CWE-15 External Control of System or Configuration Setting
baseOne or more system settings or configuration elements can be externally controlled by a user.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (110)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-6973US | —OT kritisch | KEV | ||
An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code… | ||||
| CVE-2023-50252US | critical9.8 | — | ||
php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling `<use>` tag that references an `<image>` tag, it merges the attributes from the `<use>… | ||||
| CVE-2026-44774US | critical9.9 | — | ||
Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik's Kubernetes Gateway API provider allows a tenant with HTTPRoute creation permissio… | ||||
| CVE-2026-41176US | critical9.8OT erhöht | — | ||
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`,… | ||||
| CVE-2026-32056US | critical9.8 | — | ||
OpenClaw versions prior to 2026.2.22 fail to sanitize shell startup environment variables HOME and ZDOTDIR in the system.run function, allowing attackers to bypass command allowlis… | ||||
| CVE-2026-22708US | critical9.8 | — | ||
Cursor is a code editor built for programming with AI. Prior to 2.3, hen the Cursor Agent is running in Auto-Run Mode with Allowlist mode enabled, certain shell built-ins can still… | ||||
| CVE-2025-1098US | — | Exploit | ||
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject… | ||||
| CVE-2024-51544US | high8.2 | — | ||
Service Control vulnerabilities allow access to service restart requests and vm configuration settings.
Affected products:
ABB ASPECT - Enterprise v3.08.02;
NEXUS Series v3.08.… | ||||
| CVE-2024-10979US | high8.8 | — | ||
Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suf… | ||||
| CVE-2023-43323US | medium6.5 | Exploit | ||
mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP and DNS request to external server. The Parameters effected a… | ||||
| CVE-2021-38453US | critical9.1 | — | ||
Some API functions allow interaction with the registry, which includes reading values as well as data modification. | ||||
| CVE-2026-43531US | high8.8 | — | ||
OpenClaw before 2026.4.9 contains an environment variable injection vulnerability allowing malicious workspace .env files to set runtime-control variables. Attackers can inject var… | ||||
| CVE-2026-35650US | high8.8 | — | ||
OpenClaw before 2026.3.22 contains an environment variable override handling vulnerability that allows attackers to bypass the shared host environment policy through inconsistent s… | ||||
| CVE-2026-22177US | high8.8 | — | ||
OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment variables from config env.vars, allowing startup-time code execution. Attackers can inject… | ||||
| CVE-2026-4039US | high8.8 | — | ||
A vulnerability was determined in OpenClaw 2026.2.19-2. This vulnerability affects the function applySkillConfigenvOverrides of the component Skill Env Handler. Executing a manipul… | ||||
| CVE-2025-27889US | high8.8 | — | ||
Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link. If a user clicks… | ||||
| CVE-2023-46248US | high8.8 | — | ||
Cody is an artificial intelligence (AI) coding assistant. The Cody AI VSCode extension versions 0.10.0 through 0.14.0 are vulnerable to Remote Code Execution under certain conditio… | ||||
| CVE-2023-3321US | high8.8 | — | ||
A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit the vulnerability by… | ||||
| CVE-2023-32349US | high8.8 | — | ||
Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter parameters. However, variables for validat… | ||||
| CVE-2021-27406US | high8.8 | — | ||
An attacker can take leverage on PerFact OpenVPN-Client versions 1.4.1.0 and prior to send the config command from any application running on the local host machine to force the ba… | ||||
03
Angriffsmuster (10)
CAPEC-Angriffsmuster, die dies ausnutzen.
04
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan