Advisories · Weakness
CWE-140.
Every Advisory and CVE whose sources give the weakness CWE-140, newest first.
- CVSS 5.3 Medium
Sssd: sssd: information disclosure via query injection in entra id lookups
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- CWE-140
- CVSS 4.4 Medium
Sssd: sssd: information disclosure via odata injection in entra id lookups
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- CWE-140
- CVSS 7.3 High
Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name
- vim
- Other injection
- Code injection
- CVSS 7.5 High
fast-uri vulnerable to host confusion via percent-encoded authority delimiters
- CWE-140
- CWE-436
<2.4.1 || >=3.0.0, <3.1.2 · fixed in 2.4.1, 3.1.2
GHSA-v39h-62p7-jpjc · CVE-2026-6322 - CVSS 5.3 Medium
Potential livestatus injection in prediction graph page
- Checkmk
- CWE-140
- CVSS 5.1 Medium
Potential livestatus injection in notification test
- Checkmk
- CWE-140
- CVSS 5.3 Medium
Livestatus injection in monitoring quicksearch
- Checkmk
- CWE-140
- CVSS 5.4 Medium
iccDEV has Type Confusion in CIccTag:IsTypeCompressed()
- InternationalColorConsortium iccDEV
- Memory corruption
- CWE-20
- CVSS 6.8 Medium
Junos OS and Junos OS Evolved: Annotate configuration command can be used to change the configuration
- Juniper Networks Junos OS
- Juniper Networks Junos OS Evolved
- CWE-140
- CVSS 5.3 Medium
Livestatus injection in autocomplete endpoint
- Checkmk
- CWE-140
- CVSS 6.5 Medium
OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint
- Denial of service
- CWE-140
<1.11.2 · fixed in 1.11.2
GHSA-9wj4-8h85-pgrw · CVE-2025-48879 - CVSS 5.3 Medium
Livestatus Injection in dynmaps
- Nagvis
- CWE-140
- CVSS 7.7 High
Using malformed From header can forge identity with ";" or NULL in name portion
- asterisk
- CWE-140
- CWE-792
- CVSS 6.0 Medium
Livestatus command injection in RestAPI
- Checkmk
- CWE-140
- CVSS 4.0 Medium
Improper Neutralization of Delimiters in Mongoose Web Server library
- Cesanta Mongoose Web Server
- CWE-140
- CVSS 4.0 Medium
Improper Neutralization of Delimiters in Mongoose Web Server library
- Cesanta Mongoose Web Server
- CWE-140
- CVSS 4.8 Medium
fish-shop/syntax-check Improper Neutralization of Delimiters
- fish-shop syntax-check
- CWE-140
- CVSS 6.5 Medium
Livestatus injection in mknotifyd
- Checkmk
- CWE-140
- CVSS 7.6 High
Livestatus injection in ajax_search
- Checkmk
- CWE-140
- CVSS 7.6 High
Livestatus injection in availability timeline
- Checkmk
- CWE-140
- CVSS 7.1 High
Field injection in the KirbyData text storage handler
- Broken access control
- CWE-140
<3.5.8.3 || >=3.6.0, <3.6.6.3 || >=3.7.0, <3.7.5.2 || >=3.8.0, <3.8.4.1 || >=3.9.0, <3.9.6 · fixed in 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, 3.9.6
GHSA-x5mr-p6v4-wp93 · CVE-2023-38488 - CVSS 8.3 High
Livestatus command injection in RestAPI
- Checkmk
- CWE-140