CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
baseThe product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (295)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-0230US | critical9.8 | Exploit | ||
Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. | ||||
| CVE-2024-53677US | critical9.8 | Exploit | ||
File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a mali… | ||||
| CVE-2019-11358US | medium6.1 | Exploit | ||
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source ob… | ||||
| CVE-2020-7774US | critical9.8 | — | ||
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution. | ||||
| CVE-2006-5792US | high7.5 | Exploit | ||
Unspecified vulnerability in XLink Omni-NFS Enterprise allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by vd_xlink2.pm, an "Omni-NFS Ente… | ||||
| CVE-2024-5452US | critical9.8 | Exploit | ||
A remote code execution (RCE) vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement… | ||||
| CVE-2006-2842US | high7.5 | Exploit | ||
PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if register_globals is enabled and magic_quotes_gpc is disabled, allows remote at… | ||||
| CVE-2013-2324US | high10.0 | — | ||
Unspecified vulnerability in HP Storage Data Protector 6.20, 6.21, 7.00, and 7.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1629. | ||||
| CVE-2005-0511US | high7.5 | Exploit | ||
misc.php for vBulletin 3.0.6 and earlier, when "Add Template Name in HTML Comments" is enabled, allows remote attackers to execute arbitrary PHP code via nested variables in the te… | ||||
| CVE-2020-7699US | critical9.8 | Exploit | ||
This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execu… | ||||
| CVE-2007-2374US | high9.3 | — | ||
Unspecified vulnerability in Microsoft Windows 2000, XP, and Server 2003 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors. NOTE: this inform… | ||||
| CVE-2019-14379US | critical9.8 | — | ||
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionM… | ||||
| CVE-2000-0136US | high7.5 | Exploit | ||
The Cart32 shopping cart application allows remote users to modify sensitive purchase information via hidden form fields. | ||||
| CVE-2022-21824US | high8.2 | — | ||
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing… | ||||
| CVE-2021-23449US | critical10.0 | — | ||
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host machine. | ||||
| CVE-2020-24914US | critical9.8 | — | ||
A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticat… | ||||
| CVE-2020-7746US | critical9.8 | — | ||
This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options (or the d… | ||||
| CVE-2020-11066US | critical10.0 | — | ||
In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, calling unserialize() on malicious user-submitted content… | ||||
| CVE-2006-0164US | high7.5 | Exploit | ||
phgstats.inc.php in phgstats before 0.5.1, if register_globals is enabled, allows remote attackers to include arbitrary files and execute arbitrary PHP code by modifying the PHGDIR… | ||||
| CVE-2026-34208US | critical10.0 | — | ||
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks direct assignment to global objects (for example Math.random = ...), but this protection can be bypa… | ||||
04
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan