← Back
CWE-94

7,033 CVEs • Abstraction: Base • Likelihood of Exploit: Medium

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

JSON object

Loading...

CVEs (7,033)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2012-1524
1Microsoft
1Internet Explorer
Apr 29, 2026
Jul 10, 2012
N/A· v4
N/A· v3
9.3 HIGH· v2
Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Attribute Remove Remote Code Execution Vulnerability."
CVE-2012-1522
1Microsoft
1Internet Explorer
Apr 29, 2026
Jul 10, 2012
N/A· v4
N/A· v3
9.3 HIGH· v2
Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Cached Object Remote Code Execution Vulnerability."
CVE-2012-0175
1Microsoft
6Windows 2003 Server
Windows 7Windows Server 2003+3 more
Apr 29, 2026
Jul 10, 2012
N/A· v4
8.8 HIGH· v3
9.3 HIGH· v2
The Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a craft...Show more
The Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted name for a (1) file or (2) directory, aka "Command Injection Vulnerability."Show less
CVE-2012-2174
1Ibm
1Lotus Notes
Apr 29, 2026
Jun 20, 2012
N/A· v4
N/A· v3
9.3 HIGH· v2
The URL handler in IBM Lotus Notes 8.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a crafted notes:// URL.
CVE-2012-3289
1Vmware
4Esx
EsxiPlayer+1 more
Apr 29, 2026
Jun 14, 2012
N/A· v4
N/A· v3
7.8 HIGH· v2
VMware Workstation 8.x before 8.0.4, VMware Player 4.x before 4.0.4, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 allow remote attackers to cause a denial of service (guest OS crash) via crafted traffic fr...Show more
VMware Workstation 8.x before 8.0.4, VMware Player 4.x before 4.0.4, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 allow remote attackers to cause a denial of service (guest OS crash) via crafted traffic from a remote virtual device.Show less
CVE-2012-2041
1Adobe
1Coldfusion
Apr 29, 2026
Jun 13, 2012
N/A· v4
N/A· v3
4.3 MEDIUM· v2
CRLF injection vulnerability in the Component Browser in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CVE-2012-1881
1Microsoft
1Internet Explorer
Apr 29, 2026
Jun 12, 2012
N/A· v4
N/A· v3
9.3 HIGH· v2
Microsoft Internet Explorer 8 and 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "OnRowsInserted Event Remote Code Execution Vulne...Show more
Microsoft Internet Explorer 8 and 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "OnRowsInserted Event Remote Code Execution Vulnerability."Show less
CVE-2012-1880
1Microsoft
1Internet Explorer
Apr 29, 2026
Jun 12, 2012
N/A· v4
N/A· v3
9.3 HIGH· v2
Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "insertRow Remote Code Execution Vulnerabilit...Show more
Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "insertRow Remote Code Execution Vulnerability."Show less
CVE-2012-1879
1Microsoft
1Internet Explorer
Apr 29, 2026
Jun 12, 2012
N/A· v4
8.1 HIGH· v3
9.3 HIGH· v2
Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access an undefined memory location, aka "insertAdjacentText Re...Show more
Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access an undefined memory location, aka "insertAdjacentText Remote Code Execution Vulnerability."Show less
CVE-2012-1878
1Microsoft
1Internet Explorer
Apr 29, 2026
Jun 12, 2012
N/A· v4
N/A· v3
9.3 HIGH· v2
Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "OnBeforeDeactivate Event Remote Code Executi...Show more
Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "OnBeforeDeactivate Event Remote Code Execution Vulnerability."Show less
CVE-2012-1877
1Microsoft
1Internet Explorer
Apr 29, 2026
Jun 12, 2012
N/A· v4
N/A· v3
9.3 HIGH· v2
Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Title Element Change Remote Code Execution V...Show more
Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Title Element Change Remote Code Execution Vulnerability."Show less
CVE-2012-1876
1Microsoft
1Internet Explorer
Apr 29, 2026
Jun 12, 2012
N/A· v4
N/A· v3
9.3 HIGH· v2
Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access a nonexistent object, leading...Show more
Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access a nonexistent object, leading to a heap-based buffer overflow, aka "Col Element Remote Code Execution Vulnerability," as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012.Show less
