CWE-155: Improper Neutralization of Wildcards or Matching Symbols
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as wildcards or matching symbols when they are sent to a downstream component.
A kind of CWE-138 Improper Neutralization of Special Elements.
From the CWE List. © The MITRE Corporation.
Newest
- moquette Moquette fails open when configured authentication or authorization classes cannot load 9.3 Critical
- moquette Moquette client IDs can cause cross-session H2 durable-queue corruption 8.8 High
- moquette Moquette publishes Last-Will messages without enforcing write authorization 8.7 High
- moquette Moquette unbounded per-session message queues allow memory exhaustion 8.7 High
- moquette Moquette deeply nested MQTT topics can cause stack exhaustion 8.7 High
- moquette Moquette malformed shared subscriptions can crash command processing 8.7 High
- moquette Moquette uncaught MQTT command exceptions can terminate shared session event loops 8.7 High
- moquette Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass 9.6 Critical
- openwebui open webui, open-webui +1 more Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite 8.1 High
- pyenv Pyenv: Glob/wildcard metacharacters bypass is_version_safe(), causing silent version/interpreter substitution via unquoted expansion (CVE-2022-35861 residual) 2.0 Low
- ericcornelissen shescape Shescape: Path disclosure on Unix with Zsh 6.3 Medium
- macwarrior clipbucket-v5 ClipBucket: SQL Wildcard Injection in Subtitle Edit Endpoint Allows Mass Subtitle Overwrite 4.3 Medium
-
aws-lc-syscrates.io AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN 8.2 High - cloudedge app Improper Neutralization of Wildcards or Matching Symbols in CloudEdge Online Cameras and App 8.7 High
- paloaltonetworks globalprotect, palo alto networks globalprotect app +1 more GlobalProtect: Authenticated Code Injection Through Wildcard on macOS 8.5 High
-
macropay-solutions/laravel-crud-wizard-freePackagist laravel-crud-wizard-free has File Validation Bypass 6.9 Medium - new rock technologies mx8g voip gateway, nrp1302/p desktop ip phone, om500 ip-pbx +2 more New Rock Technologies Cloud Connected Devices Improper Neutralization of Wildcards or Matching Symbols 6.9 Medium
- kubewarden kubewarden-controller The kubewarden-controller AdmissionPolicy and AdmissionPolicyGroup policies can be used to alter PolicyReport resources 6.5 Medium
- palo alto networks expedition, cloud ngfw, pan-os +2 more +4 more Expedition: Wildcard Expansion Vulnerability 6.9 Medium
- ruijie reyee os Ruijie Reyee OS Improper Neutralization of Wildcards or Matching Symbols 8.7 High
- palo alto networks pan-os, cloud ngfw, prisma access +2 more PAN-OS: Arbitrary File Read Vulnerability in the Command Line Interface (CLI) 6.7 Medium
- axis communications ab os Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API alwaysmulti.cgi... 6.5 Medium
- axis os, os 2022 +1 more Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs mediaclip... 6.5 Medium
- axis communications ab os Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs local_list... 6.5 Medium
- authzed spicedb Lookup operations do not take into account wildcards in SpiceDB 8.1 High
- flarum framework Laravel has a File Validation Bypass 6.9 Medium
- otrs, otrs ag ((otrs)) community edition, debian linux +2 more +4 more Information Disclosure 6.5 Medium
- spring data jpa, pivotal software spring data java persistance api +1 more Additional information exposure with Spring Data JPA example matcher 3.5 Low