pwncollege"}},"product_version":"0 \u003cunspecified"}],"vulnerabilityVendor":[{"id":"ca047b1d-004c-3392-8a57-49f9fcef004e","vendor":{"name":"n/a"}}]}}],"enisaIdAdvisory":[{"id":"072b97b0-6a4c-311a-b8d2-8e94cf96a6c7","advisory":{"id":"WID-SEC-W-2023-0809","description":"IBM QRadar SIEM: Mehrere Schwachstellen","summary":"Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, Informationen falsch darzustellen, einen Denial of Service Zustand herbeizuführen, Sicherheitsvorkehrungen zu umgehen, einen Cross-Site-Scripting-Angriff durchzuführen oder unbekannte Auswirkungen zu verursachen.","datePublished":"Mar 30, 2023, 10:00:00 PM","dateUpdated":"Feb 19, 2024, 11:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0809.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2023-0809\n","aliases":"CVE-2023-22809\nCVE-2022-4883\nCVE-2022-46364\nCVE-2022-46363\nCVE-2022-45143\nCVE-2022-42890\nCVE-2022-4254\nCVE-2022-42252\nCVE-2022-41966\nCVE-2022-41946\nCVE-2022-41704\nCVE-2022-40156\nCVE-2022-40155\nCVE-2022-40154\nCVE-2022-40153\nCVE-2022-40152\nCVE-2022-40150\nCVE-2022-40149\nCVE-2022-37603\nCVE-2022-37601\nCVE-2022-37599\nCVE-2022-37598\nCVE-2022-3676\nCVE-2022-36364\nCVE-2022-36033\nCVE-2022-34917\nCVE-2022-31197\nCVE-2022-31129\nCVE-2022-2964\nCVE-2022-28733\nCVE-2022-2795\nCVE-2022-25927\nCVE-2022-25901\nCVE-2022-25758\nCVE-2022-25647\nCVE-2022-24999\nCVE-2022-24839\nCVE-2022-24823\nCVE-2022-24785\nCVE-2022-23437\nCVE-2022-22971\nCVE-2022-22970\nCVE-2022-21724\nCVE-2022-21628\nCVE-2022-21626\nCVE-2022-21624\nCVE-2022-21619\nCVE-2021-43797\nCVE-2021-42740\nCVE-2021-42581\nCVE-2021-39227\nCVE-2021-3918\nCVE-2021-3807\nCVE-2021-37713\nCVE-2021-37712\nCVE-2021-37701\nCVE-2021-3765\nCVE-2021-37137\nCVE-2021-37136\nCVE-2021-32804\nCVE-2021-32803\nCVE-2021-29060\nCVE-2021-26401\nCVE-2021-25220\nCVE-2021-23450\nCVE-2021-23382\nCVE-2021-23368\nCVE-2021-23364\nCVE-2021-23362\nCVE-2021-23343\nCVE-2021-21409\nCVE-2021-21295\nCVE-2021-21290\nCVE-2020-7764\nCVE-2020-5259\nCVE-2020-24025\nCVE-2020-15366\nCVE-2020-13936\nCVE-2019-6286\nCVE-2019-6284\nCVE-2019-6283\nCVE-2019-10785\nCVE-2018-8036\nCVE-2018-20821\nCVE-2018-20190\nCVE-2018-19839\nCVE-2018-19838\nCVE-2018-19827\nCVE-2018-19797\nCVE-2018-15494\nCVE-2018-11698\nCVE-2018-11694\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"4b8256e9-b0f7-357e-a55b-4ed69d7037b1","product":{"name":"IBM QRadar SIEM \u003c 7.5.0 UP5","vendor":{"name":"IBM"}}},{"id":"879534f7-29a5-3a7f-b728-aad5e42198d2","product":{"name":"7.5","vendor":{"name":"OpenBSD"}}},{"id":"900c2de2-964e-3331-863f-9d886f508855","product":{"name":"IBM QRadar SIEM 7.5","vendor":{"name":"IBM"}}},{"id":"9dc80c65-1a0f-3d0e-8e37-2c0af0051de6","product":{"name":"IBM QRadar SIEM \u003c 7.4.3 FP9","vendor":{"name":"IBM"}}},{"id":"ec8b3a01-15ac-3279-9373-2667eb2244b4","product":{"name":"Fedora Linux","vendor":{"name":"Fedora"}}},{"id":"f8a8c0e9-5bbf-3beb-9eb7-cb062550fec3","product":{"name":"QRadar SIEM","vendor":{"name":"IBM"}}},{"id":"fe4ab39c-85c3-3255-9440-0514db6c9c6b","product":{"name":"IBM QRadar SIEM \u003c User Behavior Analytics 4.1.11","vendor":{"name":"IBM"}}}]}},{"id":"0e5fa0fc-68fe-3fa7-af88-08dae0f1581a","advisory":{"id":"WID-SEC-W-2023-1333","description":"IBM Tivoli Business Service Manager: Schwachstelle ermöglicht Codeausführung","summary":"Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM Tivoli Business Service Manager ausnutzen, um beliebigen Programmcode auszuführen.","datePublished":"May 31, 2023, 10:00:00 PM","dateUpdated":"May 31, 2023, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-1333.