CWE-94 · Code Injection (page 40)
Page 40 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-39833 | High | 7.2 | 2022-11-23 | FileCloud Versions 20.2 and later allows remote attackers to potentially cause unauthorized remote code execution and access to reported API endpoints via a cr… |
CVE-2022-41223 | Medium | 6.8 | 2022-11-22 | The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via cra… |
CVE-2022-41945 | Medium | 6.5 | 2022-11-21 | super-xray is a vulnerability scanner (xray) GUI launcher. In version 0.1-beta, the URL is not filtered and directly spliced into the command, resulting in a… |
CVE-2022-45132 | Critical | 9.8 | 2022-11-18 | In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API… |
CVE-2022-28766 | Low | 3.3 | 2022-11-17 | Windows 32-bit versions of the Zoom Client for Meetings before 5.12.6 and Zoom Rooms for Conference Room before version 5.12.6 are susceptible to a DLL injecti… |
CVE-2022-43279 | High | 7.2 | 2022-11-15 | LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/themeOptions/update.php. |
CVE-2022-40127 | High | 8.8 | 2022-11-14 | A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided r… |
CVE-2022-41882 | Medium | 6.6 | 2022-11-11 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. In version 3.6.0, if a user received a malicious file sha… |
CVE-2022-44089 | Critical | 9.8 | 2022-11-10 | ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component IS_GETCACHE. |
CVE-2022-44088 | Critical | 9.8 | 2022-11-10 | ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component INPUT_ISDESCRIPTION. |
CVE-2022-44087 | Critical | 9.8 | 2022-11-10 | ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component UPFILE_PIC_ZOOM_HIGHT. |
CVE-2022-41061 | High | 7.8 | 2022-11-09 | Microsoft Word Remote Code Execution Vulnerability |
CVE-2022-41205 | Medium | 5.5 | 2022-11-08 | SAP GUI allows an authenticated attacker to execute scripts in the local network. On successful exploitation, the attacker can gain access to registries which… |
CVE-2022-3418 | High | 7.2 | 2022-11-07 | The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported on the server, which… |
CVE-2022-44794 | High | 8.8 | 2022-11-07 | An issue was discovered in Object First Ootbi BETA build 1.0.7.712. Management protocol has a flow which allows a remote attacker to execute arbitrary Bash cod… |
CVE-2022-3869 | Medium | 6.1 | 2022-11-05 | Code Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2. |
CVE-2022-43572 | High | 7.5 | 2022-11-04 | In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, sending a malformed file through the Splunk-to-Splunk (S2S) or HTTP Event Collector (HEC) protoco… |
CVE-2022-31691 | Critical | 9.8 | 2022-11-04 | Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloud… |
CVE-2022-3721 | Medium | 4.6 | 2022-11-04 | Code Injection in GitHub repository froxlor/froxlor prior to 0.10.39. |
CVE-2022-43571 | High | 8.8 | 2022-11-03 | In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component. |
CVE-2022-32924 | High | 7.8 | 2022-11-01 | The issue was addressed with improved memory handling. This issue is fixed in tvOS 16.1, macOS Big Sur 11.7, macOS Ventura 13, watchOS 9.1, iOS 16.1 and iPadOS… |
CVE-2020-21016 | Critical | 9.8 | 2022-10-31 | D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary code as root via HNAP1/control/SetGuestWLanSettings.php. |
CVE-2022-39365 | Critical | 9.8 | 2022-10-27 | Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig templates rendering in `Pimcore/Mail` & `C… |
CVE-2022-3394 | High | 7.2 | 2022-10-25 | The WP All Export Pro WordPress plugin before 1.7.9 does not limit some functionality during exports only to users with the Administrator role, allowing any lo… |
CVE-2022-39327 | High | 8.1 | 2022-10-25 | Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. C… |
CVE-2022-39326 | High | 8.8 | 2022-10-25 | kartverket/github-workflows are shared reusable workflows for GitHub Actions. Prior to version 2.7.5, all users of the `run-terraform` reusable workflow from t… |
CVE-2021-26731 | Critical | 9.1 | 2022-10-24 | Command injection and multiple stack-based buffer overflows vulnerabilities in the modifyUserb_func function of spx_restservice allow an authenticated attacker… |
CVE-2021-26729 | Critical | 10.0 | 2022-10-24 | Command injection and multiple stack-based buffer overflows vulnerabilities in the Login_handler_func function of spx_restservice allow an attacker to execute… |
CVE-2021-26728 | Critical | 10.0 | 2022-10-24 | Command injection and stack-based buffer overflow vulnerabilities in the KillDupUsr_func function of spx_restservice allow an attacker to execute arbitrary cod… |
CVE-2021-26727 | Critical | 10.0 | 2022-10-24 | Multiple command injections and stack-based buffer overflows vulnerabilities in the SubNet_handler_func function of spx_restservice allow an attacker to execut… |
CVE-2022-43416 | High | 8.8 | 2022-10-19 | Jenkins Katalon Plugin 1.0.32 and earlier implements an agent/controller message that does not limit where it can be executed and allows invoking Katalon with… |
