CWE-94 · Code Injection (page 42)
Page 42 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-23814 | Medium | 6.7 | 2021-12-17 | This affects versions of the package unisharp/laravel-filemanager before 2.6.2. The upload() function does not sufficiently validate the file type when uploadi… |
CVE-2021-43837 | High | 8.4 | 2021-12-16 | vault-cli is a configurable command-line interface tool (and python library) to interact with Hashicorp Vault. In versions before 3.0.0 vault-cli features the… |
CVE-2021-42309 | High | 8.8 | 2021-12-15 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2021-44231 | Critical | 9.8 | 2021-12-14 | Internally used text extraction reports allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavio… |
CVE-2021-43811 | High | 7.8 | 2021-12-08 | Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurati… |
CVE-2021-44529 | Critical | 9.8 | 2021-12-08 | A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissio… |
CVE-2021-37097 | High | 7.5 | 2021-12-08 | There is a Code Injection vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to system restart. |
CVE-2021-37079 | Critical | 9.1 | 2021-12-07 | There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to delete arbitrary file by syst… |
CVE-2021-38967 | Medium | 6.7 | 2021-11-30 | IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local privileged user to inject and execute malicious code. IBM X-Force ID: 212441. |
CVE-2021-3725 | High | 7.5 | 2021-11-30 | Vulnerability in dirhistory plugin Description: the widgets that go back and forward in the directory history, triggered by pressing Alt-Left and Alt-Right, us… |
CVE-2021-43221 | Medium | 4.2 | 2021-11-24 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2021-38448 | High | 7.5 | 2021-11-22 | The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller… |
CVE-2021-33493 | Medium | 6.0 | 2021-11-22 | The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format. |
CVE-2021-22053 | High | 8.8 | 2021-11-19 | Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request… |
CVE-2021-41269 | Critical | 10.0 | 2021-11-15 | cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In affected versions A template Inj… |
CVE-2021-41653 | Critical | 9.8 | 2021-11-13 | The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payl… |
CVE-2021-33816 | Critical | 9.8 | 2021-11-10 | The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_e… |
CVE-2021-43208 | High | 7.8 | 2021-11-10 | 3D Viewer Remote Code Execution Vulnerability |
CVE-2021-42298 | High | 7.8 | 2021-11-10 | Microsoft Defender Remote Code Execution Vulnerability |
CVE-2021-42296 | High | 7.8 | 2021-11-10 | Microsoft Word Remote Code Execution Vulnerability |
CVE-2021-43466 | Critical | 9.8 | 2021-11-09 | In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution. |
CVE-2021-24721 | Medium | 6.5 | 2021-11-08 | The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulti… |
CVE-2021-24537 | High | 7.2 | 2021-11-08 | The Similar Posts WordPress plugin through 3.1.5 allow high privilege users to execute arbitrary PHP code in an hardened environment (ie with DISALLOW_FILE_EDI… |
CVE-2021-41228 | High | 7.5 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's `saved_model_cli` tool is vulnerable to a code injection as it ca… |
CVE-2021-42057 | High | 7.8 | 2021-11-04 | Obsidian Dataview through 0.4.12-hotfix1 allows eval injection. The evalInContext function in executes user input, which allows an attacker to craft malicious… |
CVE-2021-43281 | High | 7.2 | 2021-11-04 | MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not vali… |
CVE-2021-42754 | Low | 3.2 | 2021-11-02 | An improper control of generation of code vulnerability [CWE-94] in FortiClientMacOS versions 7.0.0 and below and 6.4.5 and below may allow an authenticated at… |
CVE-2021-25877 | High | 7.2 | 2021-11-01 | AVideo/YouPHPTube 10.0 and prior is affected by Insecure file write. An administrator privileged user is able to write files on filesystem using flag and code… |
CVE-2021-40348 | High | 8.8 | 2021-11-01 | Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to appen… |
CVE-2021-42694 | High | 8.3 | 2021-11-01 | An issue was discovered in the character definitions of the Unicode Specification through 14.0. The specification allows an adversary to produce source code id… |
CVE-2021-42574 | High | 8.3 | 2021-11-01 | An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control se… |
CVE-2021-36985 | High | 7.5 | 2021-10-28 | There is a Code injection vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may exhaust system resources and cause the system to… |
CVE-2021-41619 | High | 7.2 | 2021-10-27 | An issue was discovered in Gradle Enterprise before 2021.1.2. There is potential remote code execution via the application startup configuration. The installat… |
CVE-2021-38450 | Critical | 9.9 | 2021-10-27 | The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller… |
CVE-2020-23037 | Critical | 9.8 | 2021-10-22 | Portable Ltd Playable v9.18 contains a code injection vulnerability in the filename parameter, which allows attackers to execute arbitrary web scripts or HTML… |
CVE-2021-22961 | Critical | 9.8 | 2021-10-18 | A code injection vulnerability exists within the firewall software of GlassWire v2.1.167 that could lead to arbitrary code execution from a file in the user pa… |
CVE-2021-29679 | High | 8.8 | 2021-10-15 | IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated user to execute code remotely due to incorrectly neutralizaing user-contrlled input that co… |
CVE-2021-40487 | High | 8.1 | 2021-10-13 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2021-40485 | High | 7.8 | 2021-10-13 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2021-40499 | Critical | 9.8 | 2021-10-12 | Client-side printing services SAP Cloud Print Manager and SAPSprint for SAP NetWeaver Application Server for ABAP - versions 7.70, 7.70 PI, 7.70 BYD, allow an… |
CVE-2021-24546 | High | 8.8 | 2021-10-11 | The Gutenberg Block Editor Toolkit – EditorsKit WordPress plugin before 1.31.6 does not sanitise and validate the Conditional Logic of the Custom Visibility se… |
CVE-2021-40889 | Critical | 9.8 | 2021-10-11 | CMSUno version 1.7.2 is affected by a PHP code execution vulnerability. sauvePass action in {webroot}/uno/central.php file calls to file_put_contents() functio… |
CVE-2021-42139 | Critical | 9.8 | 2021-10-11 | Deno Standard Modules before 0.107.0 allows Code Injection via an untrusted YAML file in certain configurations. |
CVE-2020-21652 | Critical | 9.8 | 2021-10-06 | Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \controller\Config.php, which can be exploited via the addqq() method. |
CVE-2020-21651 | Critical | 9.8 | 2021-10-06 | Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \controller\point.php, which can be exploited via the add() method. |
CVE-2020-21650 | High | 8.8 | 2021-10-06 | Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \controller\Config.php, which can be exploited via the add() method. |
CVE-2021-25470 | High | 7.9 | 2021-10-06 | An improper caller check logic of SMC call in TEEGRIS secure OS prior to SMR Oct-2021 Release 1 can be used to compromise TEE. |
CVE-2021-22557 | Medium | 5.3 | 2021-10-04 | SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We re… |
CVE-2021-40323 | Critical | 9.8 | 2021-10-04 | Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection. |
CVE-2020-20124 | High | 8.8 | 2021-09-28 | Wuzhi CMS v4.1.0 contains a remote code execution (RCE) vulnerability in \attachment\admin\index.php. |
CVE-2021-22952 | High | 8.8 | 2021-09-23 | A vulnerability found in UniFi Talk application V1.12.3 and earlier permits a malicious actor who has already gained access to a network to subsequently contro… |
CVE-2021-3583 | High | 7.1 | 2021-09-22 | A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user… |
CVE-2021-39402 | High | 7.2 | 2021-09-20 | MaianAffiliate v.1.0 is suffers from code injection by adding a new product via the admin panel. The injected payload is reflected on the affiliate main page f… |
CVE-2021-39128 | High | 7.2 | 2021-09-16 | Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administrators access to exe… |
CVE-2021-33693 | Medium | 6.8 | 2021-09-15 | SAP Cloud Connector, version - 2.0, allows an authenticated administrator to modify a configuration file to inject malicious codes that could potentially lead… |
CVE-2021-40373 | Critical | 9.8 | 2021-09-10 | playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the #tabs-information-page of core_main_config, and then executing that code via t… |
CVE-2021-32836 | High | 7.5 | 2021-09-09 | ZStack is open source IaaS(infrastructure as a service) software. In ZStack before versions 3.10.12 and 4.1.6 there is a pre-auth unsafe deserialization vulner… |
CVE-2021-32834 | High | 8.2 | 2021-09-09 | Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a user able to create Policy Sets can… |
CVE-2021-39503 | High | 7.2 | 2021-09-07 | PHPMyWind 5.6 is vulnerable to Remote Code Execution. Becase input is filtered without "<, >, ?, =, `,...." In WriteConfig() function, an attacker can inject p… |
CVE-2021-39115 | High | 7.2 | 2021-09-01 | Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Jav… |
CVE-2021-32831 | High | 7.5 | 2021-08-30 | Total.js framework (npm package total.js) is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET… |
CVE-2021-29772 | Critical | 9.8 | 2021-08-26 | IBM API Connect 5.0.0.0 through 5.0.8.11 could allow a user to potentially inject code due to unsanitized user input. IBM X-Force ID: 202774. |
CVE-2020-19822 | High | 7.2 | 2021-08-26 | A remote code execution (RCE) vulnerability in template_user.php of ZZCMS version 2018 allows attackers to execute arbitrary PHP code via the "ml" and "title"… |
CVE-2021-39159 | Critical | 9.6 | 2021-08-25 | BinderHub is a kubernetes-based cloud service that allows users to share reproducible interactive computing environments from code repositories. In affected ve… |
CVE-2021-39160 | Critical | 9.6 | 2021-08-25 | nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could… |
CVE-2021-40084 | Critical | 9.8 | 2021-08-25 | opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell metacharacters. For example, it allows command execution via a… |
CVE-2021-39144 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient righ… |
CVE-2020-22120 | High | 8.8 | 2021-08-18 | A remote code execution (RCE) vulnerability in /root/run/adm.php?admin-ediy&part=exdiy of imcat v5.1 allows authenticated attackers to execute arbitrary code. |
CVE-2020-22937 | Critical | 9.8 | 2021-08-17 | A remote code execution (RCE) in e/install/index.php of EmpireCMS 7.5 allows attackers to execute arbitrary PHP code via writing malicious code to the install… |
CVE-2021-3615 | Medium | 6.6 | 2021-08-17 | A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow code execution if a specific file exists on the attached SD card. This vul… |
CVE-2021-32829 | Critical | 9.6 | 2021-08-17 | ZStack is open source IaaS(infrastructure as a service) software aiming to automate datacenters, managing resources of compute, storage, and networking all by… |
CVE-2021-32822 | Medium | 4.0 | 2021-08-16 | The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. Th… |
CVE-2021-32809 | Medium | 4.6 | 2021-08-12 | ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckedi… |
CVE-2021-37626 | High | 7.2 | 2021-08-11 | Contao is an open source CMS that allows you to create websites and scalable web applications. In affected versions it is possible to load PHP files by enterin… |
CVE-2021-37694 | High | 8.7 | 2021-08-11 | @asyncapi/java-spring-cloud-stream-template generates a Spring Cloud Stream (SCSt) microservice. In versions prior to 0.7.0 arbitrary code injection was possib… |
CVE-2021-38196 | Critical | 9.8 | 2021-08-08 | An issue was discovered in the better-macro crate through 2021-07-22 for Rust. It intentionally demonstrates that remote attackers can execute arbitrary code v… |
CVE-2021-36800 | High | 8.7 | 2021-08-04 | Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application. A POST sent to /{company_id}/sales/invo… |
CVE-2021-32706 | High | 7.6 | 2021-08-04 | Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5… |
CVE-2021-31630 | High | 8.8 | 2021-08-03 | Command Injection in Open PLC Webserver v3 allows remote attackers to execute arbitrary code via the "Hardware Layer Code Box" component on the "/hardware" pag… |
CVE-2021-24430 | High | 7.2 | 2021-08-02 | The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.2.0 did not validate its caching_exclude_urls and caching_include_query_strings… |
CVE-2017-18113 | High | 8.8 | 2021-08-02 | The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a system administrator… |
CVE-2020-18172 | Critical | 9.8 | 2021-07-26 | A code injection vulnerability in the SeDebugPrivilege component of Trezor Bridge 2.0.27 allows attackers to escalate privileges. |
CVE-2021-25808 | High | 7.8 | 2021-07-23 | A code injection vulnerability in backup/plugin.php of Bludit 3.13.1 allows attackers to execute arbitrary code via a crafted ZIP file. |
CVE-2021-1518 | Medium | 6.3 | 2021-07-22 | A vulnerability in the REST API of Cisco Firepower Device Manager (FDM) On-Box Software could allow an authenticated, remote attacker to execute arbitrary code… |
CVE-2021-32756 | High | 8.8 | 2021-07-21 | ManageIQ is an open-source management platform. In versions prior to jansa-4, kasparov-2, and lasker-1, there is a flaw in the MiqExpression module of ManageIQ… |
CVE-2021-32749 | Medium | 6.1 | 2021-07-16 | fail2ban is a daemon to ban hosts that cause multiple authentication errors. In versions 0.9.7 and prior, 0.10.0 through 0.10.6, and 0.11.0 through 0.11.2, the… |
CVE-2021-33678 | Medium | 6.5 | 2021-07-14 | A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75… |
CVE-2021-23390 | Critical | 9.8 | 2021-07-12 | The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions. |
CVE-2021-23389 | Critical | 9.8 | 2021-07-12 | The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions. |
CVE-2021-1585 | High | 7.5 | 2021-07-08 | A vulnerability in the Cisco Adaptive Security Device Manager (ASDM) Launcher could allow an unauthenticated, remote attacker to execute arbitrary code on a us… |
CVE-2020-23219 | High | 8.8 | 2021-07-01 | Monstra CMS 3.0.4 allows attackers to execute arbitrary code via a crafted payload entered into the "Snippet content" field under the "Edit Snippet" module. |
CVE-2021-35514 | Critical | 9.8 | 2021-06-28 | Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel. |
CVE-2020-21784 | Critical | 9.8 | 2021-06-24 | phpwcms 1.9.13 is vulnerable to Code Injection via /phpwcms/setup/setup.php. |
CVE-2020-22201 | High | 8.8 | 2021-06-16 | phpCMS 2008 sp4 allowas remote malicious users to execute arbitrary php commands via the pagesize parameter to yp/product.php. |
CVE-2021-25416 | Medium | 6.5 | 2021-06-11 | Assuming EL1 is compromised, an improper address validation in RKP prior to SMR JUN-2021 Release 1 allows local attackers to create executable kernel page outs… |
CVE-2021-25415 | Medium | 5.5 | 2021-06-11 | Assuming EL1 is compromised, an improper address validation in RKP prior to SMR JUN-2021 Release 1 allows local attackers to remap EL2 memory as writable. |
CVE-2021-25411 | Medium | 4.4 | 2021-06-11 | Improper address validation vulnerability in RKP api prior to SMR JUN-2021 Release 1 allows root privileged local attackers to write read-only kernel memory. |
CVE-2021-25393 | Medium | 6.6 | 2021-06-11 | Improper sanitization of incoming intent in SecSettings prior to SMR MAY-2021 Release 1 allows local attackers to get permissions to access system uid data. |
CVE-2021-31949 | High | 7.3 | 2021-06-08 | Microsoft Outlook Remote Code Execution Vulnerability |
CVE-2021-32673 | High | 8.8 | 2021-06-08 | reg-keygen-git-hash-plugin is a reg-suit plugin to detect the snapshot key to be compare with using Git commit hash. reg-keygen-git-hash-plugin through and inc… |