CWE-436 (page 2)
Page 2 of 2 — CVEs classified under CWE-436, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-34478 | High | 7.5 | 2024-05-05 | btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically… |
CVE-2023-39481 | High | 8.8 | 2024-05-03 | Softing Secure Integration Server Interpretation Conflict Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2024-3386 | Medium | 5.3 | 2024-04-10 | An incorrect string comparison vulnerability in Palo Alto Networks PAN-OS software prevents Predefined Decryption Exclusions from functioning as intended. This… |
CVE-2023-45715 | Low | 3.5 | 2024-03-28 | The console may experience a service interruption when processing file names with invalid characters. |
CVE-2024-2004 | Low | 3.5 | 2024-03-27 | When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to a… |
CVE-2024-29034 | Medium | 6.8 | 2024-03-24 | CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vuln… |
CVE-2024-28054 | High | 7.4 | 2024-03-18 | Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an Interpretation Conflict (relative to some mail user agents) whe… |
CVE-2023-50327 | Medium | 5.3 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 uses insecure HTTP methods which could allow a remote attacker to perform unauthorized file request modification. IBM X-Force ID… |
CVE-2024-24754 | Low | 3.7 | 2024-02-01 | Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lam… |
CVE-2024-24753 | Medium | 4.8 | 2024-02-01 | Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers… |
CVE-2024-23644 | Medium | 6.8 | 2024-01-24 | Trillium is a composable toolkit for building internet applications with async rust. In `trillium-http` prior to 0.3.12 and `trillium-client` prior to 0.5.4, i… |
CVE-2023-48256 | Medium | 5.3 | 2024-01-10 | The vulnerability allows a remote attacker to inject arbitrary HTTP response headers or manipulate HTTP response bodies inside a victim’s session via a crafted… |
CVE-2023-49284 | Low | 3.9 | 2023-12-05 | fish is a smart and user-friendly command line shell for macOS, Linux, and the rest of the family. fish shell uses certain Unicode non-characters internally fo… |
CVE-2023-40718 | High | 7.5 | 2023-10-10 | A interpretation conflict in Fortinet IPS Engine versions 7.321, 7.166 and 6.158 allows attacker to evade IPS features via crafted TCP packets. |
CVE-2023-29406 | Medium | 6.5 | 2023-07-11 | The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests… |
CVE-2023-36456 | High | 8.3 | 2023-07-06 | authentik is an open-source Identity Provider. Prior to versions 2023.4.3 and 2023.5.5, authentik does not verify the source of the X-Forwarded-For and X-Real-… |
CVE-2022-48473 | High | 7.5 | 2023-06-16 | There is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer service to be abnorm… |
CVE-2022-48471 | High | 7.5 | 2023-06-16 | There is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer service to be abnorm… |
CVE-2023-32708 | High | 7.2 | 2023-06-01 | In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can trigger an HTTP… |
CVE-2023-30541 | Medium | 5.3 | 2023-04-17 | OpenZeppelin Contracts is a library for secure smart contract development. A function in the implementation contract may be inaccessible if its selector clashe… |
CVE-2023-30536 | Medium | 6.5 | 2023-04-17 | slim/psr7 is a PSR-7 implementation for use with Slim 4. In versions prior to 1.6.1 an attacker could sneak in a newline (\n) into both the header names and va… |
CVE-2023-29197 | Medium | 5.3 | 2023-04-17 | guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a n… |
CVE-2023-22998 | Medium | 5.5 | 2023-02-28 | In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expects it to be NULL in t… |
CVE-2022-48261 | High | 7.5 | 2023-02-27 | There is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation of this vulnerability may cause the printer service to… |
CVE-2022-48230 | High | 7.5 | 2023-02-27 | There is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation could lead to DoS. |
CVE-2023-24813 | Critical | 10.0 | 2023-02-07 | Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can still call arbitrar… |
CVE-2023-22735 | Medium | 4.4 | 2023-02-07 | Zulip is an open-source team collaboration tool. In versions of zulip prior to commit `2f6c5a8` but after commit `04cf68b` users could upload files with arbitr… |
CVE-2019-25101 | Medium | 6.3 | 2023-02-04 | A vulnerability classified as critical has been found in OnShift TurboGears 1.0.11.10. This affects an unknown part of the file turbogears/controllers.py of th… |
CVE-2022-48279 | High | 7.5 | 2023-01-20 | In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is… |
CVE-2022-37436 | Medium | 5.3 | 2023-01-17 | Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into… |
CVE-2023-22602 | High | 7.5 | 2023-01-14 | When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication… |
CVE-2022-41915 | Medium | 6.5 | 2022-12-13 | Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultH… |
CVE-2022-38115 | Medium | 5.3 | 2022-11-23 | Insecure method vulnerability in which allowed HTTP methods are disclosed. E.g., OPTIONS, DELETE, TRACE, and PUT |
CVE-2022-20915 | High | 7.4 | 2022-10-10 | A vulnerability in the implementation of IPv6 VPN over MPLS (6VPE) with Zone-Based Firewall (ZBFW) of Cisco IOS XE Software could allow an unauthenticated, adj… |
