CWE-913
Allowed-with-ReviewImproper Control of Dynamically-Managed Code Resources
Abstraction: Class · Status: Incomplete
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
175 vulnerabilities reference this CWE, most recent first.
GHSA-X732-F4PC-FF5P
Vulnerability from github – Published: 2022-05-13 01:31 – Updated: 2022-05-13 01:31A vulnerability in the Fibre Channel over Ethernet (FCoE) N-port Virtualization (NPV) protocol implementation in Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. The vulnerability is due to an incorrect processing of FCoE packets when the fcoe-npv feature is uninstalled. An attacker could exploit this vulnerability by sending a stream of FCoE frames from an adjacent host to an affected device. An exploit could allow the attacker to cause packet amplification to occur, resulting in the saturation of interfaces and a DoS condition. Nexus 9000 Series Switches in Standalone NX-OS Mode are affected running software versions prior to 7.0(3)I7(5) and 9.2(2).
{
"affected": [],
"aliases": [
"CVE-2019-1617"
],
"database_specific": {
"cwe_ids": [
"CWE-913"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-03-11T21:29:00Z",
"severity": "HIGH"
},
"details": "A vulnerability in the Fibre Channel over Ethernet (FCoE) N-port Virtualization (NPV) protocol implementation in Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. The vulnerability is due to an incorrect processing of FCoE packets when the fcoe-npv feature is uninstalled. An attacker could exploit this vulnerability by sending a stream of FCoE frames from an adjacent host to an affected device. An exploit could allow the attacker to cause packet amplification to occur, resulting in the saturation of interfaces and a DoS condition. Nexus 9000 Series Switches in Standalone NX-OS Mode are affected running software versions prior to 7.0(3)I7(5) and 9.2(2).",
"id": "GHSA-x732-f4pc-ff5p",
"modified": "2022-05-13T01:31:30Z",
"published": "2022-05-13T01:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1617"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-npv-dos"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/107336"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X92G-49GH-63QM
Vulnerability from github – Published: 2022-09-17 00:00 – Updated: 2026-02-27 20:47Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@budibase/worker"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.20"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@budibase/builder"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.20"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@budibase/bbui"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.20"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-3225"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-913"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-03T16:41:39Z",
"nvd_published_at": "2022-09-16T17:15:00Z",
"severity": "MODERATE"
},
"details": "Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20.",
"id": "GHSA-x92g-49gh-63qm",
"modified": "2026-02-27T20:47:54Z",
"published": "2022-09-17T00:00:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3225"
},
{
"type": "WEB",
"url": "https://github.com/budibase/budibase/commit/d35864be0854216693a01307f81ffcabf6d549df"
},
{
"type": "WEB",
"url": "https://github.com/Budibase/budibase/releases/tag/v1.3.20"
},
{
"type": "PACKAGE",
"url": "https://github.com/budibase/budibase"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/a13a56b7-04da-4560-b8ec-0d637d12a245"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Budibase Improper Control of Dynamically-Managed Code Resources vulnerability"
}
GHSA-XGPM-XF5G-45M5
Vulnerability from github – Published: 2025-12-05 15:30 – Updated: 2025-12-05 15:30A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0. This impacts an unknown function of the file /app-api/v1/orders/. The manipulation of the argument orderId leads to improper control of dynamically-identified variables. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-14085"
],
"database_specific": {
"cwe_ids": [
"CWE-913"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-05T14:15:48Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0. This impacts an unknown function of the file /app-api/v1/orders/. The manipulation of the argument orderId leads to improper control of dynamically-identified variables. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-xgpm-xf5g-45m5",
"modified": "2025-12-05T15:30:26Z",
"published": "2025-12-05T15:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14085"
},
{
"type": "WEB",
"url": "https://github.com/Hwwg/cve/issues/23"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.334476"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.334476"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.695943"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-XH7P-RGF9-78JV
Vulnerability from github – Published: 2025-07-08 09:31 – Updated: 2025-07-08 09:31An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations.
{
"affected": [],
"aliases": [
"CVE-2025-25270"
],
"database_specific": {
"cwe_ids": [
"CWE-913"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-08T07:15:25Z",
"severity": "CRITICAL"
},
"details": "An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations.",
"id": "GHSA-xh7p-rgf9-78jv",
"modified": "2025-07-08T09:31:29Z",
"published": "2025-07-08T09:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25270"
},
{
"type": "WEB",
"url": "https://certvde.com/de/advisories/VDE-2025-019"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XJ72-WVFV-8985
Vulnerability from github – Published: 2023-04-12 20:42 – Updated: 2023-04-14 21:35There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass handleException() and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context.
Impact
A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.
Patches
This vulnerability was patched in the release of version 3.9.16 of vm2.
Workarounds
None.
References
Github Issue - https://github.com/patriksimek/vm2/issues/516 PoC - https://gist.github.com/leesh3288/f05730165799bf56d70391f3d9ea187c
For more information
If you have any questions or comments about this advisory:
- Open an issue in VM2
Thanks to Xion (SeungHyun Lee) of KAIST Hacking Lab for disclosing this vulnerability.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "vm2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.16"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-29199"
],
"database_specific": {
"cwe_ids": [
"CWE-913"
],
"github_reviewed": true,
"github_reviewed_at": "2023-04-12T20:42:44Z",
"nvd_published_at": "2023-04-14T19:15:00Z",
"severity": "CRITICAL"
},
"details": "There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass `handleException()` and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context.\n\n### Impact\nA threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.\n\n### Patches\nThis vulnerability was patched in the release of version `3.9.16` of `vm2`.\n\n### Workarounds\nNone.\n\n### References\nGithub Issue - https://github.com/patriksimek/vm2/issues/516\nPoC - https://gist.github.com/leesh3288/f05730165799bf56d70391f3d9ea187c\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open an issue in [VM2](https://github.com/patriksimek/vm2)\n\nThanks to [Xion](https://twitter.com/0x10n) (SeungHyun Lee) of [KAIST Hacking Lab](https://kaist-hacking.github.io/) for disclosing this vulnerability.",
"id": "GHSA-xj72-wvfv-8985",
"modified": "2023-04-14T21:35:01Z",
"published": "2023-04-12T20:42:44Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-xj72-wvfv-8985"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29199"
},
{
"type": "WEB",
"url": "https://github.com/patriksimek/vm2/issues/516"
},
{
"type": "WEB",
"url": "https://github.com/patriksimek/vm2/commit/24c724daa7c09f003e556d7cd1c7a8381cb985d7"
},
{
"type": "WEB",
"url": "https://gist.github.com/leesh3288/f05730165799bf56d70391f3d9ea187c"
},
{
"type": "PACKAGE",
"url": "https://github.com/patriksimek/vm2"
},
{
"type": "WEB",
"url": "https://github.com/patriksimek/vm2/releases/tag/3.9.16"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "vm2 Sandbox Escape vulnerability"
}
Mitigation
Strategy: Input Validation
For any externally-influenced input, check the input against an allowlist of acceptable values.
Mitigation
Strategy: Refactoring
Refactor the code so that it does not need to be dynamically managed.
No CAPEC attack patterns related to this CWE.