CWE-470: Reflection Injection
The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
Also known as Use of Externally-Controlled Input to Select Classes or Code, Unsafe Reflection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController8.6 High
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to behavior injection RCE via EntryTypesController8.6 High
- scrapyScrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware7.5 High
- craftcms cms, craft cms +1 moreCraft has a potential authenticated Remote Code Execution via malicious attached Behavior8.6 High
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior8.6 High
- barracuda rmmBarracuda RMM < 2025.1.1 Service Center Insecure Reflection RCE10.0 Critical
aws-advanced-nodejs-wrappernpmAWS Advanced NodeJS Wrapper: Privilege Escalation in Aurora PostgreSQL instance8.0 Highgithub.com/aws/aws-advanced-go-wrapper/auth-helpersGo,github.com/aws/aws-advanced-go-wrapper/aws-secrets-managerGo,github.com/aws/aws-advanced-go-wrapper/awssqlGo +7 more +9 moreAWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance8.0 Highsoftware.amazon.jdbc:aws-advanced-jdbc-wrapperMavenAmazon Web Services Advanced JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance8.0 High- aws go wrapper, jdbc wrapper, nodejs wrapper +2 more +4 moreAWS Advanced Python Wrapper: Privilege Escalation in Aurora PostgreSQL instance8.6 High
- pig4cloud pigIn pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz...9.1 Critical
- astroAstro's `X-Forwarded-Host` is reflected with no validation6.5 Medium
- sitecore experience platform (xp), experience manager, experience platform +3 more +5 moreHTML Cache Poisoning through Unsafe Reflections9.8 Critical
- progress telerik ui for asp.net ajaxUnsafe Reflection Vulnerability in Telerik UI for ASP.NET AJAX7.5 High
- jhipster generator-jhipster-entity-auditCWE-470 in generator-jhipster-entity-audit when having Javers selected as Entity Audit Framework7.7 High
- kentico xperienceKentico Xperience <= 13.0.180 Unsafe Reflection8.7 High
- pluginsglpi addressingThe Addressing GLPI plugin allows data enumeration through uncontrolled object instantiation8.2 High
- genetec security centerA high-severity vulnerability that can lead to arbitrary code execution on the system hosting the...8.9 High
- progress telerik report server, progress software telerik reporting +1 moreTelerik Report Server Insecure Type Resolution9.1 Critical
- progress telerik reportingTelerik Reporting Insecure Expression Evaluation7.8 High
- progress telerik reportingTelerik Reporting EntityDataSource Insecure Type Resolution8.8 High
- progress telerik reportingUnsafe Deserialization Vulnerability8.8 High
- iconics genesis64, mitsubishi electric corporation analytix, bizviz +5 more +7 moreUse of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability...6.7 Medium
- yiiframework yii, yiisoft yiisoft/yii2 +1 moreUnsafe Reflection in base Component class in yiisoft/yii28.1 High
- springCVE-2024-22258: PKCE Downgrade in Spring Authorization Server6.1 Medium
- stimulusreflex stimulus reflex, stimulusrelfex +1 moreReflex arbitrary method call in stimulus_reflex8.8 High
- mitsubishi electric corporation ezsocket, gt designer3 version1(got1000), gt designer3 version1(got2000) +10 more +12 moreUse of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability...9.8 Critical
- github enterprise serverUnsafe Reflection in Github Enterprise Server leading to Command Injection7.2 High
- google androidIn multiple locations, there is a possible way to import contacts belonging to other users due to...5.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreA website could have obscured the fullscreen notification by using a URL with a scheme handled by...6.5 Medium
- sitecore experience platformSitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code...8.8 High
- avo-hq avoPossible unsafe reflection / partial denial of service in avo8.3 High
- sailpoint identityiqSailPoint IdentityIQ Unsafe use of Reflection Vulnerability9.0 Critical
- google youtube android player api sdk, youtube android player api +1 moreRemote code execution in YouTube Android Player API SDK5.1 Medium
- hsqldb hypersql database, hypersql database hsqldb, debian linux +2 moreRemote code execution in HyperSQL DataBase8.0 High
- google android, mediatek, inc. mt6580, mt6735, mt6737, mt6739, mt6761, mt6765, mt6768, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6855, mt6873, mt6877, mt6879, mt6883, mt6885, mt6889, mt6895, mt6983, mt8167, mt8167s, mt8168, mt8173, mt8175, mt8185, mt8321, mt8362a, mt8365, mt8385, mt8666, mt8675, mt8765, mt8766, mt8768, mt8786, mt8788, mt8789, mt8791, mt8797 +1 moreIn MtkEmail, there is a possible escalation of privilege due to fragment injection. This could...7.8 High
- horde groupware, debian linux +1 moreHorde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which...8.0 High
- checkpoint endpoint security, harmony endpoint +1 moreCheck Point Endpoint Security Client E83 through E86 before E86.50 does not protect against a...2.3 Low
- apache kylinApache Kylin unsafe class loading9.8 Critical
- nationalsecurityagency emissaryPost-authentication Remote Code Execution (RCE) in emissary:emissary8.0 High
- vmware vcenter server, cloud foundation +1 moreThe vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input...9.8 Critical
- tobesoft xplatformA vulnerability of XPlatform could allow an unauthenticated attacker to execute arbitrary command...7.5 High
- glpi-project glpiUnsafe Reflection in getItemForItemtype()6.8 Medium
- intland codebeamercodeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code...6.1 Medium
- [unknown] infinispan, netapp active iq unified manager, redhat fuse +4 more +6 moreUse of Externally-Controlled Input to Select Classes or Code in Infinispan7.5 High
- redhat jboss operations network, apache struts +1 moreIt was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON)...5.6 Medium
- jenkins project pipeline: groovy plugin, jenkins pipeline\, redhat openshift container platform +2 moreSandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin9.8 Critical
- jenkins script security, jenkins project script security plugin, redhat openshift container platform +2 moreSandbox bypass vulnerability in Jenkins Script Security Plugin9.8 Critical
- bouncycastle bc-java, netapp oncommand workflow automation, opensuse leap +21 more +23 moreDeserialization of Untrusted Data in Bouncy castle9.8 Critical
- f5 big-ip (ltm, aam, afm, analytics, apm, asm, dns, edge gateway, gtm, link controller, pem, webaccelerator, websafe), big-ip access policy manager, big-ip advanced firewall manager +14 more +16 moreOn F5 BIG-IP 13.1.0-13.1.0.3 or 13.0.0, when authenticated administrative users execute commands...7.2 High
- Show moreLoading…