CVE-2022-36051 | High | 8.7 | 2022-08-31 | ZITADEL combines the ease of Auth0 and the versatility of Keycloak.**Actions**, introduced in ZITADEL **1.42.0** on the API and **1.56.0** for Console, is a fe… |
CVE-2022-36048 | Medium | 4.3 | 2022-08-31 | Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. When displaying messages with embedded remote images… |
CVE-2022-35962 | High | 8.0 | 2022-08-29 | Zulip is an open source team chat and Zulip Mobile is an app for iOS and Andriod users. In Zulip Mobile through version 27.189, a crafted link in a message sen… |
CVE-2022-29254 | Low | 3.7 | 2022-06-09 | silverstripe-omnipay is a SilverStripe integration with Omnipay PHP payments library. For a subset of Omnipay gateways (those that use intermediary states like… |
CVE-2022-23773 | High | 7.5 | 2022-02-11 | cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access co… |
CVE-2022-0011 | Medium | 6.5 | 2022-02-10 | PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed (depending on your rules)… |
CVE-2021-45327 | Critical | 9.8 | 2022-02-08 | Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a rem… |
CVE-2021-34699 | High | 7.7 | 2021-09-23 | A vulnerability in the TrustSec CLI parser of Cisco IOS and Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to… |
CVE-2021-1587 | High | 8.6 | 2021-08-25 | A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated… |
CVE-2021-39137 | Medium | 6.5 | 2021-08-24 | go-ethereum is the official Go implementation of the Ethereum protocol. In affected versions a consensus-vulnerability in go-ethereum (Geth) could cause a chai… |
CVE-2021-28474 | High | 8.8 | 2021-05-11 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2021-21366 | Medium | 4.3 | 2021-03-12 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly pres… |
CVE-2021-0207 | High | 7.5 | 2021-01-15 | An improper interpretation conflict of certain data between certain software components within the Juniper Networks Junos OS devices does not allow certain tra… |
CVE-2020-3564 | Medium | 5.3 | 2020-10-21 | A vulnerability in the FTP inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow… |
CVE-2020-3200 | High | 7.7 | 2020-06-03 | A vulnerability in the Secure Shell (SSH) server code of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause an… |
CVE-2020-10134 | Medium | 6.3 | 2020-05-19 | Pairing in Bluetooth® Core v5.2 and earlier may permit an unauthenticated attacker to acquire credentials with two pairing devices via adjacent access when the… |
CVE-2019-19089 | Medium | 6.1 | 2020-04-02 | For ABB eSOMS versions 4.0 to 6.0.3, the X-Content-Type-Options Header is missing in the HTTP response, potentially causing the response body to be interpreted… |
CVE-2020-10193 | High | 7.5 | 2020-03-06 | ESET Archive Support Module before 1294 allows virus-detection bypass via crafted RAR Compression Information in an archive. This affects versions before 1294… |
CVE-2020-10180 | Critical | 9.8 | 2020-03-05 | The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. This affects versions before 1294 of Smart Security Pr… |
CVE-2020-9399 | Medium | 5.5 | 2020-02-28 | The Avast AV parsing engine allows virus-detection bypass via a crafted ZIP archive. This affects versions before 12 definitions 200114-0 of Antivirus Pro, Ant… |
CVE-2020-9363 | High | 7.8 | 2020-02-24 | The Sophos AV parsing engine before 2020-01-14 allows virus-detection bypass via a crafted ZIP archive. This affects Endpoint Protection, Cloud Optix, Mobile… |
CVE-2020-9362 | High | 7.8 | 2020-02-24 | The Quick Heal AV parsing engine (November 2019) allows virus-detection bypass via a crafted GPFLAG in a ZIP archive. This affects Total Security, Home Securit… |
CVE-2020-9342 | Medium | 5.5 | 2020-02-22 | The F-Secure AV parsing engine before 2020-02-05 allows virus-detection bypass via crafted Compression Method data in a GZIP archive. This affects versions bef… |
CVE-2020-9264 | Medium | 5.5 | 2020-02-18 | ESET Archive Support Module before 1296 allows virus-detection bypass via a crafted Compression Information Field in a ZIP archive. This affects versions befor… |
CVE-2019-18792 | Critical | 9.1 | 2020-01-06 | An issue was discovered in Suricata 5.0.0. It is possible to bypass/evade any tcp based signature by overlapping a TCP segment with a fake FIN packet. The fake… |
CVE-2019-19589 | Critical | 9.8 | 2019-12-05 | The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives. Note: It has been argued… |
CVE-2019-17596 | High | 7.5 | 2019-10-24 | Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack s… |
CVE-2019-0052 | High | 7.5 | 2019-07-11 | The srxpfe process may crash on SRX Series services gateways when the UTM module processes a specific fragmented HTTP packet. The packet is misinterpreted as a… |
CVE-2019-5892 | Medium | 6.5 | 2019-01-10 | bgpd in FRRouting FRR (aka Free Range Routing) 2.x and 3.x before 3.0.4, 4.x before 4.0.1, 5.x before 5.0.2, and 6.x before 6.0.2 (not affecting Cumulus Linux… |
CVE-2018-19966 | High | 8.8 | 2018-12-08 | An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service (host OS crash) or possibly gain host OS privileges b… |
CVE-2018-6560 | High | 8.8 | 2018-02-02 | In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the s… |