Improper Control of Dynamically-Identified Variables
CWE-914
The product does not properly restrict reading from or writing to dynamically-identified variables.
We track 7 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.8.
How this weakness is prevented
- Implementation: For any externally-influenced input, check the input against an allowlist of internal program variables that are allowed to be modified.
- Implementation Architecture and Design: Refactor the code so that internal program variables do not need to be dynamically identified.
Latest Improper Control of Dynamically-Identified Variables vulnerabilities
- 10.0 Critical severity
vm2: Improper Control of Generation of Code
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.
- 10.0 Critical severity
lupa: Improper Access Control
Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restr
- 8.8 High severity
youlai-mall: Improper Control of Dynamically-Managed Code Resources
A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0. This impacts an unknown function of the file /app-api/v1/orders/. The manipulation of the argument orderId leads to improper control of dynamically-identified variables. Remote exploitation
- 8.8 High severity
youlai-mall: Improper Control of Dynamically-Managed Code Resources
A flaw has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function getById/updateAddress/deleteAddress of the file /mall-ums/app-api/v1/addresses/. Executing manipulation can lead to improper control of dynamically-identified variables. The
- 8.5 High severity
SAP NetWeaver Application Server ABAP: Improper Control of Dynamically-Identified Variables
In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be
- 8.0 High severity
ClusterXL, Multi-Domain Security Management…: Improper Control of Dynamically-Identified Variables
Authenticated Gaia users can inject code or commands by global variables through special HTTP requests. A Security fix that mitigates this vulnerability is available.
- 7.5 High severity
ToUI: Improper Control of Dynamically-Managed Code Resources
ToUI is a Python package for creating user interfaces (websites and desktop apps) from HTML. ToUI is using Flask-Caching (SimpleCache) to store user variables. Websites that use `Website.user_vars` property. It affects versions 2.0.1 to 2.4.0. This issue has b