Advisories · Weakness
CWE-829.
Every Advisory and CVE whose sources give the weakness CWE-829, newest first.
- CVSS 7.2 High
Moodle Arbitrary PHP code execution by site admins via Shibboleth configuration
- Code injection
- CWE-829
>=3.5, <3.5.16 || >=3.8, <3.8.7 || >=3.9, <3.9.4 || >=3.10, <3.10.1 · fixed in 3.5.16, 3.8.7, 3.9.4, 3.10.1
GHSA-2jrm-gww7-wch2 · CVE-2021-20187 - CVSS 8.1 High
Potentially compromised builds
- Weak cryptography or TLS
- CWE-494
<2.18.0 · fixed in 2.18.0
GHSA-rfj2-4g26-7jw5 · CVE-2019-10249 - CVSS 8.1 High
Eclipse Vorto resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS
- CWE-494
- CWE-669
<0.11.0 · fixed in 0.11.0
GHSA-fg2q-v428-2gph · CVE-2019-10248 - CVSS 8.1 High
Drupal Remote code execution
- CWE-829
>=8.0, <8.2.7 · fixed in 8.2.7
GHSA-rhx9-3qf7-r3j7 · CVE-2017-6381 - CVSS 5.3 Medium
Anonymous user cache poisoning in discourse
- discourse
- CWE-829
- CVSS 10.0 CriticalCritical · CVSS 9+
ICSA-22-090-05 Rockwell Automation Logix Controllers
- Rockwell Automation 1768 CompactLogix controllers
- Rockwell Automation 1769 CompactLogix controllers
- CWE-829
- CVSS 5.3 Medium
Improper Locking in JetBrains Kotlin
- CWE-667
- CWE-829
<1.6.0 · fixed in 1.6.0
GHSA-2qp4-g3q3-f92w · CVE-2022-24329 - CVSS 7.5 High
Dependency verification bypass in Gradle
- gradle
- CWE-829
- CVSS 5.8 Medium
Intent URI permissions manipulation in nextcloud news-android
- nextcloud news-android
- CWE-829
- CVSS 6.5 Medium
Inclusion of Functionality from Untrusted Control Sphere in CKEditor 4
- CWE-829
<4.16.0 · fixed in 4.16.0
GHSA-wpvm-wqr4-p7cw · CVE-2021-26272 - CVSS 9.3 CriticalCritical · CVSS 9+
Preview generation used third-party library not suited for user-generated content in Nextcloud server
- nextcloud security-advisories
- CWE-829
- CVSS 8.1 High
PHPMailer untrusted code may be run from an overridden address validator
- Other injection
- CWE-829
<6.5.0 · fixed in 6.5.0
GHSA-77mr-wc79-m8j3 · CVE-2021-3603 - CVSS 6.1 Medium
Command Injection in @theia/messages
- CWE-829
- CWE-830
<1.0.0 · fixed in 1.0.0
GHSA-c94v-8fff-73ph · CVE-2021-28162 - CVSS 8.0 High
Repository content filters do not work in Settings pluginManagement
- gradle
- CWE-829
- CVSS 9.8 CriticalCritical · CVSS 9+
Server-Side Request Forgery and Inclusion of Functionality from Untrusted Control Sphere in jsreport
- Server-side request forgery (SSRF)
- CWE-829
<2.6.0 · fixed in 2.6.0
GHSA-5fjj-cfh2-ghc5 · CVE-2020-8128 - CVSS 4.8 Medium
Local File read vulnerability in OctoberCMS
- File inclusion
- CWE-829
>=1.0.319, <1.0.466 · fixed in 1.0.466
GHSA-r23f-c2j5-rx2f · CVE-2020-5295 - CVSS 8.1 High
High severity vulnerability that affects generator-jhipster
- CWE-494
- CWE-829
<6.3.1 · fixed in 6.3.1
GHSA-mc84-xr9p-938r - CVSS 7.5 High
Unintended Require in larvitbase-api
- File inclusion
- CWE-829
<0.5.5 · fixed in 0.5.5
GHSA-xf27-jqwv-gf3r · CVE-2019-5479 - CVSS 9.8 CriticalCritical · CVSS 9+
paranoid2 gem Code backdoor
- CWE-829
=1.1.6 · no fixed version yet
GHSA-4g4c-8gqh-m4vm · CVE-2019-13589 -
The Eclipse Foundation Eclipse Buildship: In Eclipse Buildship versions prior to 3.1.1…
- The Eclipse Foundation Eclipse Buildship
- CWE-829
- CVSS 5.9 Medium
Insecure Default Configuration in tesseract.js
- CWE-829
<1.0.19 · fixed in 1.0.19
GHSA-83rx-c8cr-6j8q - CVSS 8.1 High
Cleartext Transmission of Sensitive Information, Inclusion of Functionality from Untrusted Control Sphere , and Download of Code Without Integrity Check in Eclipse hawkBit
- Weak cryptography or TLS
- CWE-494
<0.3.0M2 · fixed in 0.3.0M2
GHSA-jwqm-c9f2-2cq3 · CVE-2019-10240 - CVSS 5.9 Medium
Moderate severity vulnerability that affects org.springframework:spring-core
- CWE-829
>=5.0.0.RELEASE, <5.0.7.RELEASE || >=4.3.0.RELEASE, <4.3.18.RELEASE · fixed in 5.0.7.RELEASE, 4.3.18.RELEASE
GHSA-f26x-pr96-vw86 · CVE-2018-11040 - CVSS 7.3 High
procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top.
- [UNKNOWN] procps-ng, procps
- CWE-829