Weakness (CWE)
CWE-914: Improper Control of Dynamically-Identified Variables
The product does not properly restrict reading from or writing to dynamically-identified variables.
How to prevent it (2 mitigations)
-
Implementation
For any externally-influenced input, check the input against an allowlist of internal program variables that are allowed to be modified.
-
Implementation, Architecture and Design
Refactor the code so that internal program variables do not need to be dynamically identified.
Source: MITRE CWE-914
4 results · Clear filters · Feed
-
High 7.3
YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution
YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts t…
-
High 7.9CVE-2026-34444 Public exploit
Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr
Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended rest…
-
High 8.5
Information Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP
In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be…
-
High 8.0
Authenticated Gaia users can inject code or commands by global variables through special HTTP requests. A Security fix …