CWE-707 Improper Neutralization
pillarThe product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
01
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
02
Schwachstellen (319)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-26633US | —OT kritisch | KEV | ||
Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally. | ||||
| CVE-2024-43572US | —OT kritisch | KEV | ||
Microsoft Management Console Remote Code Execution Vulnerability | ||||
| CVE-2017-6884US | high8.8OT kritisch | KEV | ||
A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic tools, specifically… | ||||
| CVE-2024-10914US | critical9.8 | Exploit | ||
A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability is the function cgi_us… | ||||
| CVE-2023-41892US | critical9.8 | Exploit | ||
Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to upd… | ||||
| CVE-2024-10915US | critical9.8 | Exploit | ||
A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been rated as critical. Affected by this issue is the function cgi_user_add of t… | ||||
| CVE-2024-8522US | high7.5 | Exploit | ||
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint… | ||||
| CVE-2024-12828US | high8.8 | Exploit | ||
Webmin CGI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Webmin. Authenti… | ||||
| CVE-2024-1781US | critical9.8 | Exploit | ||
A vulnerability was found in Totolink X6000R AX3000 9.4.0cu.852_20230719. It has been rated as critical. This issue affects the function setWizardCfg of the file /cgi-bin/cstecgi.c… | ||||
| CVE-2022-4257US | critical9.8 | — | ||
A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component… | ||||
| CVE-2024-7464US | critical9.8 | — | ||
A vulnerability, which was classified as critical, has been found in TOTOLINK CP900 6.3c.566. This issue affects the function setTelnetCfg of the component Telnet Service. The mani… | ||||
| CVE-2022-3801US | high8.8 | — | ||
A vulnerability, which was classified as critical, was found in IBAX go-ibax. This affects an unknown part of the file /api/v2/open/rowsInfo. The manipulation of the argument order… | ||||
| CVE-2025-53771US | — | Exploit | ||
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2023-44693US | critical9.8 | — | ||
D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /importexport.php. | ||||
| CVE-2015-9251US | medium6.1 | Exploit | ||
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses… | ||||
| CVE-2023-51385US | medium6.5 | Exploit | ||
In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain si… | ||||
| CVE-2024-29201US | critical9.9 | — | ||
JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpServer's Ansible to exe… | ||||
| CVE-2026-20330US | critical9.9 | — | ||
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Softwar… | ||||
| CVE-2023-33377US | critical9.8 | — | ||
Connected IO v2.1.0 and prior has an OS command injection vulnerability in the set firewall command in part of its communication protocol, enabling attackers to execute arbitrary O… | ||||
| CVE-2022-4375US | critical9.8 | — | ||
A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the… | ||||
03
Angriffsmuster (16)
CAPEC-Angriffsmuster, die dies ausnutzen.
04
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan