CWE-99: Improper Control of Resource Identifiers
The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended control sphere.
Also known as Insecure Direct Object Reference, Resource Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- benner connectaBenner Connecta EditarLogado resource injection5.3 Medium
- benner modernanetBenner ModernaNet GetImageMedico resource injection5.3 Medium
- harpia diagsystemHarpia DiagSystem atualatendimento_jpeg.php resource injection5.3 Medium
- hitachi vantara pentaho data integration & analytics, pentaho business analytics server +1 moreHitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')8.8 High
- eng knowageDataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30...9.1 Critical
- campcodes school management softwareCampCodes School Management Software Attachment resource injection2.3 Low
- ffmpegFfmpeg: dash playlist ssrf vulnerability in ffmpeg7.2 High
- ffmpegFfmpeg: hls xbin demuxer dos amplification in ffmpeg5.3 Medium
- ffmpegFfmpeg: hls unsafe file extension bypass in ffmpeg4.7 Medium
- ffmpegFfmpeg: null pointer dereference in ffmpeg hls parsing7.5 High
- ffmpegFfmpeg: improper handling of input format in tty demuxer of ffmpeg5.3 Medium
- vercom s.a. redlink sdkCross Application Scripting in Redlink SDK4.3 Medium
- projectsendprojectsend process.php get_preview resource injection6.9 Medium
- free5gc smf, simplemachines simple machines forum +1 moreSimpleMachines SMF User Alert Read Status index.php resource injection5.3 Medium
- free5gc smf, simplemachines simple machine forum, simple machines forum +2 moreSimpleMachines SMF Delete User index.php resource injection5.3 Medium
- gitlabImproper Control of Resource Identifiers ('Resource Injection') in GitLab2.7 Low
- campcodes online laundry management systemCampcodes Online Laundry Management System HTTP Request Parameter manage_user.php resource injection5.3 Medium
- phpgurukul doctor appointment management systemPHPGurukul Doctor Appointment Management System view-appointment-detail.php resource injection6.3 Medium
- linux kernel, red hat enterprise linux 6, enterprise linux 7 +3 more +5 moreKernel: max page sharing of kernel samepage merging (ksm) may cause memory deduplication5.3 Medium
- hitachi vantara pentaho data integration & analytics, hitachi pentaho data integration and analytics +1 moreHitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')8.5 High
- gitlabIncorrect Authorization in GitLab5.7 Medium
- gitlabImproper Encoding or Escaping of Output in GitLab4.1 Medium
- abstrium pydio cellsAbstrium Pydio Cells User Creation resource injection6.3 Medium
- apereo phpcas, fedoraproject fedora +1 moreService Hostname Discovery Exploitation in phpCAS8.0 High
- sourcecodester train scheduler app, train scheduler app project scheduler app +1 moreSourceCodester Train Scheduler App resource injection5.4 Medium
- sap sql anywhere, sap se sql anywhere server +1 moreSAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users...6.5 Medium
- school club application system project club application system, unspecified school club application system +1 moreSchool Club Application System resource injection6.5 Medium
- brainstormforce starter templates — elementor, gutenberg & beaver builder templates, starter templates +1 moreStarter Templates — Elementor, Gutenberg & Beaver Builder Templates <= 2.7.0 Authenticated Block Import to Stored XSS7.6 High
- nextcloud desktop, fedoraproject fedora +1 moreNextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing...8.8 High
- haxx curl, debian linux, fujitsu m10-1 firmware +10 more +12 morecurl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other...7.8 High
- sap se business objects business intelligence platform, sap businessobjects business intelligence platform +1 moreSAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access...6.5 Medium
- apereo opencastOpencast uses unsafe identifiers7.7 High
- cisco unified intelligence centerCisco Unified Intelligence Center Remote File Injection Vulnerability5.9 Medium
- aveva indusoft web studio, ics-cert aveva software, llc indusoft web studio prior to version 8.1 sp3 and intouch edge hmi (formerly intouch machine edition) prior to version 2017 update, aveva intouch machine edition 2014 +2 moreAVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly...7.5 High
- phoenixcontact mguard firmwareAn issue was discovered on Phoenix Contact mGuard devices that have been updated to Version 8.4.0...9.8 Critical
- curlA flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file...5.3 Medium