CWE-917 · Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection) (page 3)
Page 3 of 3 — CVEs classified under CWE-917, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-11943 | High | 8.8 | 2019-06-05 | A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. |
CVE-2019-11942 | High | 8.8 | 2019-06-05 | A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. |
CVE-2019-11628 | High | 8.2 | 2019-05-01 | An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterpr… |
CVE-2019-9041 | High | 7.2 | 2019-02-23 | An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzz_template.php file, the parserIfLabel() function's filtering is not strict, resulting in PHP cod… |
CVE-2019-5916 | Critical | 9.8 | 2019-02-13 | Input validation issue in POWER EGG(Ver 2.0.1, Ver 2.02 Patch 3 and earlier, Ver 2.1 Patch 4 and earlier, Ver 2.2 Patch 7 and earlier, Ver 2.3 Patch 9 and earl… |
CVE-2019-7743 | Critical | 9.8 | 2019-02-12 | An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objection injection attacks because there is no protection mechanis… |
CVE-2018-16621 | High | 7.2 | 2018-11-15 | Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection. |
CVE-2018-12533 | Critical | 9.8 | 2018-06-18 | JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via… |
CVE-2018-12532 | Critical | 9.8 | 2018-06-18 | JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapper and execute arbitr… |
CVE-2010-1871 | High | 8.8 | 2010-08-05 | JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression La… |