Improper Control of Dynamically-Managed Code Resources
CWE-913
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
We track 66 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 9.1. 1 has been exploited in real attacks.
How this weakness is prevented
- Implementation: For any externally-influenced input, check the input against an allowlist of acceptable values.
- Implementation Architecture and Design: Refactor the code so that it does not need to be dynamically managed.
Latest Improper Control of Dynamically-Managed Code Resources vulnerabilities
- 7.9 High severity
gzdoom: Improper Control of Dynamically-Managed Code Resources
GZDoom is a feature centric port for all Doom engine games. GZDoom is an open source Doom engine. In versions 4.14.2 and earlier, ZScript actor state handling allows scripts to read arbitrary addresses, write constants into the JIT-compiled code section, and r
- 7.3 High severity
Keras: Improper Control of Dynamically-Managed Code Resources
The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .h5/.hdf5 model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed. Thi
- 9.1 Critical severity
CrafterCMS: Improper Control of Dynamically-Managed Code Resources
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass Sandbox restri
- 9.9 Critical severity
CryptoLib: Improper Control of Dynamically-Managed Code Resources
NASA CryptoLib before 1.3.2 does not check whether the SA is in an operational state before use, possibly leading to a bypass of the Space Data Link Security protocol (SDLS).
- 7.5 High severity
Drupal core: Improper Control of Dynamically-Managed Code Resources
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11
- 9.8 Critical severity
composiohq/composio: Improper Control of Dynamically-Managed Code Resources
In composiohq/composio version 0.4.3, the mathematical_calculator endpoint uses the unsafe eval() function to perform mathematical operations. This can lead to arbitrary code execution if untrusted input is passed to the eval() function.
- 8.5 High severity
Apache ShardingSphere ElasticJob-UI: Improper Control of Dynamically-Managed Code Resources
The Lite UI of Apache ShardingSphere ElasticJob-UI allows an attacker to perform RCE by constructing a special JDBC URL of H2 database. This issue affects Apache ShardingSphere ElasticJob-UI version 3.0.1 and prior versions. This vulnerability has been fixed i
- 8.8 High severity
Langflow: Improper Control of Dynamically-Managed Code Resources
Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged attacker to gain super admin privileges by performing a mass assignment request on the '/api/v1/users' endpoint.
- 9.8 Critical severity
lightning-ai/pytorch-lightning: Improper Control of Dynamically-Managed Code Resources
A remote code execution (RCE) vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement of dunder attributes by the `deepdiff` library. The library uses `deepdiff.Delt
- 9.9 Critical severity
Improper input validation in the Pulsar Function Worker allows a malicious authenticated user…
Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, outside of the sandboxes designated for running user-provided functions. This vulnerability also applies
- 8.8 High severity
Apache Solr: Unrestricted Upload of File with Dangerous Type
Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0
- 9.8 Critical severity
Glassfish: Improper Control of Dynamically-Managed Code Resources
In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or < 7u201, or < 8u191), allows remote attackers to load malicious code on the server via access to insecure ORB listeners.
- 7.8 High severity
Red Hat OpenShift Container Platform 4.11: Improper Control of Dynamically-Managed Code Resources
A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.
- 9.8 Critical severity
Gecko Bootloader: Buffer Copy without Checking Size of Input
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon Labs Gecko Bootloader on ARM (Firmware Update File Parser modules) allows Code Injection, Authenticat
- 9.9 Critical severity
RestrictedPython: Improper Control of Dynamically-Managed Code Resources
RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment. RestrictedPython does not check access to stack frames and their attributes. Stack frames are accessible w
- 7.5 High severity
ToUI: Improper Control of Dynamically-Managed Code Resources
ToUI is a Python package for creating user interfaces (websites and desktop apps) from HTML. ToUI is using Flask-Caching (SimpleCache) to store user variables. Websites that use `Website.user_vars` property. It affects versions 2.0.1 to 2.4.0. This issue has b
- 10.0 Critical severity
vm2: Improper Control of Dynamically-Managed Code Resources
There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass `handleException()` and leak unsanitized host exceptions which can be used to escape the sandbox and run arbit
- 9.8 Critical severity
vm2: Improper Control of Dynamically-Managed Code Resources
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the sa
- 9.8 Critical severity
node-sqlite3: Improper Control of Dynamically-Managed Code Resources
A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can lead to arbitrary code execution. An attacker can provide malicious input to trigger this vulnerabilit
- 9.8 Critical severity
datahub: Improper Control of Dynamically-Managed Code Resources
DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or requesting access tokens, crafts multiple JSON strings using format strings with user-controlled data
- 9.8 Critical severity
Backclick: Missing Authentication for Critical Functionality
An issue was discovered in BACKCLICK Professional 5.9.63. Due to an exposed internal communications interface, it is possible to execute arbitrary system commands on the server.
- 7.2 High severity
Crafter CMS: Improper Control of Dynamically-Managed Code Resources
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.
- 7.2 High severity
Crafter CMS: Improper Control of Dynamically-Managed Code Resources
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI.
- 10.0 Critical severity
vm2: Improper Control of Dynamically-Managed Code Resources
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerabili
- 9.1 Critical severity
Foundry Multipass: Improper Control of Dynamically-Managed Code Resources
The Multipass service was found to have code paths that could be abused to cause a denial of service for authentication or authorization operations. A malicious attacker could perform an application-level denial of service attack, potentially causing authentic
- 7.8 High severity
Linux Kernel: Improper Control of Dynamically-Managed Code Resources
In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 (e.g., with GCC 3.2.2 and Linux kernel 2.4.20). This can cause execution of bytes located in supposedly non-executable regions of