İçeriğe atla
Noroxi

CWE-829 · 244 kayıt

Inclusion of Functionality from Untrusted Control Sphere

Bu sınıftaki CVE’ler

244 kayıt

  • CVE-2026-0770
    88Hemen

    Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %63

    langflow · langflow23 Oca 2026

  • CVE-2025-32463
    78Bu hafta

    Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the -

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %55

    sudo project · sudo30 Haz 2025

  • CVE-2024-38476
    51Planlayın

    Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect

    KritikCVSS 9,8Kavram kanıtıEPSS %42

    apache · http server1 Tem 2024

  • CVE-2020-16152
    50Planlayın

    The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers

    KritikCVSS 9,8SilahlaştırılmışEPSS %36

    extremenetworks · aerohive netconfig14 Kas 2021

  • CVE-2010-2076
    42Planlayın

    Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, A

    KritikCVSS 9,8İstismar yokEPSS %10

    apache · cxf19 Ağu 2010

  • CVE-2004-0285
    41Planlayın

    PHP remote file inclusion vulnerabilities in include/footer.inc.php in (1) AllMyVisitors, (2) AllMyLinks, and (3) AllMyGuests allow remote a

    KritikCVSS 9,8Kavram kanıtıEPSS %8

    allmyguests project · allmyguests23 Kas 2004

  • CVE-2004-0030
    41Planlayın

    PHP remote file inclusion vulnerability in (1) functions.php, (2) authentication_index.php, and (3) config_gedcom.php for PHPGEDVIEW 2.61 al

    KritikCVSS 9,8Kavram kanıtıEPSS %7

    phpgedview · phpgedview20 Oca 2004

  • CVE-2020-3794
    41Planlayın

    ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a file inclusion vulnerability.

    KritikCVSS 9,8İstismar yokEPSS %7

    adobe · coldfusion25 Mar 2020

  • CVE-2023-6971
    41Planlayın

    The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP heade

    KritikCVSS 9,8İstismar yokEPSS %6

    backupbliss · backup migration22 Ara 2023

  • CVE-2022-1161
    41Planlayın

    ICSA-22-090-05 Rockwell Automation Logix Controllers

    KritikCVSS 9,8İstismar yokEPSS %5

    rockwellautomation · compactlogix 1768-l43 firmware11 Nis 2022

  • CVE-2020-4561
    41Planlayın

    IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions.

    KritikCVSS 10,0İstismar yokEPSS %3

    ibm · cognos analytics1 Haz 2021

  • CVE-2019-13589
    40Planlayın

    The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.

    KritikCVSS 9,8İstismar yokEPSS %4

    anjlab · paranoid214 Tem 2019

  • CVE-2017-5397
    40Planlayın

    The cache directory on the local file system is set to be world writable.

    KritikCVSS 9,8İstismar yokEPSS %4

    mozilla · firefox11 Haz 2018

  • CVE-2012-4919
    40Planlayın

    Gallery Plugin1.4 for WordPress has a Remote File Include Vulnerability

    KritikCVSS 9,8İstismar yokEPSS %3

    gallery project · gallery22 Oca 2020

  • CVE-2020-8128
    40Planlayın

    An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbit

    KritikCVSS 9,8İstismar yokEPSS %3

    jsreport · jsreport14 Şub 2020

  • CVE-2017-1376
    40Planlayın

    A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges.

    KritikCVSS 9,8İstismar yokEPSS %3

    ibm · operations analytics predictive insights28 Ağu 2017

  • CVE-2021-32802
    40Planlayın

    Preview generation used third-party library not suited for user-generated content in Nextcloud server

    KritikCVSS 9,8İstismar yokEPSS %3

    nextcloud · nextcloud server7 Eyl 2021

  • CVE-2020-25414
    40Planlayın

    A local file inclusion vulnerability was discovered in the captcha function in Monstra 3.0.4 which allows remote attackers to execute arbitr

    KritikCVSS 9,8İstismar yokEPSS %2

    monstra · monstra17 Haz 2021

  • CVE-2023-49133
    40Planlayın

    A command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point

    KritikCVSS 9,8İstismar yokEPSS %2

    tp-link · eap225 firmware9 Nis 2024

  • CVE-2023-49134
    40Planlayın

    A command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point

    KritikCVSS 9,8İstismar yokEPSS %2

    tp-link · eap225 firmware9 Nis 2024

  • CVE-2025-70974
    40Planlayın

    Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java

    KritikCVSS 10,0İstismar yokEPSS %1

    alibaba · fastjson9 Oca 2026

  • CVE-2024-38537
    39İzleyin

    Inclusion of Untrusted polyfill.io Code Vulnerability in fides.js

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    ethyca · fides2 Tem 2024

  • CVE-2023-26053
    39İzleyin

    Gradle usage of long IDs for PGP keys opens potential for collision attacks

    KritikCVSS 9,8İstismar yokEPSS %1

    gradle · gradle2 Mar 2023

  • CVE-2022-24119
    39İzleyin

    Certain General Electric Renewable Energy products have a hidden feature for unauthenticated remote access to the device configuration shell

    KritikCVSS 9,8İstismar yokEPSS %1

    ge · inet 900 firmware26 Ara 2022

  • CVE-2025-27668
    39İzleyin

    Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Arbitrary Content Inclusion via Ifr

    KritikCVSS 9,8İstismar yokEPSS %1

    printerlogic · vasion print5 Mar 2025

Tüm zafiyet sınıfları