CWE-94 · Code Injection (page 44)
Page 44 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-15142 | High | 8.0 | 2020-08-14 | In openapi-python-client before version 0.5.3, clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent exe… |
CVE-2020-10055 | Critical | 9.8 | 2020-08-14 | A vulnerability has been identified in Desigo CC (V4.x), Desigo CC (V3.x), Desigo CC Compact (V4.x), Desigo CC Compact (V3.x). Affected applications are delive… |
CVE-2020-8224 | High | 7.8 | 2020-08-10 | A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL config into a fixed directory. |
CVE-2020-8218 | High | 7.2 | 2020-07-30 | A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the ad… |
CVE-2020-7694 | Low | 3.7 | 2020-07-27 | This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP req… |
CVE-2020-12013 | Critical | 9.1 | 2020-07-16 | A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. This affects: Mitsubishi Electric MC… |
CVE-2020-11546 | Critical | 9.8 | 2020-07-14 | SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php. An unauthenticated remote… |
CVE-2020-8194 | Medium | 6.5 | 2020-07-10 | Reflected code injection in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP… |
CVE-2020-8163 | High | 8.8 | 2020-07-02 | The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call t… |
CVE-2020-15348 | Critical | 9.8 | 2020-06-26 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows use of live/CPEManager/AXCampaignManager/delete_cpes_by_ids?cpe_ids= for eval injection of Python code. |
CVE-2016-11064 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code via injection. |
CVE-2020-5593 | High | 8.8 | 2020-06-11 | Zenphoto versions prior to 1.5.7 allows an attacker to conduct PHP code injection attacks by leading a user to upload a specially crafted .zip file. |
CVE-2020-7675 | Critical | 9.8 | 2020-06-10 | cd-messenger through 2.7.26 is vulnerable to Arbitrary Code Execution. User input provided to the `color` argument executed by the `eval` function resulting in… |
CVE-2020-7674 | Critical | 9.8 | 2020-06-10 | access-policy through 3.1.0 is vulnerable to Arbitrary Code Execution. User input provided to the `template` function is executed by the `eval` function result… |
CVE-2020-7673 | Critical | 9.8 | 2020-06-10 | node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution. User input provided to the argument `A` of `extend` function`(A,B,as,isAargs)` located wit… |
CVE-2020-7672 | High | 8.6 | 2020-06-10 | mosc through 1.0.0 is vulnerable to Arbitrary Code Execution. User input provided to `properties` argument is executed by the `eval` function, resulting in cod… |
CVE-2020-8180 | Critical | 9.9 | 2020-06-08 | A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by an administrator. |
CVE-2020-7013 | High | 7.2 | 2020-06-03 | Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated attacker with privileges to create TSVB visualizations coul… |
CVE-2020-7012 | High | 8.8 | 2020-06-03 | Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker with privileges to wri… |
CVE-2020-13756 | Critical | 9.8 | 2020-06-03 | Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelector… |
CVE-2020-11079 | High | 8.6 | 2020-05-28 | node-dns-sync (npm module dns-sync) through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the libr… |
CVE-2019-5997 | Critical | 9.8 | 2020-05-20 | Video Insight VMS versions prior to 7.6.1 allow remote attackers to conduct code injection attacks via unspecified vectors. |
CVE-2020-13144 | High | 8.8 | 2020-05-18 | Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New course>New section>New subsection>New unit>Add new component… |
CVE-2020-8149 | Critical | 9.8 | 2020-05-15 | Lack of output sanitization allowed an attack to execute arbitrary shell commands via the logkitty npm package before version 0.7.1. |
CVE-2020-11057 | Critical | 9.9 | 2020-05-12 | In XWiki Platform 7.2 through 11.10.2, registered users without scripting/programming permissions are able to execute python/groovy scripts while editing perso… |