CVE-2022-39424 | High | 8.1 | 2022-10-18 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.40. Difficu… |
CVE-2022-41544 | Critical | 9.8 | 2022-10-18 | GetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE) vulnerability via the edited_file parameter in admin/theme-edit.php. |
CVE-2022-41576 | High | 7.8 | 2022-10-14 | The rphone module has a script that can be maliciously modified.Successful exploitation of this vulnerability may cause irreversible programs to be implanted o… |
CVE-2022-35944 | Medium | 6.2 | 2022-10-13 | October is a self-hosted Content Management System (CMS) platform based on the Laravel PHP Framework. This vulnerability only affects installations that rely o… |
CVE-2022-41534 | High | 7.2 | 2022-10-13 | Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /php_action/createOrder.php. Th… |
CVE-2022-42889 | Critical | 9.8 | 2022-10-13 | Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${… |
CVE-2022-42902 | High | 8.8 | 2022-10-13 | In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dynamic code execution in lava_server/lavatable.py. Due to improper input sanitizat… |
CVE-2022-40871 | Critical | 9.8 | 2022-10-12 | Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successful… |
CVE-2022-40469 | High | 8.8 | 2022-10-12 | iKuai OS v3.6.7 was discovered to contain an authenticated remote code execution (RCE) vulnerability. |
CVE-2022-40274 | High | 7.8 | 2022-09-30 | Gridea version 0.9.3 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Gridea… |
CVE-2022-40486 | High | 8.8 | 2022-09-28 | TP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel. 57450(5553) was discovered to allow authenticated attackers to execute arbitrary code via a c… |
CVE-2022-40497 | High | 8.8 | 2022-09-28 | Wazuh v3.6.1 - v3.13.5, v4.0.0 - v4.2.7, and v4.3.0 - v4.3.7 were discovered to contain an authenticated remote code execution (RCE) vulnerability via the Acti… |
CVE-2022-21797 | High | 7.3 | 2022-09-26 | The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement. |
CVE-2022-40628 | Critical | 9.8 | 2022-09-23 | This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to im… |
CVE-2022-3236 | Critical | 9.8 | 2022-09-23 | A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older. |
CVE-2022-26112 | Critical | 9.8 | 2022-09-23 | In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy… |
CVE-2022-36386 | Critical | 9.1 | 2022-09-21 | Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin <= 3.6.7 at WordPress. |
CVE-2022-28640 | High | 8.8 | 2022-09-20 | A potential local adjacent arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability was dis… |
CVE-2022-41138 | Critical | 9.8 | 2022-09-20 | In Zutty before 0.13, DECRQSS in text written to the terminal can achieve arbitrary code execution. |
CVE-2022-3245 | Medium | 6.1 | 2022-09-20 | HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScri… |
CVE-2022-3242 | Medium | 6.1 | 2022-09-20 | Code Injection in GitHub repository microweber/microweber prior to 1.3.2. |
CVE-2022-36100 | Critical | 9.9 | 2022-09-08 | XWiki Platform Applications Tag and XWiki Platform Tag UI are tag applications for XWiki, a generic wiki platform. Starting with version 1.7 in XWiki Platform… |
CVE-2022-36099 | Critical | 9.9 | 2022-09-08 | XWiki Platform Wiki UI Main Wiki is software for managing subwikis on XWiki Platform, a generic wiki platform. Starting with version 5.3-milestone-2 and prior… |
CVE-2022-36069 | High | 7.3 | 2022-09-07 | Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such… |
CVE-2022-35847 | Medium | 6.3 | 2022-09-06 | An improper neutralization of special elements used in a template engine vulnerability [CWE-1336] in FortiSOAR management interface 7.2.0, 7.0.0 through 7.0.3… |
CVE-2022-31860 | Critical | 9.8 | 2022-09-06 | An issue was discovered in OpenRemote through 1.0.4 allows attackers to execute arbitrary code via a crafted Groovy rule. |
CVE-2022-25813 | High | 7.5 | 2022-09-02 | In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “S… |
CVE-2022-36036 | Low | 3.6 | 2022-08-29 | mdx-mermaid provides plug and play access to Mermaid in MDX. There is a potential for an arbitrary javascript injection in versions less than 1.3.0 and 2.0.0-r… |
CVE-2022-37053 | Critical | 9.8 | 2022-08-28 | TRENDnet TEW733GR v1.03B01 is vulnerable to Command injection via /htdocs/upnpinc/gena.php. |
CVE-2022-36756 | Critical | 9.8 | 2022-08-28 | DIR845L A1 v1.00-v1.03 is vulnerable to command injection via /htdocs/upnpinc/gena.php. |
CVE-2022-38078 | Critical | 9.8 | 2022-08-24 | Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially crafted message by POST method to Movable Ty… |
CVE-2022-25812 | High | 7.2 | 2022-08-22 | The Transposh WordPress Translation WordPress plugin before 1.0.8 does not validate its debug settings, which could allow allowing high privilege users such as… |
CVE-2022-36216 | High | 7.2 | 2022-08-17 | DedeCMS v5.7.94 - v5.7.97 was discovered to contain a remote code execution vulnerability in member_toadmin.php. |
