CWE-914: Improper Control of Dynamically-Identified Variables
The product does not properly restrict reading from or writing to dynamically-identified variables.
A kind of CWE-99 Improper Control of Resource Identifiers.
From the CWE List. © The MITRE Corporation.
Newest
-
libyaml-perlDebian,perl-YAMLAlmaLinux +1 more YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution 7.3 High - patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 more vm2: Sandbox Escape 10.0 Critical
- chyrplite chyrp lite, xenocrat chyrp-lite +1 more Chyrp Lite has an IDOR via Mass Assignment in Post Model 6.5 Medium
- scoder lupa, red hat openshift ai (rhoai), satellite 6.18 +2 more Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr 7.9 High
- youlai youlai-mall youlaitech youlai-mall orders improper control of dynamically-identified variables 5.3 Medium
- youlai youlai-mall youlaitech youlai-mall addresses deleteAddress improper control of dynamically-identified variables 5.3 Medium
- sap se netweaver application server abap Information Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP 8.5 High
- checkpoint clusterxl, clusterxl, multi-domain security management, quantum appliances, quantum maestro, quantum scalable chassis, quantum security gateways, quantum security management, gaia os +6 more +8 more Authenticated Gaia users can inject code or commands by global variables through special HTTP... 8.0 High
- mubarakalmehairbi toui ToUI allows user-specific variables to be shared between users 9.1 Critical