CWE-829: Inclusion of Functionality from Untrusted Control Sphere
The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- rockwell automation 1768 compactlogix controllers, 1769 compactlogix controllers, compact guardlogix 5370 controllers +38 more +40 moreICSA-22-090-05 Rockwell Automation Logix Controllers10.0 Critical
- cuppacmsCuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts...7.8 High
- cuppacmsCuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts...7.8 High
- jetbrains kotlin, oracle communications cloud native core binding support function, communications pricing design center +2 moreImproper Locking in JetBrains Kotlin5.3 Medium
- hospital\'s patient records management system project patient records management systemA local file inclusion in Hospital Patient Record Management System v1.0 allows attackers to...7.8 High
- ibm planning analytics, planning analytics workspace +1 moreIBM Planning Analytics 2.0 is vulnerable to a Remote File Include (RFI) attack. User input could...7.1 High
- gradleDependency verification bypass in Gradle7.5 High
- insyde insydeh2o, siemens ruggedcom ape1808 - bios, simatic field pg m5 +16 more +18 moreA vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that...8.2 High
- ivanti avalancheAn exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 allows an...8.1 High
- esri arcgis serverRemote file inclusion vulnerability in ArcGIS Server help documentation4.7 Medium
- nextcloud news, news-android +1 moreIntent URI permissions manipulation in nextcloud news-android5.8 Medium
- ntt-west biz box nvr510 firmware, biz box nvr700w firmware, biz box rtx1210 firmware +6 more +8 moreCross-site script inclusion vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier,...5.4 Medium
- sas sas\/intrnetSAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion. The samples library (included...7.5 High
- extremenetworks aerohive netconfigThe NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and...9.8 Critical
- ua-parser-js project ua-parser-jsua-parser-js Crypto Mining backdoor5.0 Medium
- insyde insydeh2o, siemens ruggedcom ape1808 - bios, ruggedcom apr1808 firmware +32 more +34 moreIn the kernel in Insyde InsydeH2O 5.x, certain SMM drivers did not correctly validate the...7.8 High
- unknown wp-publicationswp-publications <= 0.0 Local File Include8.3 High
- nextcloud server, kiteworks security-advisories +1 morePreview generation used third-party library not suited for user-generated content in Nextcloud server9.3 Critical
- nvidia data center gpu manager, data center gpu manager (dcgm) +1 moreNVIDIA DCGM contains a vulnerability in the DIAG module where any user can inject shared...7.8 High
- advantech r-seenetA local file inclusion (LFI) vulnerability exists in the options.php script functionality of...8.1 High
- idrive remotepciDrive RemotePC before 7.6.48 on Windows allows privilege escalation. A local and low-privileged...7.8 High
- kaseya vsa(Semi-)Authenticated local file inclusion in Kaseya VSA < v9.5.66.5 Medium
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5...5.3 Medium
- monstraA local file inclusion vulnerability was discovered in the captcha function in Monstra 3.0.4...9.8 Critical
- phpmailer, fedoraproject fedora +1 moreInclusion of Functionality from Untrusted Control Sphere in PHPMailer/PHPMailer8.1 High
- annexcloud loyalty experience platformAn Insecure Direct Object Reference (IDOR) vulnerability in Annex Cloud Loyalty Experience...4.3 Medium
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in...10.0 Critical
- google chrome, fedoraproject fedora +1 moreInappropriate implementation in Offline in Google Chrome on Android prior to 90.0.4430.212...8.8 High
- gradle, quarkus +1 moreRepository content filters do not work in Settings pluginManagement8.0 High
- quadbase espressdashboardAn issue was discovered in Quadbase EspressReports ES 7 Update 9. An authenticated user is able...8.1 High
- eclipse theia, the eclipse foundation eclipse theia +1 moreCommand Injection in @theia/messages6.1 Medium
- weberpIn webERP 4.15, the ManualContents.php file allows users to specify the "Language" parameter,...6.5 Medium
- ibm maximo for civil infrastructureIBM Maximo for Civil Infrastructure 7.6.2 includes executable functionality (such as a library)...6.3 Medium
- moodleMoodle Arbitrary PHP code execution by site admins via Shibboleth configuration7.2 High
- ckeditor, oracle agile product lifecycle management, application express +7 more +9 moreInclusion of Functionality from Untrusted Control Sphere in CKEditor 46.5 Medium
- ckeditor, oracle agile product lifecycle management, application express +4 more +6 moreCKEditor 4 ReDoS Vulnerability6.5 Medium
- liquidfilesA Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19. This client...6.1 Medium
- tt-rss tiny tiny rssAn issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. imgproxy in plugins...8.1 High
- teradici cloud access connector, cloud access connector legacy +1 moreThe Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy...7.5 High
- digdashAn issue was discovered in DigDash 2018R2 before p20200528, 2019R1 before p20200421, and 2019R2...7.8 High
- nagios, fedoraproject fedora +1 moreNagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for...4.9 Medium
- octobercms octoberLocal File read vulnerability in OctoberCMS4.8 Medium
- avast antivirusAn issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx...7.5 High
- adobe coldfusionColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a file inclusion vulnerability....9.8 Critical
- jsreportServer-Side Request Forgery and Inclusion of Functionality from Untrusted Control Sphere in jsreport9.8 Critical
- netapp oncommand system managerNetApp OnCommand System Manager 2.1 and earlier allows remote attackers to include arbitrary...7.5 High
- gitlab, gitlab community edition, enterprise edition +1 more +3 moreThe (1) create_branch, (2) create_tag, (3) import_project, and (4) fork_project functions in lib...6.5 Medium
- gallery plugin authors galleryGallery Plugin1.4 for WordPress has a Remote File Include Vulnerability9.8 Critical
- mozilla firefoxIf an image had not loaded correctly (such as when it is not actually an image), it could be...7.4 High
- enghouse web chatA remote file include (RFI) issue was discovered in Enghouse Web Chat 6.2.284.34. One can replace...5.3 Medium
- Show moreLoading…