CWE-829 · Inclusion of Functionality from Untrusted Control Sphere (page 4)
Page 4 of 4 — CVEs classified under CWE-829, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-25788 | High | 8.1 | 2020-09-19 | An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. imgproxy in plugins/af_proxy_http/init.php mishandles $_REQUEST["url"] in an error mes… |
CVE-2020-13175 | High | 7.5 | 2020-08-11 | The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 20, 2020 (v15 and earlier for Clo… |
CVE-2020-13651 | High | 7.8 | 2020-06-15 | An issue was discovered in DigDash 2018R2 before p20200528, 2019R1 before p20200421, and 2019R2 before p20200430. It allows a user to provide data that will be… |
CVE-2020-13977 | Medium | 4.9 | 2020-06-09 | Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram a… |
CVE-2020-5295 | Medium | 4.8 | 2020-06-03 | In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to read local files of an… |
CVE-2020-10865 | High | 7.5 | 2020-04-01 | An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to m… |
CVE-2020-3794 | Critical | 9.8 | 2020-03-25 | ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a file inclusion vulnerability. Successful exploitation could lead to arbitrary code execution of… |
CVE-2020-8128 | Critical | 9.8 | 2020-02-14 | An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code. |
CVE-2013-3321 | High | 7.5 | 2020-01-29 | NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to include arbitrary files through specially crafted requests to the "diagnostic" page… |
CVE-2013-4582 | Medium | 6.5 | 2020-01-28 | The (1) create_branch, (2) create_tag, (3) import_project, and (4) fork_project functions in lib/gitlab_projects.rb in GitLab 5.0 before 5.4.2, Community Editi… |
CVE-2012-4919 | Critical | 9.8 | 2020-01-22 | Gallery Plugin1.4 for WordPress has a Remote File Include Vulnerability |
CVE-2019-16951 | Medium | 5.3 | 2019-11-13 | A remote file include (RFI) issue was discovered in Enghouse Web Chat 6.2.284.34. One can replace the localhost attribute with one's own domain name. When the… |
CVE-2019-8154 | High | 8.8 | 2019-11-06 | A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to m… |
CVE-2013-1945 | Low | 3.3 | 2019-10-31 | ruby193 uses an insecure LD_LIBRARY_PATH setting. |
CVE-2019-11742 | Medium | 6.5 | 2019-09-27 | A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a <canvas> element due to an err… |
CVE-2019-10666 | High | 8.1 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. Several of the scripts perform dynamic script inclusion via the include() function on user supplied input wit… |
CVE-2019-5479 | High | 7.5 | 2019-09-03 | An unintended require vulnerability in <v0.5.5 larvitbase-api may allow an attacker to load arbitrary non-production code (JavaScript file). |
CVE-2019-15839 | High | 7.5 | 2019-08-30 | The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion. |
CVE-2019-13589 | Critical | 9.8 | 2019-07-14 | The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without th… |
CVE-2019-4263 | Medium | 4.3 | 2019-07-11 | IBM Content Navigator 3.0CD is vulnerable to local file inclusion, allowing an attacker to access a configuration file in the ICN server. IBM X-Force ID: 16001… |
CVE-2019-11770 | High | 8.1 | 2019-06-14 | In Eclipse Buildship versions prior to 3.1.1, the build files indicate that this project is resolving dependencies over HTTP instead of HTTPS. Any of these art… |
CVE-2019-10249 | High | 8.1 | 2019-05-06 | All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been compromised. |
CVE-2019-11591 | High | 8.8 | 2019-04-29 | The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion… |
CVE-2019-11590 | High | 8.8 | 2019-04-29 | The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via d… |
CVE-2019-10248 | High | 8.1 | 2019-04-22 | Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. Any of these dependent artifacts could ha… |
CVE-2019-10240 | High | 8.1 | 2019-04-03 | Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts c… |
CVE-2019-9829 | High | 8.8 | 2019-03-15 | Maccms 10 allows remote attackers to execute arbitrary PHP code by entering this code in a template/default_pc/html/art Edit action. This occurs because templa… |
CVE-2018-17246 | Critical | 9.8 | 2018-12-20 | Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could… |
CVE-2018-12120 | High | 8.1 | 2018-11-28 | Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or `nod… |
CVE-2018-18387 | High | 8.8 | 2018-10-29 | playSMS through 1.4.2 allows Privilege Escalation through Daemon abuse. |
CVE-2018-15486 | Critical | 9.1 | 2018-09-07 | An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Unauthenticated Local File Inclusion and File modification is possible through the… |
CVE-2018-8351 | Medium | 6.5 | 2018-08-15 | An information disclosure vulnerability exists when affected Microsoft browsers improperly allow cross-frame interaction, aka "Microsoft Browser Information Di… |
CVE-2018-1000502 | High | 7.2 | 2018-06-26 | MyBB Group MyBB contains a File Inclusion vulnerability in Admin panel (Tools and Maintenance -> Task Manager -> Add New Task) that can result in Allows Local… |
CVE-2018-11040 | High | 7.5 | 2018-06-25 | Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain reques… |
CVE-2017-5397 | Critical | 9.8 | 2018-06-11 | The cache directory on the local file system is set to be world writable. Firefox defaults to extracting libraries from this cache. This allows for the possibi… |
CVE-2018-1122 | High | 7.3 | 2018-05-23 | procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, t… |
CVE-2018-7422 | High | 7.5 | 2018-03-19 | A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_pat… |
CVE-2017-14095 | High | 8.1 | 2018-01-19 | A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution via a lo… |
CVE-2017-1376 | Critical | 9.8 | 2017-08-29 | A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873. |
CVE-2017-6381 | High | 8.1 | 2017-03-16 | A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htac… |
CVE-2010-2076 | Critical | 9.8 | 2010-08-19 | Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache… |
CVE-2004-0285 | Critical | 9.8 | 2004-11-23 | PHP remote file inclusion vulnerabilities in include/footer.inc.php in (1) AllMyVisitors, (2) AllMyLinks, and (3) AllMyGuests allow remote attackers to execute… |
CVE-2004-0030 | Critical | 9.8 | 2004-01-20 | PHP remote file inclusion vulnerability in (1) functions.php, (2) authentication_index.php, and (3) config_gedcom.php for PHPGEDVIEW 2.61 allows remote attacke… |