Sign in Sign up
JA · EN · FR
SecPulse

Cwe 94

🧬 CWE Related 1,871
slug: cwe-94

Explanation

CWE-94は「攻撃者が送ったデータが、プログラムコードとして解釈・実行されてしまう」欠陥です。 Pythonの `eval()`・PHPの `eval()`/`include()` にユーザー入力を渡すような実装が典型例です。 リモートコード実行 (RCE) の直接的な原因となるため、最も重大なクラスの脆弱性です。
📌 Example
Log4Shell (CVE-2021-44228) はLog4jのJNDI Lookupを悪用したコードインジェクションで、世界中のJavaサーバーが数日でハッキングされた。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 1,872

Image ID Title
CVE-2022-41223 KEV [KEV] Code Injection in Mitel MiVoice Connect (CVE-2022-41223)
CVE-2023-21553 Code Injection in Azure DevOps Server (CVE-2023-21553)
CVE-2022-44702 Code Injection in Windows Terminal (CVE-2022-44702)
CVE-2022-44087 Code Injection in Ecisp (CVE-2022-44087)
CVE-2022-44088 Code Injection in Ecisp (CVE-2022-44088)
CVE-2022-44089 Code Injection in Ecisp (CVE-2022-44089)
CVE-2022-41061 Code Injection in Microsoft Office (CVE-2022-41061)
CVE-2022-3236 KEV [KEV] Code Injection in Sophos Firewall (CVE-2022-3236)
CVE-2022-37053 Code Injection in TRENDnet TEW733GR (CVE-2022-37053)
CVE-2022-22963 KEV [KEV] Code Injection in VMware Tanzu Spring Cloud (CVE-2022-22963)
CVE-2022-36262 Code Injection in taocms (CVE-2022-36262)
CVE-2022-37009 Code Injection in JetBrains IntelliJ IDEA (CVE-2022-37009)
CVE-2022-34821 Code Injection in RUGGEDCOM RM1224 LTE(4G) EU (CVE-2022-34821)
CVE-2009-1862 KEV [KEV] Code Injection in Adobe Acrobat and Reader, Flash Player (CVE-2009-1862)
CVE-2009-0557 KEV [KEV] Code Injection in Microsoft Office (CVE-2009-0557)
CVE-2014-4148 KEV [KEV] Code Injection in Microsoft Windows (CVE-2014-4148)
CVE-2021-41653 Code Injection in Tp Link Tl Wr840N Firmware (CVE-2021-41653)
CVE-2020-17091 Code Injection in Microsoft Teams (CVE-2020-17091)
CVE-2022-22947 KEV [KEV] Code Injection in VMware Spring Cloud Gateway (CVE-2022-22947)
CVE-2022-22954 KEV [KEV] Code Injection in VMware Workspace ONE Access and Identity Manager (CVE-2022-22954)
CVE-2018-7602 KEV [KEV] Code Injection in Drupal Core (CVE-2018-7602)
CVE-2021-40219 Code Injection in Bolt (CVE-2021-40219)
CVE-2022-22965 KEV [KEV] Code Injection in VMware Spring Framework (CVE-2022-22965)
CVE-2018-1273 KEV [KEV] Code Injection in VMware Tanzu Spring Data Commons (CVE-2018-1273)
CVE-2014-6287 KEV [KEV] Code Injection in Rejetto HTTP File Server (HFS) (CVE-2014-6287)
CVE-2013-4810 KEV [KEV] Code Injection in Hewlett Packard (HP) ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management (CVE-2013-4810)
CVE-2009-1151 KEV [KEV] Code Injection in phpMyAdmin (CVE-2009-1151)
CVE-2022-25578 Code Injection in taocms (CVE-2022-25578)
CVE-2022-24512 Code Injection in Microsoft.NETCore.App.Runtime.linux-arm (CVE-2022-24512)
CVE-2020-8218 KEV [KEV] Code Injection in Pulse Secure Pulse Connect Secure (CVE-2020-8218)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details