1394
Reference Description
CVE-2021-22204 Chain: regex in EXIF processor code does not correctly determine where a
string ends (CWE-625), enabling eval injection (CWE-95), as exploited in the
wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2021-22204
CVE-2006-1895 ".*" regexp leads to static code injection
https://www.cve.org/CVERecord?id=CVE-2006-1895
CVE-2002-2175 insertion of username into regexp results in partial comparison, causing wrong
database entry to be updated when one username is a substring of another.
https://www.cve.org/CVERecord?id=CVE-2002-2175
CVE-2006-4527 regexp intended to verify that all characters are legal, only checks that at least
one is legal, enabling file inclusion.
https://www.cve.org/CVERecord?id=CVE-2006-4527
CVE-2005-1949 Regexp for IP address isn't anchored at the end, allowing appending of shell
metacharacters.
https://www.cve.org/CVERecord?id=CVE-2005-1949
CVE-2002-2109 Regexp isn't "anchored" to the beginning or end, which allows spoofed values
that have trusted values as substrings.
https://www.cve.org/CVERecord?id=CVE-2002-2109
CVE-2006-6511 regexp in .htaccess file allows access of files whose names contain certain
substrings
https://www.cve.org/CVERecord?id=CVE-2006-6511
CVE-2006-6629 allow load of macro files whose names contain certain substrings.
https://www.cve.org/CVERecord?id=CVE-2006-6629
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 845 The CERT Oracle Secure Coding Standard for
Java (2011) Chapter 2 - Input Validation and Data
Sanitization (IDS)
844 2362
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1397 Comprehensive Categorization: Comparison 1400 2523
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
The CERT Oracle Secure
Coding Standard for Java
(2011)
IDS08-J Sanitize untrusted data passed to a
regex
References
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-626: Null Byte Interaction Error (Poison Null Byte)
Weakness ID : 626
Structure : Simple
Abstraction : Variant
Description
CWE Version 4.14
CWE-626: Null Byte Interaction Error (Poison Null Byte)
CWE-626: Null Byte Interaction Error (Poison Null Byte)