CWE-94: Improper Control of Generation of Code ('Code Injection')
Svakhetstype fra CWE-katalogen
Hva svakheten betyr
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Definisjonen gjengis slik MITRE har publisert den, på engelsk.
3 521 sårbarheter i tjenesten peker på denne svakheten
-
Craft CMS Code Injection Vulnerability
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to b…
-
CrushFTP VFS Sandbox Escape Vulnerability
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside …
-
OSGeo GeoServer JAI-EXT Code Injection Vulnerability
JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as t…
-
VMware Spring Cloud Gateway Code Injection Vulnerability
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote att…
-
GitLab Community and Enterprise Editions Remote Code Execution Vulnerability
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote com…
-
Kibana Arbitrary Code Execution
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt…
-
Microsoft HTTP.sys Remote Code Execution Vulnerability
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP request…
-
Microsoft Windows Buffer Overflow Vulnerability
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a craf…
-
MongoDB mongo-express Remote Code Execution Vulnerability
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.
-
Gitea Code Injection Vulnerability
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
-
IBM Langflow Code Injection Vulnerability
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via ex…
-
Langflow Code Injection Vulnerability
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows witho…
-
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
-
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
-
Cisco Unified Communications Products Code Injection Vulnerability
A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & P…
-
Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability
A remote code execution issue exists in HPE OneView.
-
Laravel Livewire Code Injection Vulnerability
Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. …
-
Langflow Missing Authentication Vulnerability
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary cod…
-
XWiki Platform Eval Injection Vulnerability
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This …
-
Craft CMS Code Injection Vulnerability
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has …
-
OSGeo GeoServer GeoTools Eval Injection Vulnerability
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Executi…
-
Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary comm…
-
Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
Unauthenticated remote code execution
-
Apache RocketMQ Command Execution Vulnerability
For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked …
-
Novi Survey Insecure Deserialization Vulnerability
Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.