CWE-917 · Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection) (page 3)
Page 3 of 3 — CVEs classified under CWE-917, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-5916 | Critical | 9.8 | 2019-02-13 | Input validation issue in POWER EGG(Ver 2.0.1, Ver 2.02 Patch 3 and earlier, Ver 2.1 Patch 4 and earlier, Ver 2.2 Patch 7 and earlier, Ver 2.3 Patch 9 and earl… |
CVE-2019-7743 | Critical | 9.8 | 2019-02-12 | An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objection injection attacks because there is no protection mechanis… |
CVE-2018-16621 | High | 7.2 | 2018-11-15 | Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection. |
CVE-2018-12533 | Critical | 9.8 | 2018-06-18 | JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via… |
CVE-2018-12532 | Critical | 9.8 | 2018-06-18 | JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapper and execute arbitr… |
CVE-2010-1871 | High | 8.8 | 2010-08-05 | JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression La… |