CWE-829

A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the cryp

IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions. This a

A local file inclusion vulnerability was discovered in the captcha function in Monstra 3.0.4 which allows remote attacke

A local file inclusion (LFI) vulnerability exists in the options.php script functionality of Advantech R-SeeNet v 2.4.12

The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0

Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user pro

IBM Maximo for Civil Infrastructure 7.6.2 includes executable functionality (such as a library) from a source that is ou

Inappropriate implementation in Offline in Google Chrome on Android prior to 90.0.4430.212 allowed a remote attacker who

The wp-publications WordPress plugin is vulnerable to restrictive local file inclusion via the Q_FILE parameter found in

An issue was discovered in Quadbase EspressReports ES 7 Update 9. An authenticated user is able to navigate to the MenuP

PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is inje

An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to th

In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/

iDrive RemotePC before 7.6.48 on Windows allows privilege escalation. A local and low-privileged user can force RemotePC

NVIDIA DCGM, all versions prior to 2.2.9, contains a vulnerability in the DIAG module where any user can inject shared l

A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently

SAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion. The samples library (included by default) in the app

It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to ex

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted tex

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL

In webERP 4.15, the ManualContents.php file allows users to specify the "Language" parameter, which can lead to local fi

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5, under specific circum

Semi-authenticated local file inclusion The contents of arbitrary files can be returned by the webserver Example request

In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascr

nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud N

Cross-site script inclusion vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier, NVR510 Rev.15.01.18 and ear

A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attack

Gallery Plugin1.4 for WordPress has a Remote File Include Vulnerability

An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attack

ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a file inclusion vulnerability. Successful exploitation co

An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. imgproxy in plugins/af_proxy_http/init.php mish

An issue was discovered in DigDash 2018R2 before p20200528, 2019R1 before p20200421, and 2019R2 before p20200430. It all

NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to include arbitrary files through specially cra

An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Servi

The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to

The (1) create_branch, (2) create_tag, (3) import_project, and (4) fork_project functions in lib/gitlab_projects.rb in G

A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19. This client-side attack requires use

Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration s

In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this

The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third

Maccms 10 allows remote attackers to execute arbitrary PHP code by entering this code in a template/default_pc/html/art

The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, wi

The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action paramet

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An

Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HT

Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. An

All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artif

In Eclipse Buildship versions prior to 3.1.1, the build files indicate that this project is resolving dependencies over

An issue was discovered in LibreNMS through 1.47. Several of the scripts perform dynamic script inclusion via the includ

The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion.