CWE-178 · Improper Handling of Case Sensitivity (page 2)
Page 2 of 2 — CVEs classified under CWE-178, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-22968 | Medium | 5.3 | 2022-04-14 | In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensiti… |
CVE-2021-45893 | High | 7.5 | 2022-04-05 | An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4. There is Improper Handling of Case Sensitivity, which makes password guessing easier. |
CVE-2021-25036 | High | 8.8 | 2022-01-17 | The All in One SEO WordPress plugin before 4.1.5.3 is affected by a Privilege Escalation issue, which was discovered during an internal audit by the Jetpack Sc… |
CVE-2021-0973 | Medium | 5.0 | 2021-12-15 | In isFileUri of UriUtil.java, there is a possible way to bypass ignoring file://URI attachment due to improper handling of case sensitivity. This could lead to… |
CVE-2021-39134 | High | 8.2 | 2021-08-31 | `@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to gu… |
CVE-2021-39155 | High | 8.3 | 2021-08-24 | Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggrega… |
CVE-2021-24347 | High | 8.8 | 2021-06-14 | The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar file… |
CVE-2021-28323 | Medium | 6.5 | 2021-04-13 | Windows DNS Information Disclosure Vulnerability |
CVE-2021-25920 | Medium | 6.5 | 2021-03-22 | In OpenEMR, versions v2.7.2-rc1 to 6.0.0 are vulnerable to Improper Access Control when creating a new user, which leads to a malicious user able to read and s… |
CVE-2020-15234 | Medium | 6.1 | 2020-10-02 | ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite before version 0.34.1, the OAuth 2.0 Client's registered redirect URLs and t… |
CVE-2020-12812 | Critical | 9.8 | 2020-07-24 | An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully wi… |
CVE-2020-5301 | Low | 3.0 | 2020-04-21 | SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. The module controller in `SimpleSAML\Module` that processes requests for… |
CVE-2019-6289 | High | 8.8 | 2019-01-15 | uploads/include/dialog/select_soft.php in DedeCMS V57_UTF8_SP2 allows remote attackers to execute arbitrary PHP code by uploading with a safe file extension an… |
CVE-2018-8337 | Medium | 5.3 | 2018-09-13 | A security feature bypass vulnerability exists when Windows Subsystem for Linux improperly handles case sensitivity, aka "Windows Subsystem for Linux Security… |
CVE-2018-9845 | Critical | 9.8 | 2018-04-29 | Etherpad Lite before 1.6.4 is exploitable for admin access. |
CVE-2017-8493 | Medium | 5.5 | 2017-06-15 | Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to set varia… |
CVE-2007-3365 | High | 7.5 | 2007-06-22 | MyServer 0.8.9 and earlier does not properly handle uppercase characters in filename extensions, which allows remote attackers to obtain sensitive information… |
CVE-2005-0269 | Critical | 9.8 | 2005-05-02 | The file extension check in GNUBoard 3.40 and earlier only verifies extensions that contain all lowercase letters, which allows remote attackers to upload arbi… |
CVE-2004-2214 | Critical | 9.8 | 2004-12-31 | Mbedthis AppWeb HTTP server before 1.1.3 allows remote attackers to bypass access restrictions via a URI with mixed case characters. |
CVE-2004-2154 | Critical | 9.8 | 2004-12-31 | CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing… |
CVE-2004-1083 | High | 7.5 | 2004-12-03 | Apache for Apple Mac OS X 10.2.8 and 10.3.6 restricts access to files in a case sensitive manner, but the Apple HFS+ filesystem accesses files in a case insens… |
CVE-2003-0411 | High | 7.5 | 2003-06-30 | Sun ONE Application Server 7.0 for Windows 2000/XP allows remote attackers to obtain JSP source code via a request that uses the uppercase ".JSP" extension ins… |
CVE-2002-2119 | Critical | 9.8 | 2002-12-31 | Novell eDirectory 8.6.2 and 8.7 use case insensitive passwords, which makes it easier for remote attackers to conduct brute force password guessing. |
CVE-2002-1820 | Critical | 9.8 | 2002-12-31 | register.php in Ultimate PHP Board (UPB) 1.0 and 1.0b uses an administrative account Admin with a capital "A," but allows a remote attacker to impersonate the… |
CVE-2002-0485 | High | 7.5 | 2002-08-12 | Norton Anti-Virus (NAV) allows remote attackers to bypass content filtering via attachments whose Content-Type and Content-Disposition headers are mixed upper… |
CVE-2001-0795 | High | 7.5 | 2001-10-18 | Perception LiteServe 1.25 allows remote attackers to obtain source code of CGI scripts via URLs that contain MS-DOS conventions such as (1) upper case letters… |
CVE-2001-0766 | Critical | 9.8 | 2001-10-18 | Apache on MacOS X Client 10.0.3 with the HFS+ file system allows remote attackers to bypass access restrictions via a URL that contains some characters whose c… |
CVE-2001-1238 | High | 7.8 | 2001-07-16 | Task Manager in Windows 2000 does not allow local users to end processes with uppercase letters named (1) winlogon.exe, (2) csrss.exe, (3) smss.exe and (4) ser… |
CVE-2000-0499 | High | 7.5 | 2000-06-08 | The default configuration of BEA WebLogic 3.1.8 through 4.5.1 allows a remote attacker to view source code of a JSP program by requesting a URL which provides… |
CVE-2000-0498 | High | 7.5 | 2000-06-08 | Unify eWave ServletExec allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case. |
CVE-2000-0497 | High | 7.5 | 2000-06-08 | IBM WebSphere server 3.0.2 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case. |
CVE-1999-0239 | High | 7.5 | 1998-01-01 | Netscape FastTrack Web server lists files when a lowercase "get" command is used instead of an uppercase GET. |