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2023-1333\n","aliases":"CVE-2021-23450\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"56c0e79c-69de-3735-9e15-476109488434","product":{"name":"IBM Tivoli Business Service Manager 6.2.0","vendor":{"name":"IBM"}}}]}},{"id":"172a722a-bb56-3b9a-afe5-2033e6646812","advisory":{"id":"WID-SEC-W-2025-0825","description":"Oracle Commerce: Mehrere Schwachstellen","summary":"Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Commerce ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.","datePublished":"Apr 15, 2025, 10:00:00 PM","dateUpdated":"Apr 15, 2025, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-0825.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2025-0825\n","aliases":"CVE-2021-23450\nCVE-2023-51074\nCVE-2024-38819\nCVE-2024-45613\nCVE-2025-21576\nCVE-2025-24813\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"22f2a5e5-f52e-38ef-bc34-142b690e16ea","product":{"name":"Oracle Commerce 11.4.0","vendor":{"name":"Oracle"}}},{"id":"285dda28-e90e-3769-aa11-5a09b162ffdd","product":{"name":"Oracle Commerce 11.3.0","vendor":{"name":"Oracle"}}},{"id":"39d5e111-0367-3655-b9c8-3912d8b3400b","product":{"name":"Commerce","vendor":{"name":"craftcms"}}},{"id":"6adc5241-87ae-3c10-a6d5-498b1eef6710","product":{"name":"11.3.1","vendor":{"name":"Oracle"}}},{"id":"8496998b-5448-36c1-ae76-38e3467f03c6","product":{"name":"11.3.2","vendor":{"name":"MariaDB"}}},{"id":"9424bf1e-26db-3cf4-bb25-e4f6e26ad716","product":{"name":"11.4.0","vendor":{"name":"IBM"}}},{"id":"ab3f16e6-2e46-3643-b31e-78edb5230677","product":{"name":"Oracle Commerce 11.3.1","vendor":{"name":"Oracle"}}},{"id":"ea14e8e7-de22-3a1c-be74-6ceb0212652f","product":{"name":"Oracle Commerce 11.3.2","vendor":{"name":"Oracle"}}},{"id":"f2a3d399-2950-31cb-8395-8f32e1b46748","product":{"name":"11.3.0","vendor":{"name":"Oracle"}}}]}},{"id":"8614c72c-e297-31c5-94ab-74ddd2ca60f2","advisory":{"id":"WID-SEC-W-2024-0955","description":"HCL Domino Blog Template: Schwachstelle ermöglicht Codeausführung und Denial of Service","summary":"Ein entfernter anonymer Angreifer kann eine Schwachstelle im HCL Domino Blog Template ausnutzen, um beliebigen Code auszuführen oder einen Denial of Service zu verursachen.","datePublished":"Apr 23, 2024, 10:00:00 PM","dateUpdated":"Jan 5, 2025, 11:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0955.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2024-0955\n","aliases":"CVE-2021-23450\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"03904710-3197-3dac-a2a7-640e9878f18b","product":{"name":"HCL Notes \u003c14.0 Fix Pack 3","vendor":{"name":"HCL"}}},{"id":"4950d871-a6f6-3d79-b456-99a308c7f65d","product":{"name":"HCL Notes 14.0 Fix Pack 3","vendor":{"name":"HCL"}}},{"id":"a479b1c9-2d85-3512-97f7-ba049962727c","product":{"name":"domino","vendor":{"name":"HCL Software"}}},{"id":"c81d201f-a04c-3ecb-8155-ffa88f7f4837","product":{"name":"14.0 Fix Pack 3","vendor":{"name":"HCL"}}},{"id":"cd5d3074-c6c0-3b71-af3a-4732b490e5cd","product":{"name":"Notes","vendor":{"name":"HCL Software"}}}]}},{"id":"b72fe44f-3680-38d6-aa07-1d8d0591155e","advisory":{"id":"WID-SEC-W-2024-3309","description":"IBM Tivoli Netcool/OMNIbus: Schwachstelle ermöglicht Codeausführung","summary":"Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM Tivoli Netcool/OMNIbus ausnutzen, um beliebigen Programmcode auszuführen.","datePublished":"Mar 14, 2022, 11:00:00 PM","dateUpdated":"Oct 29, 2024, 11:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2024-3309.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2024-3309\n","aliases":"CVE-2021-23450\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"42c39c38-5746-3626-a719-82613fbc9446","product":{"name":"WebGui","vendor":{"name":"IBM"}}},{"id":"574de2e8-48be-3a6f-8622-09727d2623d1","product":{"name":"IBM Business Automation Workflow","vendor":{"name":"IBM"}}},{"id":"895523aa-82db-3640-aa22-486dab53298f","product":{"name":"IBM Tivoli Netcool/OMNIbus WebGui","vendor":{"name":"IBM"}}},{"id":"d381c50d-e532-3329-ac32-a786c3b832c2","product":{"name":"Tivoli Netcool/OMNIbus","vendor":{"name":"IBM"}}}]}}]}