CVE-2020-6262 | High | 8.8 | 2020-05-12 | Service Data Download in SAP Application Server ABAP (ST-PI, before versions 2008_1_46C, 2008_1_620, 2008_1_640, 2008_1_700, 2008_1_710, 740) allows an attacke… |
CVE-2020-6248 | High | 7.2 | 2020-05-12 | SAP Adaptive Server Enterprise (Backup Server), version 16.0, does not perform the necessary validation checks for an authenticated user while executing DUMP o… |
CVE-2020-6243 | High | 8.8 | 2020-05-12 | Under certain conditions, SAP Adaptive Server Enterprise (XP Server on Windows Platform), versions 15.7, 16.0, does not perform the necessary checks for an aut… |
CVE-2020-11056 | High | 7.4 | 2020-05-07 | In Sprout Forms before 3.9.0, there is a potential Server-Side Template Injection vulnerability when using custom fields in Notification Emails which could lea… |
CVE-2020-10176 | Critical | 9.8 | 2020-05-07 | ASSA ABLOY Yale WIPC-301W 2.x.2.29 through 2.x.2.43_p1 devices allow Eval Injection of commands. |
CVE-2020-7609 | Critical | 9.8 | 2020-04-27 | node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function "fromJSON()" can be controlled by users wi… |
CVE-2020-5739 | High | 8.8 | 2020-04-14 | Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpenVPN up script to t… |
CVE-2019-19089 | Medium | 6.1 | 2020-04-02 | For ABB eSOMS versions 4.0 to 6.0.3, the X-Content-Type-Options Header is missing in the HTTP response, potentially causing the response body to be interpreted… |
CVE-2020-10948 | Critical | 9.8 | 2020-04-01 | Jon Hedley AlienForm2 (typically installed as af.cgi or alienform.cgi) 2.0.2 is vulnerable to Remote Command Execution via eval injection, a different issue th… |
CVE-2019-9163 | Critical | 9.8 | 2020-04-01 | The connection initiation process in March Networks Command Client before 2.7.2 allows remote attackers to execute arbitrary code via crafted XAML objects. |
CVE-2020-5558 | High | 8.8 | 2020-03-25 | CuteNews 2.0.1 allows remote authenticated attackers to execute arbitrary PHP code via unspecified vectors. |
CVE-2020-5553 | Critical | 9.8 | 2020-03-25 | mailform version 1.04 allows remote attackers to execute arbitrary PHP code via unspecified vectors. |
CVE-2020-10684 | High | 7.9 | 2020-03-24 | A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of… |
CVE-2020-7480 | Critical | 9.8 | 2020-03-23 | A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could cause files on the ap… |
CVE-2020-6650 | High | 8.3 | 2020-03-23 | UPS companion software v1.05 & Prior is affected by ‘Eval Injection’ vulnerability. The software does not neutralize or incorrectly neutralizes code syntax bef… |
CVE-2020-8140 | Medium | 6.7 | 2020-03-20 | A code injection in Nextcloud Desktop Client 2.6.2 for macOS allowed to load arbitrary code when starting the client with DYLD_INSERT_LIBRARIES set in the envi… |
CVE-2020-8137 | Critical | 9.8 | 2020-03-20 | Code injection vulnerability in blamer 1.0.0 and earlier may result in remote code execution when the input can be controlled by an attacker. |
CVE-2019-16108 | High | 7.5 | 2020-03-20 | phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode. |
CVE-2019-18582 | High | 7.2 | 2020-03-18 | Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server-side template in… |
CVE-2019-19208 | Critical | 9.8 | 2020-03-16 | Codiad Web IDE through 2.8.4 allows PHP Code injection. |
CVE-2020-8141 | High | 8.8 | 2020-03-15 | The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can contro… |
CVE-2020-10389 | High | 7.2 | 2020-03-12 | admin/save-settings.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by injecting PHP code into any POST paramet… |
CVE-2020-5203 | Critical | 9.8 | 2020-03-11 | In Fat-Free Framework 3.7.1, attackers can achieve arbitrary code execution if developers choose to pass user controlled input (e.g., $_REQUEST, $_GET, or $_PO… |
