CWE-172
17 CVEs classified under CWE-172. Browse by severity and year.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10160 | Critical | 9.8 | 2019-06-07 | A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and… |
CVE-2018-3777 | Critical | 9.8 | 2018-08-03 | Insufficient URI encoding in restforce before 3.0.0 allows attacker to inject arbitrary parameters into Salesforce API requests. |
CVE-2016-6691 | Critical | 9.8 | 2016-10-10 | service/jni/com_android_server_wifi_Gbk2Utf.cpp in the Qualcomm Wi-Fi gbk2utf module in Android before 2016-10-05 allows remote attackers to cause a denial of… |
CVE-2025-12758 | High | 7.5 | 2025-11-27 | Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() functio… |
CVE-2025-27110 | High | 7.5 | 2025-02-25 | Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and… |
CVE-2019-12677 | Medium | 6.5 | 2019-10-02 | A vulnerability in the Secure Sockets Layer (SSL) VPN feature of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker… |
CVE-2026-48784 | Medium | 6.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, UrlGenerator::do… |
CVE-2026-42926 | Medium | 5.8 | 2026-05-13 | When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to injec… |
CVE-2018-7173 | Medium | 5.5 | 2018-02-15 | A large loop in JBIG2Stream::readSymbolDictSeg in xpdf 4.00 allows an attacker to cause denial of service via a specific file due to inappropriate decoding. |
CVE-2016-3829 | Medium | 5.5 | 2016-08-05 | The ih264d decoder in mediaserver in Android 6.x before 2016-08-01 does not initialize certain structure members, which allows remote attackers to cause a deni… |
CVE-2016-3828 | Medium | 5.5 | 2016-08-05 | decoder/ih264d_api.c in mediaserver in Android 6.x before 2016-08-01 mishandles invalid PPS and SPS NAL units, which allows remote attackers to cause a denial… |
CVE-2016-3827 | Medium | 5.5 | 2016-08-05 | codecs/hevcdec/SoftHEVC.cpp in libstagefright in mediaserver in Android 6.0.1 before 2016-08-01 mishandles decoder errors, which allows remote attackers to cau… |
CVE-2019-10153 | Medium | 5.0 | 2019-07-30 | A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields would cause fence_rhevm… |
CVE-2018-2415 | Medium | 4.7 | 2018-05-09 | SAP NetWeaver Application Server Java Web Container and HTTP Service (Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Server Core 7.11, 7.30… |
CVE-2018-7289 | Low | 3.3 | 2018-02-21 | An issue was discovered in armadito-windows-driver/src/communication.c in Armadito 0.12.7.2. Malware with filenames containing pure UTF-16 characters can bypas… |
CVE-2021-33604 | Low | 2.5 | 2021-06-24 | URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaad… |
CVE-2024-48909 | Low | 2.0 | 2024-10-14 | SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, c… |