# CWE-829.

Every Advisory and CVE whose sources give the weakness CWE-829, newest first.

## Records, newest first (an older page)

- [Moodle Arbitrary PHP code execution by site admins via Shibboleth configuration](https://agentprime.io/advisories/GHSA-2jrm-gww7-wch2.md)
  `GHSA-2jrm-gww7-wch2`, `BIT-moodle-2021-20187`, `CVE-2021-20187`, `PKSA-czrr-wk83-tjhd` · Packagist `moodle/moodle`: affected `>=3.5, <3.5.16 || >=3.8, <3.8.7 || >=3.9, <3.9.4 || >=3.10, <3.10.1`, fixed in `3.5.16`, `3.8.7`, `3.9.4`, `3.10.1` · CVSS 7.2 High · Not analysed yet · Published 24 May 2022 · Tags: Code injection, CWE-829
- [Potentially compromised builds](https://agentprime.io/advisories/GHSA-rfj2-4g26-7jw5.md)
  `GHSA-rfj2-4g26-7jw5`, `CVE-2019-10249` · Maven `org.eclipse.xtend:org.eclipse.xtend.core` and 1 more: affected `<2.18.0`, fixed in `2.18.0` · CVSS 8.1 High · Not analysed yet · Published 24 May 2022 · Tags: Weak cryptography or TLS, CWE-494, CWE-829
- [Eclipse Vorto resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS](https://agentprime.io/advisories/GHSA-fg2q-v428-2gph.md)
  `GHSA-fg2q-v428-2gph`, `CVE-2019-10248` · Maven `org.eclipse.vorto:org.eclipse.vorto.core`: affected `<0.11.0`, fixed in `0.11.0` · CVSS 8.1 High · Not analysed yet · Published 24 May 2022 · Tags: CWE-494, CWE-669, CWE-829
- [Drupal Remote code execution](https://agentprime.io/advisories/GHSA-rhx9-3qf7-r3j7.md)
  `GHSA-rhx9-3qf7-r3j7`, `CVE-2017-6381`, `PKSA-1931-qv6k-h8s6`, `PKSA-8cvj-gc3z-dc48` · Packagist `drupal/core` and 1 more: affected `>=8.0, <8.2.7`, fixed in `8.2.7` · CVSS 8.1 High · Not analysed yet · Published 13 May 2022 · Tags: CWE-829
- [Anonymous user cache poisoning in discourse](https://agentprime.io/advisories/CVE-2022-24824.md)
  `CVE-2022-24824` · CVE record: discourse discourse · CVSS 5.3 Medium · Not analysed yet · Published 14 Apr 2022 · Tags: CWE-829
- [ICSA-22-090-05 Rockwell Automation Logix Controllers](https://agentprime.io/advisories/CVE-2022-1161.md)
  `CVE-2022-1161` · CVE record: Rockwell Automation 1768 CompactLogix controllers and 4 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Apr 2022 · Tags: CWE-829
- [Improper Locking in JetBrains Kotlin](https://agentprime.io/advisories/GHSA-2qp4-g3q3-f92w.md)
  `GHSA-2qp4-g3q3-f92w`, `CVE-2022-24329` · Maven `org.jetbrains.kotlin:kotlin-stdlib`: affected `<1.6.0`, fixed in `1.6.0` · CVSS 5.3 Medium · Not analysed yet · Published 26 Feb 2022 · Tags: CWE-667, CWE-829
- [Dependency verification bypass in Gradle](https://agentprime.io/advisories/CVE-2022-23630.md)
  `CVE-2022-23630` · CVE record: gradle gradle · CVSS 7.5 High · Not analysed yet · Published 10 Feb 2022 · Tags: CWE-829
- [Intent URI permissions manipulation in nextcloud news-android](https://agentprime.io/advisories/CVE-2021-41256.md)
  `CVE-2021-41256` · CVE record: nextcloud news-android · CVSS 5.8 Medium · Not analysed yet · Published 30 Nov 2021 · Tags: CWE-829
- [Inclusion of Functionality from Untrusted Control Sphere in CKEditor 4](https://agentprime.io/advisories/GHSA-wpvm-wqr4-p7cw.md)
  `GHSA-wpvm-wqr4-p7cw`, `CVE-2021-26272` · npm `ckeditor4`: affected `<4.16.0`, fixed in `4.16.0` · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2021 · Tags: CWE-829
- [Preview generation used third-party library not suited for user-generated content in Nextcloud server](https://agentprime.io/advisories/CVE-2021-32802.md)
  `CVE-2021-32802` · CVE record: nextcloud security-advisories · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2021 · Tags: CWE-829
- [PHPMailer untrusted code may be run from an overridden address validator](https://agentprime.io/advisories/GHSA-77mr-wc79-m8j3.md)
  `GHSA-77mr-wc79-m8j3`, `BIT-phpmailer-2021-3603`, `CVE-2021-3603`, `PKSA-m8by-bb7v-7qt5` · Packagist `phpmailer/phpmailer`: affected `<6.5.0`, fixed in `6.5.0` · CVSS 8.1 High · Not analysed yet · Published 22 Jun 2021 · Tags: Other injection, CWE-829
- [Command Injection in @theia/messages](https://agentprime.io/advisories/GHSA-c94v-8fff-73ph.md)
