CWE-470 · Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection) (page 2)
Page 2 of 2 — CVEs classified under CWE-470, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-1574 | Medium | 6.7 | 2024-07-04 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in the licensing feature of Mitsubishi Electric GENESIS64 vers… |
CVE-2024-22258 | Medium | 6.1 | 2024-03-20 | Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for… |
CVE-2024-28121 | High | 8.8 | 2024-03-12 | stimulus_reflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time we… |
CVE-2023-6943 | Critical | 9.8 | 2024-01-30 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5… |
CVE-2024-0200 | High | 7.2 | 2024-01-16 | An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the exe… |
CVE-2023-35680 | Medium | 5.5 | 2023-09-11 | In multiple locations, there is a possible way to import contacts belonging to other users due to a confused deputy. This could lead to local information discl… |
CVE-2023-37207 | Medium | 6.5 | 2023-07-05 | A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have le… |
CVE-2023-33652 | High | 8.8 | 2023-06-06 | Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /sitecore/shell/I… |
CVE-2023-34102 | High | 8.3 | 2023-06-05 | Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updating a record with use… |
CVE-2023-32217 | Critical | 9.0 | 2023-06-05 | IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior t… |
CVE-2023-0460 | Medium | 5.1 | 2023-03-01 | The YouTube Embedded 1.2 SDK binds to a service within the YouTube Main App. After binding, a remote context is created with the flags Context.CONTEXT_INCLUDE_… |
CVE-2022-41853 | High | 8.0 | 2022-10-06 | Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execut… |
CVE-2022-26469 | High | 7.8 | 2022-09-06 | In MtkEmail, there is a possible escalation of privilege due to fragment injection. This could lead to local escalation of privilege with no additional executi… |
CVE-2022-30287 | High | 8.0 | 2022-07-28 | Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads t… |
CVE-2022-23744 | Low | 2.3 | 2022-07-07 | Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable endpoint protection by a local administr… |
CVE-2021-31522 | Critical | 9.8 | 2022-01-06 | Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3… |
CVE-2021-32647 | High | 8.0 | 2021-06-01 | Emissary is a P2P based data-driven workflow engine. Affected versions of Emissary are vulnerable to post-authentication Remote Code Execution (RCE). The [`Cre… |
CVE-2021-21985 | Critical | 9.8 | 2021-05-26 | The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enab… |
CVE-2020-7857 | High | 7.5 | 2021-04-20 | A vulnerability of XPlatform could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient validation of… |
CVE-2021-21327 | Medium | 6.8 | 2021-03-08 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI befo… |
CVE-2019-20635 | Medium | 6.1 | 2020-04-02 | codeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code and access the Java class loader via computed fields. |
CVE-2019-10174 | High | 8.8 | 2019-11-25 | A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke priva… |
CVE-2019-3834 | High | 7.3 | 2019-10-03 | It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader propert… |
CVE-2019-1003041 | Critical | 9.8 | 2019-03-28 | A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts. |
CVE-2019-1003040 | Critical | 9.8 | 2019-03-28 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts. |
CVE-2018-1000613 | Critical | 9.8 | 2018-07-09 | Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controll… |
CVE-2018-5511 | High | 7.2 | 2018-04-13 | On F5 BIG-IP 13.1.0-13.1.0.3 or 13.0.0, when authenticated administrative users execute commands in the Traffic Management User Interface (TMUI), also referred… |
CVE-2017-7536 | High | 7.0 | 2018-01-10 | In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to acc… |
CVE-2004-2331 | Medium | 5.5 | 2004-12-31 | ColdFusion MX 6.1 and 6.1 J2EE allows local users to bypass sandbox security restrictions and obtain sensitive information by using Java reflection methods to… |