CVE-2012-1875
1Microsoft
1Internet Explorer
Apr 29, 2026
Jun 12, 2012
N/A· v4
N/A· v3
9.3 HIGH· v2
Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Same ID Property Remote Code Execution Vulnerability."
CVE-2012-1874
1Microsoft
1Internet Explorer
Apr 29, 2026
Jun 12, 2012
N/A· v4
N/A· v3
9.3 HIGH· v2
Microsoft Internet Explorer 8 and 9 does not properly handle objects in memory, which allows user-assisted remote attackers to execute arbitrary code by accessing a deleted object, aka "Developer Toolbar Remote Code Exec...Show more
Microsoft Internet Explorer 8 and 9 does not properly handle objects in memory, which allows user-assisted remote attackers to execute arbitrary code by accessing a deleted object, aka "Developer Toolbar Remote Code Execution Vulnerability."Show less
CVE-2012-1855
1Microsoft
1.net Framework
Apr 29, 2026
Jun 12, 2012
N/A· v4
N/A· v3
9.3 HIGH· v2
Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly handle function pointers, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a...Show more
Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly handle function pointers, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application, aka ".NET Framework Memory Access Vulnerability."Show less
CVE-2012-1523
1Microsoft
1Internet Explorer
Apr 29, 2026
Jun 12, 2012
N/A· v4
N/A· v3
9.3 HIGH· v2
Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Center Element Remote Code Execution Vulnera...Show more
Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Center Element Remote Code Execution Vulnerability."Show less
CVE-2012-0173
1Microsoft
5Windows 7
Windows Server 2003Windows Server 2008+2 more
Apr 29, 2026
Jun 12, 2012
N/A· v4
N/A· v3
9.3 HIGH· v2
The Remote Desktop Protocol (RDP) implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly proc...Show more
The Remote Desktop Protocol (RDP) implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly process packets in memory, which allows remote attackers to execute arbitrary code by sending crafted RDP packets triggering access to an object that (1) was not properly initialized or (2) is deleted, aka "Remote Desktop Protocol Vulnerability," a different vulnerability than CVE-2012-0002.Show less
CVE-2012-2596
1Siemens
1Wincc
Apr 29, 2026
Jun 8, 2012
N/A· v4
N/A· v3
5.5 MEDIUM· v2
The XPath functionality in unspecified web applications in Siemens WinCC 7.0 SP3 before Update 2 does not properly handle special characters in parameters, which allows remote authenticated users to read or modify settin...Show more
The XPath functionality in unspecified web applications in Siemens WinCC 7.0 SP3 before Update 2 does not properly handle special characters in parameters, which allows remote authenticated users to read or modify settings via a crafted URL, related to an "XML injection" attack.Show less
CVE-2011-4458
1Bestpractical
1Rt
Apr 29, 2026
Jun 4, 2012
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Best Practical Solutions RT 3.6.x, 3.7.x, and 3.8.x before 3.8.12 and 4.x before 4.0.6, when the VERPPrefix and VERPDomain options are enabled, allows remote attackers to execute arbitrary code via unspecified vectors, a...Show more
Best Practical Solutions RT 3.6.x, 3.7.x, and 3.8.x before 3.8.12 and 4.x before 4.0.6, when the VERPPrefix and VERPDomain options are enabled, allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2011-5092 and CVE-2011-5093.Show less
CVE-2012-0295
1Symantec
1Endpoint Protection
Apr 29, 2026
May 23, 2012
N/A· v4
N/A· v3
9.3 HIGH· v2
The Manager service in the management console in Symantec Endpoint Protection (SEP) 12.1 before 12.1 RU1-MP1 allows remote attackers to conduct file-insertion attacks and execute arbitrary code by leveraging exploitation...Show more
The Manager service in the management console in Symantec Endpoint Protection (SEP) 12.1 before 12.1 RU1-MP1 allows remote attackers to conduct file-insertion attacks and execute arbitrary code by leveraging exploitation of CVE-2012-0294.Show less