cve.bz

CWE-829: Inclusion of Functionality from Untrusted Control Sphere, page 7

Filter

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

What the weakness is: CWE-829 at MITRE

Related attack patterns (CAPEC): 13
  • CAPEC-175 Code Inclusion Likelihood: Medium · Severity: Very High
  • CAPEC-201 Serialized Data External Linking Likelihood: High · Severity: High
  • CAPEC-228 DTD Injection Severity: Medium
  • CAPEC-251 Local Code Inclusion Severity: Medium
  • CAPEC-252 PHP Local File Inclusion Severity: Medium
  • CAPEC-253 Remote Code Inclusion
  • CAPEC-263 Force Use of Corrupted Files Severity: Medium
  • CAPEC-538 Open-Source Library Manipulation Likelihood: Low · Severity: High
  • CAPEC-549 Local Execution of Code Likelihood: Medium · Severity: High
  • CAPEC-640 Inclusion of Code in Existing Process Likelihood: Low · Severity: High
  • CAPEC-660 Root/Jailbreak Detection Evasion via Hooking Likelihood: Medium · Severity: Very High
  • CAPEC-695 Repo Jacking Likelihood: Medium · Severity: High
  • CAPEC-698 Install Malicious Extension Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-829, as MITRE names them. Credits.

Ask an AI about CWE-829

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-829: Inclusion of Functionality from Untrusted Control Sphere and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/829.html and https://cve.bz/cve/cwe/829?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.4CVE-2022-31156EPSS 0.6%

    Gradle is a build tool. Dependency verification is a security feature in Gradle Build Tool that was introduced to allow validation of external dependencies either through their checksum or cryptographic signatures. In versions 6.2 through …

  2. 8.0CVE-2021-41037EPSS 0.8%

    In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installation. Those touchpoints can, for example, alter the command-line used to start the application, injec…

  3. 8.8CVE-2021-4229EPSS 1.5%

    A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this i…

  4. 6.5CVE-2022-29845ExploitEPSS 4.2%

    In Progress Ipswitch WhatsUp Gold 21.1.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would allow them to read the contents of a local file.

  5. 5.3CVE-2022-24824EPSS 1.0%

    Discourse is an open source platform for community discussion. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the users are shown the crawler view of the site instead of the HTML p…

  6. 9.8CVE-2022-1161EPSS 5.2%

    An attacker with the ability to modify a user program may change user program code on some ControlLogix, CompactLogix, and GuardLogix Control systems. Studio 5000 Logix Designer writes user-readable program code to a separate location than…

  7. 7.8CVE-2022-25486ExploitEPSS 10.0%

    CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertConfigField.php.

  8. 7.8CVE-2022-25485ExploitEPSS 7.9%

    CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php.

  9. 5.3CVE-2022-24329EPSS 2.2%

    In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.

  10. 7.8CVE-2022-24232EPSS 1.5%

    A local file inclusion in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.

  11. 7.8CVE-2022-22308EPSS 0.7%

    IBM Planning Analytics 2.0 is vulnerable to a Remote File Include (RFI) attack. User input could be passed into file include commands and the web application could be tricked into including remote files with malicious code. IBM X-Force ID:…

  12. 7.5CVE-2022-23630EPSS 1.3%

    Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, Gradle may skip that verification and accept a dependency that would otherwise fail the build as an untrusted external artif…

  13. 8.2CVE-2021-41841EPSS 0.3%

    An issue was discovered in AhciBusDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System Management Mode and execute arbitrary code. This occurs because of Inclusion of F…

  14. 8.1CVE-2021-42133EPSS 2.9%

    An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform an arbitrary file write.

  15. 4.7CVE-2021-29113EPSS 0.8%

    A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attacker to inject attacker supplied html into a page.

  16. 7.1CVE-2021-41256EPSS 1.1%

    nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issue by which a malicious application installed on the same device can send it an a…

  17. 5.4CVE-2021-20843EPSS 0.7%

    Cross-site script inclusion vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier, NVR510 Rev.15.01.18 and earlier, NVR700W Rev.15.00.19 and earlier, and RTX1210 Rev.14.01.38 and earlier allows a remote authenticated attacker to …

  18. 7.5CVE-2021-41569ExploitEPSS 8.0%

    SAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion. The samples library (included by default) in the appstart.sas file, allows end-users of the application to access the sample.webcsf1.sas program, which contains user-contr…

  19. 9.8CVE-2020-16152ExploitEPSS 36%

    The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP code as the root user via remote HTTP requests that insert this code into a log fil…

  20. 7.8CVE-2021-33626EPSS 0.3%

    A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer(QWORD values for CommBuffer). This can be used by an attacker to corrupt…

  21. 9.8CVE-2021-38360EPSS 2.3%

    The wp-publications WordPress plugin is vulnerable to restrictive local file inclusion via the Q_FILE parameter found in the ~/bibtexbrowser.php file which allows attackers to include local zip files and achieve remote code execution, in v…

  22. 9.8CVE-2021-32802EPSS 2.6%

    Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user provided file content. For some image types, the Nextcloud server was invoking a third-party library that wasn't suited fo…

  23. 7.8CVE-2021-34398EPSS 0.3%

    NVIDIA DCGM, all versions prior to 2.2.9, contains a vulnerability in the DIAG module where any user can inject shared libraries into the DCGM server, which is usually running as root, which may lead to privilege escalation, total loss of …

  24. 9.8CVE-2021-21804EPSS 3.7%

    A local file inclusion (LFI) vulnerability exists in the options.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted HTTP request can lead to arbitrary PHP code execution. An attacker can send a crafte…

  25. 7.8CVE-2021-34692EPSS 0.3%

    iDrive RemotePC before 7.6.48 on Windows allows privilege escalation. A local and low-privileged user can force RemotePC to execute an attacker-controlled executable with SYSTEM privileges.