CVE-2020-5259 | High | 7.7 | 2020-03-10 | In affected versions of dojox (NPM package), the jqMix method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject propert… |
CVE-2020-5258 | High | 7.7 | 2020-03-10 | In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject prope… |
CVE-2020-10257 | Critical | 9.8 | 2020-03-10 | The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functio… |
CVE-2020-9530 | Medium | 6.5 | 2020-03-06 | An issue was discovered on Xiaomi MIUI V11.0.5.0.QFAEUXM devices. The export component of GetApps(com.xiaomi.mipicks) mishandles the functionality of opening o… |
CVE-2019-3695 | High | 8.4 | 2020-03-03 | A Improper Control of Generation of Code vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterpr… |
CVE-2020-8132 | Critical | 9.8 | 2020-02-28 | Lack of input validation in pdf-image npm package version <= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is constructed based on untrust… |
CVE-2020-9406 | Critical | 9.8 | 2020-02-26 | IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service. |
CVE-2019-4000 | High | 7.8 | 2020-02-25 | Improper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client 6.5.0 allows a local, authenticated attacker to execute arbit… |
CVE-2020-8518 | Critical | 9.8 | 2020-02-17 | Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution. |
CVE-2020-8129 | Critical | 9.8 | 2020-02-14 | An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code. |
CVE-2013-4211 | Critical | 9.8 | 2020-02-14 | A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, which could let a remote malicious user e… |
CVE-2013-4225 | High | 8.8 | 2020-02-11 | The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operati… |
CVE-2020-5529 | High | 8.1 | 2020-02-11 | HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute ar… |
CVE-2019-17268 | Critical | 9.8 | 2020-02-07 | The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions through 0… |
CVE-2020-8644 | Critical | 9.8 | 2020-02-05 | PlaySMS before 1.4.3 does not sanitize inputs from a malicious string. |
CVE-2013-2267 | High | 7.2 | 2020-01-27 | PHP Code Injection vulnerability in FUDforum Bulletin Board Software 3.0.4 could allow remote attackers to execute arbitrary code on the system. |
CVE-2020-6836 | Critical | 9.8 | 2020-01-11 | grammar-parser.jison in the hot-formula-parser package before 3.0.1 for Node.js is vulnerable to arbitrary code injection. The package fails to sanitize values… |
CVE-2019-20343 | Critical | 9.8 | 2020-01-06 | The MojoHaus Exec Maven plugin 1.1.1 for Maven allows code execution via a crafted XML document because a configuration element (within a plugin element) can s… |
CVE-2019-20155 | High | 8.8 | 2020-01-05 | An issue was discovered in report_edit.jsp in Determine (formerly Selectica) Contract Lifecycle Management (CLM) v5.4. Any authenticated user may execute Groov… |
CVE-2019-10758 | Critical | 9.9 | 2019-12-24 | mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exe… |
CVE-2019-19909 | High | 8.8 | 2019-12-19 | An issue was discovered in Public Knowledge Project (PKP) pkp-lib before 3.1.2-2, as used in Open Journal Systems (OJS) before 3.1.2-2. Code injection can occu… |
CVE-2019-7486 | High | 8.8 | 2019-12-19 | Code injection in SonicWall SMA100 allows an authenticated user to execute arbitrary code in viewcacert CGI script. This vulnerability impacted SMA100 version… |
CVE-2019-15599 | Critical | 9.8 | 2019-12-18 | A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command. |
CVE-2019-15598 | Critical | 9.8 | 2019-12-18 | A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command. |
CVE-2019-15597 | Critical | 9.8 | 2019-12-18 | A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input. |
CVE-2019-4716 | Critical | 9.8 | 2019-12-18 | IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute… |
CVE-2019-16774 | Medium | 4.4 | 2019-12-12 | In phpfastcache before 5.1.3, there is a possible object injection vulnerability in cookie driver. |
CVE-2019-10769 | Critical | 9.8 | 2019-12-06 | safer-eval is a npm package to sandbox the he evaluation of code used within the eval function. Affected versions of this package are vulnerable to Arbitrary C… |
CVE-2019-16885 | Critical | 9.8 | 2019-12-03 | In OkayCMS through 2.3.4, an unauthenticated attacker can achieve remote code execution by injecting a malicious PHP object via a crafted cookie. This could ha… |
CVE-2019-3665 | Medium | 6.5 | 2019-12-03 | Code Injection vulnerability in the web interface in McAfee Web Advisor (WA) prior to 4.1.1.48 allows remote unauthenticated attacker to allow the browser to r… |
CVE-2019-19502 | Critical | 9.8 | 2019-12-02 | Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated users to execute arbitrary PHP code. |
CVE-2019-14867 | High | 8.8 | 2019-11-27 | A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function… |
CVE-2019-16255 | High | 8.1 | 2019-11-26 | Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#… |
CVE-2019-13714 | Medium | 6.1 | 2019-11-25 | Insufficient validation of untrusted input in Color Enhancer extension in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to inject CSS into an H… |
CVE-2019-3427 | High | 7.2 | 2019-11-22 | The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a code injection vulnerability. An attacker could exploit the vulnerability to inject malici… |
CVE-2019-18889 | Critical | 9.8 | 2019-11-21 | An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could resu… |
CVE-2019-5509 | Critical | 9.8 | 2019-11-21 | ONTAP Select Deploy administration utility versions 2.11.2 through 2.12.2 are susceptible to a code injection vulnerability which when successfully exploited c… |
CVE-2019-19010 | Critical | 9.8 | 2019-11-16 | Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information… |
CVE-2019-15388 | High | 8.1 | 2019-11-14 | The Coolpad 1851 Android device with a build fingerprint of Coolpad/android/android:8.1.0/O11019/1534834761:userdebug/release-keys contains a pre-installed pla… |
CVE-2013-1666 | Critical | 9.8 | 2019-11-01 | Foswiki before 1.1.8 contains a code injection vulnerability in the MAKETEXT macro. |
CVE-2018-4031 | Critical | 10.0 | 2019-10-31 | An exploitable vulnerability exists in the safe browsing function of the CUJO Smart Firewall, version 7003. The flaw lies in the way the safe browsing function… |
CVE-2019-10211 | Critical | 9.8 | 2019-10-29 | Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via bundled OpenSSL executing code from unprotected directory. |
CVE-2019-17526 | Critical | 9.8 | 2019-10-18 | An issue was discovered in SageMath Sage Cell Server through 2019-10-05. Python Code Injection can occur in the context of an internet facing web application… |
CVE-2019-17613 | Critical | 9.8 | 2019-10-15 | qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature to supply PHP code t… |
CVE-2019-17408 | Critical | 9.8 | 2019-10-14 | parserIfLabel in inc/zzz_template.php in ZZZCMS zzzphp 1.7.3 allows remote attackers to execute arbitrary code because the danger_key function can be bypassed… |
CVE-2019-3652 | Medium | 5.0 | 2019-10-09 | Code Injection vulnerability in EPSetup.exe in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to get their malicious code… |
CVE-2018-21023 | High | 8.8 | 2019-10-08 | getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the ns_id parameter. |
CVE-2019-17310 | High | 7.2 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Campaigns module by an Admin user. |
CVE-2019-17309 | High | 7.2 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the EmailMan module by an Admin user. |
CVE-2019-17308 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Emails module by a Regular user. |
CVE-2019-17307 | High | 7.2 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Tracker module by an Admin user. |
CVE-2019-17306 | High | 7.2 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Configurator module by an Admin user. |