地图 / 资源注入

资源注入

Resource Injection · 注入与走私

注入与走私 / 资源注入

35公开报告

—CWE 编号

0已标注发现方式

35关联报告

发现方式分布

暂无发现方式标注。

关联报告

Arbitrary local system file read on open-xchange serverOpen-Xchange · — · 未评级 · $2,000 · 125 票 Nextcloud Desktop Client RCE via malicious URI schemesNextcloud · 2021-04-15 · 低危 · $1,000 · 73 票 [Xenoblade Chronicles X: Definitive Edition] Unrestricted RPCs allow DoS and writing arbitrary flags remotelyNintendo · 2025-05-15 · 高危 · 65 票 HTML injection possible with soft email confirmations when Administrator manually confirms attacker email addressGitLab · 2024-10-08 · 低危 · $1,060 · 61 票 Content injection in Jira issue title enabling sending arbitrary POST request as victimGitLab · 2022-09-22 · 中危 · 55 票 Arbitrary POST request as victim user from HTML injection in Jupyter notebooksGitLab · 2022-05-20 · 中危 · 54 票 Render content from untrusted sources via web_preview endpoint on Acronis CloudAcronis · — · 未评级 · $200 · 46 票 position: fixed !important bypasses CSS sanitizer's fixed-position mitigation, enabling full-viewport phishing overlays.Nextcloud · 2026-04-20 · 低危 · 44 票 When you call your branch the same name as a git hash, it could be checked out by dependentsGitLab · 2021-08-19 · 低危 · $2,000 · 39 票 Unquoted body background attribute enables CSS injection that bypasses remote image blockingNextcloud · 2026-04-20 · 低危 · 35 票 Smuggling content in PR with refs/replace in GitHubGitHub · 2023-08-01 · 低危 · 35 票 Command injection in GitHub Actions ContainerStepHostGitHub · 2022-11-03 · 低危 · $4,000 · 32 票 CSS injection via BB code tag "█████"phpBB · 2019-09-26 · 低危 · 28 票 HTTP parameter pollution from outdated Greenhouse.io JS dependencySlack · 2018-07-19 · 低危 · 26 票 Git Reference Ambiguity in GitHub - Commit Smuggling, Account Takeover, and Remote Code ExecutionGitHub · 2023-11-29 · 低危 · 25 票 YAML schema injection risk in Swagger UI via schema_url parameter at developers.cloudflare.comCloudflare Public Bug Bounty · 2023-11-10 · 低危 · 24 票 Resource Injection - [████████]U.S. Dept Of Defense · 2024-03-22 · 低危 · 22 票 Improper handling of null bytes in GitHub Actions Runner allows an attacker to set arbitrary environment variablesGitHub · 2023-03-09 · 低危 · 19 票 [Biz] [Mailer] Кроп любых* изображений расположенных на сервереMail.ru · — · 未评级 · 19 票 Object injection in `stripe-billing-typographic` GitHub project via /auth/loginStripe · 2023-03-06 · 低危 · 17 票 HTML injection in https://interviewing.shopify.com/index.php?candidate=Shopify · 2019-07-04 · 低危 · 17 票 H1-5411 CTF Write-up by erbbysam and zioth1-5411-CTF · 2018-10-22 · 未评级 · 17 票 Stored CSS InjectionCoinbase · 2018-04-02 · 未评级 · 15 票 Code injectionLegal Robot · 2017-08-12 · 低危 · 13 票 'X-Forwarded-Host' key used in input without sanitation - possible cache poisoningRadancy · — · 未评级 · 10 票 Zero-amount miner TX + RingCT allows monero wallet to receive arbitrary amount of moneroMonero · 2019-07-03 · 高危 · 9 票 flash injection in http://www.rockstargames.com/IV/imgPlayer/imageEmbed.swfRockstar Games · 2017-08-25 · 低危 · 8 票 Anyone can register organization legal type as "Soletrader"Liberapay · 2018-06-03 · 低危 · 6 票 HTML Injection in OwncloudownCloud · 2017-07-06 · 低危 · $150 · 6 票 XSS in Desktop Client in call notification popupNextcloud · 2022-11-25 · 低危 · 5 票 XSS in Desktop Client via user status and informationNextcloud · 2022-11-25 · 低危 · 5 票 AWS Load Balancer Controller Managed Security Groups can be replaced by an unprivileged attackerKubernetes · 2022-06-02 · 低危 · $500 · 5 票 Swagger UI Injection via Config URL - `███`U.S. Dept Of Defense · 2026-01-12 · 低危 · 4 票 AWS Load Balancer Controller can be used by an attacker to modify rules of any Security Group that they are able to tagKubernetes · 2022-06-02 · 低危 · $500 · 3 票 Content spoofing on https://surveyserver.nextcloud.comNextcloud · 2021-02-14 · 低危 · 2 票