  26. 6.5CVE-2021-30121EPSS 5.0%

    Semi-authenticated local file inclusion The contents of arbitrary files can be returned by the webserver Example request: `https://x.x.x.x/KLC/js/Kaseya.SB.JS/js.aspx?path=C:\Kaseya\WebPages\dl.asp` A valid sessionId is required but can be…

  27. 6.5CVE-2021-29777EPSS 1.4%

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5, under specific circumstance of a table being dropped while being accessed in another session, could allow an authenticated user to cause a d…

  28. 9.8CVE-2020-25414EPSS 2.0%

    A local file inclusion vulnerability was discovered in the captcha function in Monstra 3.0.4 which allows remote attackers to execute arbitrary PHP code.

  29. 8.1CVE-2021-3603EPSS 2.3%

    PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the $patternselect parameter to validateAddress() is set to 'php…

  30. 8.8CVE-2021-30507EPSS 1.1%

    Inappropriate implementation in Offline in Google Chrome on Android prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.

  31. 10.0CVE-2020-4561EPSS 2.9%

    IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions. This allows a remote attacker who can access a valid CA endpoint to read and write files to the Cognos Analytics system. IBM …

  32. 7.2CVE-2021-29427EPSS 1.3%

    In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning. Repository content filtering is a security control Gradle introduced to help users specify wha…

  33. 8.1CVE-2020-24985EPSS 1.1%

    An issue was discovered in Quadbase EspressReports ES 7 Update 9. An authenticated user is able to navigate to the MenuPage section of the application, and change the frmsrc parameter value to retrieve and execute external files or payload…

  34. 6.1CVE-2021-28162EPSS 0.8%

    In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.

  35. 6.5CVE-2020-22474EPSS 1.0%

    In webERP 4.15, the ManualContents.php file allows users to specify the "Language" parameter, which can lead to local file inclusion.

  36. 8.8CVE-2021-20443EPSS 0.9%

    IBM Maximo for Civil Infrastructure 7.6.2 includes executable functionality (such as a library) from a source that is outside of the intended control sphere. IBM X-Force ID: 196619.

  37. 7.2CVE-2021-20187EPSS 1.6%

    It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP scripts via a PHP include used during Shibboleth authentication.

  38. 6.5CVE-2021-26272EPSS 2.4%

    It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).

  39. 6.5CVE-2021-26271EPSS 2.0%

    It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).

  40. 6.1CVE-2020-29072EPSS 0.7%

    A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19. This client-side attack requires user interaction (opening a link) and successful exploitation could lead to encrypted e-mail content leakage via messages/…

  41. 8.1CVE-2020-25788EPSS 1.2%

    An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. imgproxy in plugins/af_proxy_http/init.php mishandles $_REQUEST["url"] in an error message.

  42. 7.5CVE-2020-13175EPSS 1.7%

    The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 20, 2020 (v15 and earlier for Cloud Access Connector) contains a local file inclusion vulnerability which allows …

  43. 7.8CVE-2020-13651EPSS 0.9%

    An issue was discovered in DigDash 2018R2 before p20200528, 2019R1 before p20200421, and 2019R2 before p20200430. It allows a user to provide data that will be used to generate the JNLP file used by a client to obtain the right Java applic…

  44. 4.9CVE-2020-13977EPSS 2.7%

    Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram and Trends code via crafted versions of the archivejson.cgi, objectjson.cgi, and …

  45. 4.9CVE-2020-5295ExploitEPSS 7.4%

    In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to read local files of an October CMS server. The vulnerability is only exploitable by an authenticated b…

  46. 7.5CVE-2020-10865EPSS 1.7%

    An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to make arbitrary changes to the Components section of the Stats.ini file via RPC fr…

  47. 9.8CVE-2020-3794EPSS 7.1%

    ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a file inclusion vulnerability. Successful exploitation could lead to arbitrary code execution of files located in the webroot or its subdirectory.

  48. 9.8CVE-2020-8128EPSS 2.7%

    An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code.

  49. 7.5CVE-2013-3321EPSS 2.2%

    NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to include arbitrary files through specially crafted requests to the "diagnostic" page using the SnapMirror log path parameter.

  50. 6.5CVE-2013-4582EPSS 1.9%

    The (1) create_branch, (2) create_tag, (3) import_project, and (4) fork_project functions in lib/gitlab_projects.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 a…