CWE-917
212 CVEs • Abstraction: Base
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
CVEs (212)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Hp 1Intelligent Management Center Jun 17, 2026 Oct 19, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 A iccselectdevtype expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07). |
1Hp 1Intelligent Management Center Jun 17, 2026 Oct 19, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 A faultparasset expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07). |
1Hp 1Intelligent Management Center Jun 17, 2026 Oct 19, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 A faulttrapgroupselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07). |
1Hp 1Intelligent Management Center Jun 17, 2026 Oct 19, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 A faultstatchoosefaulttype expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07). |
1Hp 1Intelligent Management Center Jun 17, 2026 Oct 19, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 A ictexpertcsvdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07). |
1Hp 1Intelligent Management Center Jun 17, 2026 Oct 19, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 A deployselectsoftware expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07). |
1Hp 1Intelligent Management Center Jun 17, 2026 Oct 19, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 A deployselectbootrom expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07). |
1Hp 1Intelligent Management Center Jun 17, 2026 Oct 19, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 A devgroupselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07). |
1Hp 1Intelligent Management Center Jun 17, 2026 Oct 19, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 A chooseperfview expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07). |
1Hp 1Intelligent Management Center Jun 17, 2026 Oct 19, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 A comparefilesresult expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07). |
1Hp 1Intelligent Management Center Jun 17, 2026 Oct 19, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 A faultdevparasset expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07). |
1Hp 1Intelligent Management Center Jun 17, 2026 Oct 19, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 A eventinfo_content expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07). |
1Hp 1Intelligent Management Center Jun 17, 2026 Oct 19, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 A adddevicetoview expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07). |
1Hp 1Intelligent Management Center Jun 17, 2026 Oct 19, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 A addvsiinterfaceinfo expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07). |
1Hp 1Intelligent Management Center Jun 17, 2026 Oct 19, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 A syslogtempletselectwin expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07). |
1Hp 1Intelligent Management Center Jun 17, 2026 Oct 19, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 A legend expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07). |
In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the...Show more |
In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, rrequest parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows th...Show more |
Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are...Show more |
Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If...Show more |