  `GHSA-c94v-8fff-73ph`, `CVE-2021-28162` · npm `@theia/messages`: affected `<1.0.0`, fixed in `1.0.0` · CVSS 6.1 Medium · Not analysed yet · Published 10 May 2021 · Tags: CWE-829, CWE-830
- [Repository content filters do not work in Settings pluginManagement](https://agentprime.io/advisories/CVE-2021-29427.md)
  `CVE-2021-29427` · CVE record: gradle gradle · CVSS 8.0 High · Not analysed yet · Published 13 Apr 2021 · Tags: CWE-829
- [Server-Side Request Forgery and Inclusion of Functionality from Untrusted Control Sphere in jsreport](https://agentprime.io/advisories/GHSA-5fjj-cfh2-ghc5.md)
  `GHSA-5fjj-cfh2-ghc5`, `CVE-2020-8128` · npm `jsreport`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Apr 2021 · Tags: Server-side request forgery (SSRF), CWE-829
- [Local File read vulnerability in OctoberCMS](https://agentprime.io/advisories/GHSA-r23f-c2j5-rx2f.md)
  `GHSA-r23f-c2j5-rx2f`, `CVE-2020-5295`, `PKSA-cdgw-bbb7-3jf8` · Packagist `october/cms`: affected `>=1.0.319, <1.0.466`, fixed in `1.0.466` · CVSS 4.8 Medium · Not analysed yet · Published 3 Jun 2020 · Tags: File inclusion, CWE-829
- [High severity vulnerability that affects generator-jhipster](https://agentprime.io/advisories/GHSA-mc84-xr9p-938r.md)
  `GHSA-mc84-xr9p-938r` · npm `generator-jhipster`: affected `<6.3.1`, fixed in `6.3.1` · CVSS 8.1 High · Not analysed yet · Published 23 Sept 2019 · Tags: CWE-494, CWE-829
- [Unintended Require in larvitbase-api](https://agentprime.io/advisories/GHSA-xf27-jqwv-gf3r.md)
  `GHSA-xf27-jqwv-gf3r`, `CVE-2019-5479` · npm `larvitbase-api`: affected `<0.5.5`, fixed in `0.5.5` · CVSS 7.5 High · Not analysed yet · Published 11 Sept 2019 · Tags: File inclusion, CWE-829
- [paranoid2 gem Code backdoor](https://agentprime.io/advisories/GHSA-4g4c-8gqh-m4vm.md)
  `GHSA-4g4c-8gqh-m4vm`, `CVE-2019-13589` · RubyGems `paranoid2`: affected `=1.1.6`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jul 2019 · Tags: CWE-829
- [The Eclipse Foundation Eclipse Buildship: In Eclipse Buildship versions prior to 3.1.1…](https://agentprime.io/advisories/CVE-2019-11770.md)
  `CVE-2019-11770` · CVE record: The Eclipse Foundation Eclipse Buildship · No CVSS score · Not analysed yet · Published 14 Jun 2019 · Tags: CWE-829
- [Insecure Default Configuration in tesseract.js](https://agentprime.io/advisories/GHSA-83rx-c8cr-6j8q.md)
  `GHSA-83rx-c8cr-6j8q` · npm `tesseract.js`: affected `<1.0.19`, fixed in `1.0.19` · CVSS 5.9 Medium · Not analysed yet · Published 5 Jun 2019 · Tags: CWE-829
- [Cleartext Transmission of Sensitive Information, Inclusion of Functionality from Untrusted Control Sphere , and Download of Code Without Integrity Check in Eclipse hawkBit](https://agentprime.io/advisories/GHSA-jwqm-c9f2-2cq3.md)
  `GHSA-jwqm-c9f2-2cq3`, `CVE-2019-10240` · Maven `org.eclipse.hawkbit:hawkbit-autoconfigure` and 9 more: affected `<0.3.0M2`, fixed in `0.3.0M2` · CVSS 8.1 High · Not analysed yet · Published 15 Apr 2019 · Tags: Weak cryptography or TLS, CWE-494, CWE-829
- [Moderate severity vulnerability that affects org.springframework:spring-core](https://agentprime.io/advisories/GHSA-f26x-pr96-vw86.md)
  `GHSA-f26x-pr96-vw86`, `CVE-2018-11040` · Maven `org.springframework:spring-core`: affected `>=5.0.0.RELEASE, <5.0.7.RELEASE || >=4.3.0.RELEASE, <4.3.18.RELEASE`, fixed in `5.0.7.RELEASE`, `4.3.18.RELEASE` · CVSS 5.9 Medium · Not analysed yet · Published 16 Oct 2018 · Tags: CWE-829
- [procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top.](https://agentprime.io/advisories/CVE-2018-1122.md)
  `CVE-2018-1122` · CVE record: \[UNKNOWN\] procps-ng, procps · CVSS 7.3 High · Not analysed yet · Published 23 May 2018 · Tags: CWE-829

Newest: <https://agentprime.io/advisories/tag/cwe-829.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-829&cursor=WyIyMDIyLTA1LTI0VDIyOjAxOjA0LjAwMDAwMFoiLCJHSFNBLTR2MnEtaGp4My1jNHZyIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-829/?cursor=WyIyMDIyLTA1LTI0VDIyOjAxOjA0LjAwMDAwMFoiLCJHSFNBLTR2MnEtaGp4My1jNHZyIl0>. Everything for agents: <https://agentprime.io/llms.txt>.