CWE-829: Inclusion of Functionality from Untrusted Control Sphere
The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- adobe systems incorporated magento 2, magento +1 moreMagento remote code execution vulnerability8.8 High
- ruby-lang ruby193ruby193 uses an insecure LD_LIBRARY_PATH setting.3.3 Low
generator-jhipsternpmHigh severity vulnerability that affects generator-jhipster8.1 High- librenmsAn issue was discovered in LibreNMS through 1.47. Several of the scripts perform dynamic script...8.1 High
- mozilla firefox, firefox esr, thunderbird +2 moreA same-origin policy violation occurs allowing the theft of cross-origin images through a...6.5 Medium
- larvit larvitbaseUnintended Require in larvitbase-api7.5 High
- sinaextra sina extension for elementorThe sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion.7.5 High
- anjlab paranoid2paranoid2 gem Code backdoor9.8 Critical
- ibm content navigatorIBM Content Navigator 3.0CD is vulnerable to local file inclusion, allowing an attacker to access...4.3 Medium
- eclipse buildship, the eclipse foundation eclipse buildship +1 moreIn Eclipse Buildship versions prior to 3.1.1, the build files indicate that this project is...8.1 High
tesseract.jsnpmInsecure Default Configuration in tesseract.js5.9 Medium- eclipse xtend, xtext, the eclipse foundation eclipse xtext +2 morePotentially compromised builds8.1 High
- web-dorado contact formThe WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin...8.8 High
- 10web form makerThe 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax...8.8 High
- eclipse vorto, the eclipse foundation eclipse vorto +1 moreEclipse Vorto resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS8.1 High
- eclipse hawkbit, the eclipse foundation eclipse hawkbit +1 moreCleartext Transmission of Sensitive Information, Inclusion of Functionality from Untrusted Control Sphere , and Download of Code Without Integrity Check in Eclipse hawkBit8.1 High
- maccmsMaccms 10 allows remote attackers to execute arbitrary PHP code by entering this code in a...8.8 High
- elastic kibana, redhat openshift container platform +1 moreKibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console...9.8 Critical
- node.jsNode.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by...8.1 High
- playsms project playsmsplaySMS through 1.4.2 allows Privilege Escalation through Daemon abuse.8.8 High
- kone group controller firmwareAn issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Unauthenticated...9.1 Critical
- microsoft edge, internet explorer 10, internet explorer 11 +1 more +3 moreAn information disclosure vulnerability exists when affected Microsoft browsers improperly allow...6.5 Medium
- mybbMyBB Group MyBB contains a File Inclusion vulnerability in Admin panel (Tools and Maintenance ->...7.2 High
- pivotal spring framework, debian linux, oracle agile product lifecycle management +25 more +27 moreModerate severity vulnerability that affects org.springframework:spring-core7.5 High
- mozilla firefoxThe cache directory on the local file system is set to be world writable. Firefox defaults to...9.8 Critical
- procps-ng project procps-ng, [unknown] procps-ng, procps, canonical ubuntu linux +1 more +3 moreprocps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user...7.3 High
- siteeditor site editorA Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows...7.5 High
- trend micro smart protection server (standalone), trendmicro smart protection server +1 moreA vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could...8.1 High
- ibm operations analytics predictive insightsA flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and...9.8 Critical
- drupal, drupal core +1 moreDrupal Remote code execution8.1 High
- apache cxfImproper Input Validation in Apache CXF9.8 Critical
- allmyguests project allmyguests, allmylinks project allmylinks, allmyvisitors project allmyvisitors +2 morePHP remote file inclusion vulnerabilities in include/footer.inc.php in (1) AllMyVisitors, (2)...9.8 Critical
- phpgedviewPHP remote file inclusion vulnerability in (1) functions.php, (2) authentication_index.php, and ...9.8 Critical