NVD disclosure day

Published threat advisories for December 17, 2021

CVE-2021-23450

Dojo Prototype Pollution Vulnerability

Halo Surface Signal: 3 out of 5 — possibly public-facing.

A Prototype Pollution vulnerability exists in the Dojo JavaScript toolkit's `setObject` function. If reachable, an attacker could exploit this to modify application objects, potentially leading to altered behavior or system changes. Confirm if affected products are in use and assess exposure.

NVD modified: NVD date unavailable

CVE advisoryKnown Exploit

CVE-2021-22054

VMware Workspace ONE UEM Server-Side Request Forgery Vulnerability

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A server-side request forgery vulnerability in VMware Workspace ONE UEM console allows unauthenticated actors with network access to expose sensitive information, impacting an organization's data confidentiality and presenting a business risk.

NVD modified: NVD date unavailable • CISA KEV