CVE-2022-35516 | Critical | 9.8 | 2022-08-17 | DedeCMS v5.7.93 - v5.7.96 was discovered to contain a remote code execution vulnerability in login.php. |
CVE-2022-38193 | Medium | 6.1 | 2022-08-16 | There is a code injection vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below that may allow a remote, unauthenticated attacker to pass strings w… |
CVE-2022-36262 | Critical | 9.8 | 2022-08-15 | An issue was discovered in taocms 3.0.2. in the website settings that allows arbitrary php code to be injected by modifying config.php. |
CVE-2022-36006 | High | 7.9 | 2022-08-15 | Arvados is an open source platform for managing, processing, and sharing genomic and other large scientific and biomedical data. A remote code execution (RCE)… |
CVE-2022-30580 | High | 7.8 | 2022-08-10 | Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe… |
CVE-2022-35779 | High | 7.8 | 2022-08-09 | Azure RTOS GUIX Studio Remote Code Execution Vulnerability |
CVE-2022-35777 | High | 8.8 | 2022-08-09 | Visual Studio Remote Code Execution Vulnerability |
CVE-2022-35772 | High | 7.2 | 2022-08-09 | Azure Site Recovery Remote Code Execution Vulnerability |
CVE-2022-35767 | High | 8.1 | 2022-08-09 | Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
CVE-2022-35766 | High | 8.1 | 2022-08-09 | Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
CVE-2022-34715 | Critical | 9.8 | 2022-08-09 | Windows Network File System Remote Code Execution Vulnerability |
CVE-2022-34714 | High | 8.1 | 2022-08-09 | Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
CVE-2022-30194 | High | 7.5 | 2022-08-09 | Windows WebBrowser Control Remote Code Execution Vulnerability |
CVE-2022-30175 | High | 7.8 | 2022-08-09 | Azure RTOS GUIX Studio Remote Code Execution Vulnerability |
CVE-2022-33725 | Medium | 4.0 | 2022-08-05 | A vulnerability using PendingIntent in Knox VPN prior to SMR Aug-2022 Release 1 allows attackers to access content providers with system privilege. |
CVE-2022-33721 | Medium | 4.4 | 2022-08-05 | A vulnerability using PendingIntent in DeX for PC prior to SMR Aug-2022 Release 1 allows attackers to access files with system privilege. |
CVE-2022-2636 | High | 8.5 | 2022-08-05 | Improper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6. |
CVE-2022-37396 | Medium | 4.1 | 2022-08-03 | In JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code execution |
CVE-2022-34625 | High | 7.2 | 2022-08-02 | Mealie1.0.0beta3 was discovered to contain a Server-Side Template Injection vulnerability, which allows attackers to execute arbitrary code via a crafted Jinja… |
CVE-2022-36799 | High | 7.2 | 2022-08-01 | This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of… |
CVE-2022-30083 | Critical | 9.8 | 2022-07-30 | EllieGrid Android Application version 3.4.1 is vulnerable to Code Injection. The application appears to evaluate user input as code (remote). |
CVE-2021-22646 | High | 8.8 | 2022-07-28 | The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution. |
CVE-2022-37009 | Low | 3.9 | 2022-07-28 | In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible |
CVE-2022-35649 | Critical | 9.8 | 2022-07-25 | The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote… |
CVE-2022-25759 | Critical | 9.9 | 2022-07-22 | The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload. |
CVE-2022-31161 | Critical | 10.0 | 2022-07-15 | Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subproc… |
CVE-2022-32417 | Critical | 9.8 | 2022-07-14 | PbootCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the function parserIfLabel at function.php. |
CVE-2022-34821 | High | 7.6 | 2022-07-12 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2), SCALANCE M804PB (6G… |
CVE-2022-34663 | High | 8.0 | 2022-07-12 | A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RU… |
CVE-2015-3173 | High | 7.2 | 2022-07-06 | custom-content-type-manager Wordpress plugin can be used by an administrator to achieve arbitrary PHP remote code execution. |
CVE-2022-2073 | High | 7.2 | 2022-06-29 | Code Injection in GitHub repository getgrav/grav prior to 1.7.34. |
CVE-2021-40553 | High | 8.8 | 2022-06-28 | piwigo 11.5.0 is affected by a remote code execution (RCE) vulnerability in the LocalFiles Editor. |
CVE-2017-20099 | High | 7.3 | 2022-06-27 | A vulnerability was found in Analytics Stats Counter Statistics Plugin 1.2.2.5 and classified as critical. This issue affects some unknown processing. The mani… |
CVE-2017-20095 | Medium | 6.3 | 2022-06-24 | A vulnerability classified as critical was found in Simple Ads Manager Plugin. This vulnerability affects unknown code. The manipulation leads to code injectio… |
CVE-2017-20086 | Medium | 6.3 | 2022-06-23 | A vulnerability, which was classified as critical, was found in VaultPress Plugin 1.8.4. This affects an unknown part. The manipulation leads to code injection… |
CVE-2017-20064 | Medium | 6.3 | 2022-06-20 | A vulnerability was found in Elefant CMS 1.3.12-RC. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /d… |