TYPE DE FAIBLESSE

CWE-913

32 CVE, des plus récentes aux plus anciennes. Définition MITRE de CWE-913 (en anglais) →

CVE-2026-118538A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer.… 5.1 MOYENNE

CVE-2026-102734Les applications Python utilisant la bibliothèque `asteval` (versions antérieures à 1.0.9) avec NumPy activé sont concernées. Un attaquant capable de convaincre un utilisateur d'ex… 5.5 MOYENNE

CVE-2026-108819Les versions d'Agno-agi jusqu'à 3.0.6 et 3.1.1 sont affectées par une faille dans la fonction `exec` de la couche d'orchestration des agents (Agent Orchestration Layer). Un attaqua… 5.5 MOYENNE

CVE-2026-92217Le logiciel a2ui-project (jusqu'à la version 0.10.6) présente une vulnérabilité dans sa manière de traiter les messages. Un attaquant disposant d'identifiants d'utilisateur valides… 5.3 MOYENNE

CVE-2026-48775Les applications LangGraph utilisant SQLite pour le checkpointing sont affectées si un attaquant obtient un accès administratif de haut niveau aux fichiers de la base de données so… 6.8 MOYENNE

CVE-2026-1770Crafter Studio, au sein de Crafter CMS, est affecté par une faille qui permet à un utilisateur disposant de permissions de niveau développeur de contourner le bac à sable (sandboxi… 4.5 MOYENNE

CVE-2024-5401Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-7280… 4.3 MOYENNE

CVE-2025-26405Improper control of dynamically-managed code resources for some Intel(R) NPU Drivers within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary… 5.1 MOYENNE

CVE-2025-61780Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, a possible information disclosure vulnerability existed in `Rack::Sendfile` when running b… 5.8 MOYENNE

CVE-2025-46673NASA CryptoLib before 1.3.2 does not check whether the SA is in an operational state before use, possibly leading to a bypass of the Space Data Link Security protocol (SDLS). 4.9 MOYENNE

CVE-2024-2537Improper Control of Dynamically-Managed Code Resources vulnerability in Logitech Logi Tune on MacOS allows Local Code Inclusion. 4.4 MOYENNE

CVE-2023-6184Cross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site Scripting 5.0 MOYENNE

CVE-2023-5763In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or < 7u201, or < 8u191), allows remote attackers to load malicious code on the server via access to… 6.8 MOYENNE

CVE-2023-39983A vulnerability that poses a potential risk of polluting the MXsecurity sqlite database and the nsm-web UI has been identified in MXsecurity versions prior to v1.0.1. This vulnerab… 5.3 MOYENNE

CVE-2022-40635Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypa… 6.4 MOYENNE

CVE-2022-40634Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI. 6.4 MOYENNE

CVE-2022-39051Attacker might be able to execute malicious Perl code in the Template toolkit, by having the admin installing an unverified 3th party package 6.8 MOYENNE

CVE-2022-27889The Multipass service was found to have code paths that could be abused to cause a denial of service for authentication or authorization operations. A malicious attacker could perf… 5.3 MOYENNE

CVE-2022-25355EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version o… 5.3 MOYENNE

CVE-2021-42809Improper Access Control of Dynamically-Managed Code Resources (DLL) in Thales Sentinel Protection Installer could allow the execution of arbitrary code. 6.5 MOYENNE

CVE-2021-23262Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE. 4.2 MOYENNE

CVE-2021-23259Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have securi… 4.2 MOYENNE

CVE-2021-23258Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which wil… 4.2 MOYENNE

CVE-2021-32813Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.4.13, there exists a potential header vulnerability in Traefik's handling of the Connection header. Active ex… 4.8 MOYENNE

CVE-2021-26276scripts/cli.js in the GoDaddy node-config-shield (aka Config Shield) package before 0.2.2 for Node.js calls eval when processing a set command. NOTE: the vendor reportedly states t… 5.3 MOYENNE

CVE-2020-3419A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to join a Webex session without appearing on the participant… 6.5 MOYENNE

CVE-2020-25803Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker template… 4.2 MOYENNE

CVE-2020-25802Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy scripting. T… 4.2 MOYENNE

CVE-2020-15372A vulnerability in the command-line interface in Brocade Fabric OS before Brocade Fabric OS v8.2.2a1, 8.2.2c, v7.4.2g, v8.2.0_CBN3, v8.2.1e, v8.1.2k, v9.0.0, could allow a local au… 5.5 MOYENNE

CVE-2020-4100"HCL Verse for Android was found to employ dynamic code loading. This mechanism allows a developer to specify which components of the application should not be loaded by default wh… 4.4 MOYENNE

CVE-2019-15006There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center. This plugin was used to facilitate com… 6.5 MOYENNE

CVE-2018-19836In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php allows registering variables from the $_COO… 6.1 MOYENNE