CWE-917 · 179 kayıt

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Bu sınıftaki CVE’ler

179 kayıt

CVE kayıtları
Aksiyon	CVE	Zafiyet	Ciddiyet	KEV	EPSS	Yayın
99Hemen	CVE-2022-26134Silahlaştırılmış	In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attackatlassian · confluence data center · CWE-917 pre-auth RCE	Kritik9,8	KEV	%100,0	3 Haz 2022
99Hemen	CVE-2021-26084Silahlaştırılmış	In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attackatlassian · confluence data center · CWE-917 pre-auth RCE	Kritik9,8	KEV	%100,0	30 Ağu 2021
98Hemen	CVE-2020-17530Silahlaştırılmış	Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.apache · struts · CWE-917 pre-auth RCE	Kritik9,8	KEV	%95,9	10 Ara 2020
96Hemen	CVE-2021-45046Silahlaştırılmış	Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attackapache · log4j · CWE-917 pre-auth RCE	Kritik9,0	KEV	%100,0	14 Ara 2021
95Hemen	CVE-2020-10199Silahlaştırılmış	Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).sonatype · nexus · CWE-917 RCE	Yüksek8,8	KEV	%99,1	1 Nis 2020
90Hemen	CVE-2010-1871Silahlaştırılmış	JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for redhat · jboss enterprise application platform · CWE-917 pre-auth RCE	Yüksek8,8	KEV	%83,4	5 Ağu 2010
65Bu hafta	CVE-2021-31805Kavram kanıtı	Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.apache · struts · CWE-917 pre-auth RCE	Kritik9,8	—	%85,4	12 Nis 2022
46Planlayın	CVE-2019-5355İstismar yok	A remote denial of service vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.hp · intelligent management center · CWE-917 pre-auth RCE Hizmet dışı bırakma	Yüksek7,5	—	%54,0	5 Haz 2019
45Planlayın	CVE-2018-12533Kavram kanıtı	JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitredhat · richfaces · CWE-917 pre-auth RCE	Kritik9,8	—	%19,0	18 Haz 2018
44Planlayın	CVE-2022-22980Kavram kanıtı	A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expresvmware · spring data mongodb · CWE-917 pre-auth RCE	Kritik9,8	—	%17,8	23 Haz 2022
41Planlayın	CVE-2020-3956Kavram kanıtı	VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly hanvmware · vcloud director · CWE-917 RCE	Yüksek8,8	—	%21,1	20 May 2020
41Planlayın	CVE-2019-5352İstismar yok	A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.hp · intelligent management center · CWE-917 pre-auth RCE	Kritik9,8	—	%8,1	5 Haz 2019
41Planlayın	CVE-2019-11949İstismar yok	A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.hp · intelligent management center · CWE-917 pre-auth RCE	Kritik9,8	—	%8,1	5 Haz 2019
41Planlayın	CVE-2019-5358İstismar yok	A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.hp · intelligent management center · CWE-917 pre-auth RCE	Kritik9,8	—	%8,1	5 Haz 2019
41Planlayın	CVE-2019-5387İstismar yok	A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.hp · intelligent management center · CWE-917 pre-auth RCE	Kritik9,8	—	%8,1	5 Haz 2019
41Planlayın	CVE-2018-12532İstismar yok	JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapperredhat · richfaces · CWE-917 pre-auth RCE	Kritik9,8	—	%7,0	18 Haz 2018
41Planlayın	CVE-2020-7169İstismar yok	A ictexpertcsvdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Centerhp · intelligent management center · CWE-917 pre-auth RCE	Kritik9,8	—	%7,0	19 Eki 2020
41Planlayın	CVE-2020-7161İstismar yok	A reporttaskselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMhp · intelligent management center · CWE-917 pre-auth RCE	Kritik9,8	—	%7,0	19 Eki 2020
41Planlayın	CVE-2020-7153İstismar yok	A iccselectdevtype expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMhp · intelligent management center · CWE-917 pre-auth RCE	Kritik9,8	—	%7,0	19 Eki 2020
41Planlayın	CVE-2020-7151İstismar yok	A faulttrapgroupselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Centerhp · intelligent management center · CWE-917 pre-auth RCE	Kritik9,8	—	%7,0	19 Eki 2020
41Planlayın	CVE-2020-24652İstismar yok	A addvsiinterfaceinfo expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center hp · intelligent management center · CWE-917 pre-auth RCE	Kritik9,8	—	%7,0	19 Eki 2020
41Planlayın	CVE-2020-7168İstismar yok	A selectusergroup expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMChp · intelligent management center · CWE-917 pre-auth RCE	Kritik9,8	—	%7,0	19 Eki 2020
41Planlayın	CVE-2020-7141İstismar yok	A adddevicetoview expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMChp · intelligent management center · CWE-917 pre-auth RCE	Kritik9,8	—	%7,0	19 Eki 2020
41Planlayın	CVE-2020-7145İstismar yok	A chooseperfview expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC)hp · intelligent management center · CWE-917 pre-auth RCE	Kritik9,8	—	%7,0	19 Eki 2020
41Planlayın	CVE-2020-7147İstismar yok	A deployselectbootrom expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center hp · intelligent management center · CWE-917 pre-auth RCE	Kritik9,8	—	%7,0	19 Eki 2020

CVE-2022-26134
99Hemen
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attack
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100
- pre-auth RCE
atlassian · confluence data center3 Haz 2022
CVE-2021-26084
99Hemen
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attack
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100
- pre-auth RCE
atlassian · confluence data center30 Ağu 2021
CVE-2020-17530
98Hemen
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %96
- pre-auth RCE
apache · struts10 Ara 2020
CVE-2021-45046
96Hemen
Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
KritikCVSS 9,0KEVSilahlaştırılmışEPSS %100
- pre-auth RCE
apache · log4j14 Ara 2021
CVE-2020-10199
95Hemen
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %99
- RCE
sonatype · nexus1 Nis 2020
CVE-2010-1871
90Hemen
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for
YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %83
- pre-auth RCE
redhat · jboss enterprise application platform5 Ağu 2010
CVE-2021-31805
65Bu hafta
Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.
KritikCVSS 9,8Kavram kanıtıEPSS %85
- pre-auth RCE
apache · struts12 Nis 2022
CVE-2019-5355
46Planlayın
A remote denial of service vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
YüksekCVSS 7,5İstismar yokEPSS %54
- pre-auth RCE
- Hizmet dışı bırakma
hp · intelligent management center5 Haz 2019
CVE-2018-12533
45Planlayın
JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbit
KritikCVSS 9,8Kavram kanıtıEPSS %19
- pre-auth RCE
redhat · richfaces18 Haz 2018
CVE-2022-22980
44Planlayın
A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expres
KritikCVSS 9,8Kavram kanıtıEPSS %18
- pre-auth RCE
vmware · spring data mongodb23 Haz 2022
CVE-2020-3956
41Planlayın
VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly han
YüksekCVSS 8,8Kavram kanıtıEPSS %21
- RCE
vmware · vcloud director20 May 2020
CVE-2019-5352
41Planlayın
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
KritikCVSS 9,8İstismar yokEPSS %8
- pre-auth RCE
hp · intelligent management center5 Haz 2019
CVE-2019-11949
41Planlayın
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
KritikCVSS 9,8İstismar yokEPSS %8
- pre-auth RCE
hp · intelligent management center5 Haz 2019
CVE-2019-5358
41Planlayın
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
KritikCVSS 9,8İstismar yokEPSS %8
- pre-auth RCE
hp · intelligent management center5 Haz 2019
CVE-2019-5387
41Planlayın
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
KritikCVSS 9,8İstismar yokEPSS %8
- pre-auth RCE
hp · intelligent management center5 Haz 2019
CVE-2018-12532
41Planlayın
JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapper
KritikCVSS 9,8İstismar yokEPSS %7
- pre-auth RCE
redhat · richfaces18 Haz 2018
CVE-2020-7169
41Planlayın
A ictexpertcsvdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center
KritikCVSS 9,8İstismar yokEPSS %7
- pre-auth RCE
hp · intelligent management center19 Eki 2020
CVE-2020-7161
41Planlayın
A reporttaskselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iM
KritikCVSS 9,8İstismar yokEPSS %7
- pre-auth RCE
hp · intelligent management center19 Eki 2020
CVE-2020-7153
41Planlayın
A iccselectdevtype expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iM
KritikCVSS 9,8İstismar yokEPSS %7
- pre-auth RCE
hp · intelligent management center19 Eki 2020
CVE-2020-7151
41Planlayın
A faulttrapgroupselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center
KritikCVSS 9,8İstismar yokEPSS %7
- pre-auth RCE
hp · intelligent management center19 Eki 2020
CVE-2020-24652
41Planlayın
A addvsiinterfaceinfo expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center
KritikCVSS 9,8İstismar yokEPSS %7
- pre-auth RCE
hp · intelligent management center19 Eki 2020
CVE-2020-7168
41Planlayın
A selectusergroup expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC
KritikCVSS 9,8İstismar yokEPSS %7
- pre-auth RCE
hp · intelligent management center19 Eki 2020
CVE-2020-7141
41Planlayın
A adddevicetoview expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC
KritikCVSS 9,8İstismar yokEPSS %7
- pre-auth RCE
hp · intelligent management center19 Eki 2020
CVE-2020-7145
41Planlayın
A chooseperfview expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC)
KritikCVSS 9,8İstismar yokEPSS %7
- pre-auth RCE
hp · intelligent management center19 Eki 2020
CVE-2020-7147
41Planlayın
A deployselectbootrom expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center
KritikCVSS 9,8İstismar yokEPSS %7
- pre-auth RCE
hp · intelligent management center19 Eki 2020

Tüm zafiyet sınıfları