CWE-178: Improper Handling of Case Sensitivity
The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- drupal openid connect / oauth client, bojanz openid connect \/ oauth client +1 moreOpenID Connect / OAuth client - Less critical - Access bypass - SA-CONTRIB-2026-0274.2 Medium
- lfprojects mcp go sdk, modelcontextprotocol go-sdk, red hat migration toolkit for virtualization +3 more +5 moreMCP Go SDK Vulnerable to Improper Handling of Case Sensitivity7.0 High
- caddyserver caddyCaddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass7.7 High
- caddyserver caddyCaddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass7.7 High
- filebrowserFile Browser has an Authentication Bypass in User Password Update5.4 Medium
- b3log siyuanSiYuan has a File Read Interface Case Bypass Vulnerability7.5 High
- formioFormio improperly authorized permission elevation through specially crafted request path8.7 High
- anysphere cursorCursor IDE: Sensitive File Overwrite Bypass is Possible8.1 High
- anysphere cursorCursor CLI Agent: Sensitive File Overwrite Bypass7.1 High
@elysiajs/corsnpmelysia-cors Origin Validation Error6.5 Medium- apache tomcatApache Tomcat: Security constraint bypass for CGI scripts7.3 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreLibsoup: cookie domain validation bypass via uppercase characters in libsoup4.3 Medium
- corydolphin corydolphin/flask-cors, flask-cors project flask-cors +1 moreCase-Insensitive Path Matching in corydolphin/flask-cors5.3 Medium
- apache camelApache Camel: Camel Message Header Injection via Improper Filtering5.6 Medium
- jenkins openid connect authentication, jenkins project openid connect authentication plugin +1 moreImproper handling of case sensitivity in Jenkins OpenId Connect Authentication Plugin8.8 High
- gradio-app gradioGradio Blocked Path ACL Bypass Vulnerability8.7 High
- spring ldapSpring LDAP sensitive data exposure for case-sensitive comparisons3.7 Low
- vmware spring, spring framework +1 moreCVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception3.1 Low
- mozilla firefoxIn violation of spec, cookie prefixes such as `__Secure` were being ignored if they were not...9.8 Critical
- python-social-auth social-app-djangosocial-auth-app-django Improper Handling of Case Sensitivity vulnerability4.9 Medium
- drupal, drupal core +1 moreDrupal core - Moderately critical - Access bypass - SA-CORE-2024-0048.1 High
- vitejs viteVite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem7.5 High
- curl, fedoraproject fedora, siemens ruggedcom rox mx5000 +14 more +16 moreThis flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back...6.5 Medium
- chamiloChamilo LMS Htaccess File Upload Security Bypass9.8 Critical
- eclipse jgitImproper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file write8.8 High
- opennetworking onosAn issue was discovered in ONOS 2.5.1. An intent with an uppercase letter in a device ID shows...9.8 Critical
- linuxfoundation modular open smart networkPrivilege escalation in MOSN9.8 Critical
- vmware spring framework, netapp active iq unified manager, cloud secure agent +4 more +6 moreImproper handling of case sensitivity in Spring Framework5.3 Medium
- zauner arcAn issue was discovered in Softwarebuero Zauner ARC 4.2.0.4. There is Improper Handling of Case...7.5 High
- aioseo all in one seo, smub all in one seo – best wordpress seo plugin – easily improve seo rankings & increase traffic +1 moreAll In One SEO < 4.1.5.3 - Authenticated Privilege Escalation8.8 High
- pmmp pocketmine-mpPocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity4.8 Medium
- google androidIn isFileUri of UriUtil.java, there is a possible way to bypass ignoring file://URI attachment...5.0 Medium
- npm arborist, oracle graalvm, siemens sinec infrastructure network services +2 moreUNIX Symbolic Link (Symlink) Following in @npmcli/arborist8.2 High
- istioAuthorization Policy Bypass Due to Case Insensitive Host Comparison8.3 High
- smartypants sp project & document manager, smartypantsplugins sp project \& document manager +1 moreSP Project & Document Manager <2 4.22 - Authenticated Shell Upload8.8 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1803 +26 more +28 moreWindows DNS Information Disclosure Vulnerability6.5 Medium
- open-emr openemrIn OpenEMR, versions v2.7.2-rc1 to 6.0.0 are vulnerable to Improper Access Control when creating...6.5 Medium
- ory fositeRedirect URL matching ignores character casing6.1 Medium
- fortinet fortiosAn improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and...9.8 Critical
- simplesamlphpInformation disclosure of source code in SimpleSAMLphp3.0 Low
- dedecmsuploads/include/dialog/select_soft.php in DedeCMS V57_UTF8_SP2 allows remote attackers to execute...8.8 High
- microsoft windows 10, windows 10 servers, windows server 2016 +2 moreA security feature bypass vulnerability exists when Windows Subsystem for Linux improperly...5.3 Medium
- etherpad liteEtherpad Lite before 1.6.4 is exploitable for admin access.9.8 Critical
- microsoft windows 10, windows 8.1, windows rt 8.1 +3 more +5 moreMicrosoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607,...5.5 Medium
- myserverproject myserverMyServer 0.8.9 and earlier does not properly handle uppercase characters in filename extensions,...7.5 High
- sir gnuboardThe file extension check in GNUBoard 3.40 and earlier only verifies extensions that contain all...9.8 Critical
- mbedthis appweb http serverMbedthis AppWeb HTTP server before 1.1.3 allows remote attackers to bypass access restrictions...9.8 Critical
- apple cups, canonical ubuntu linux +1 moreCUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows...9.8 Critical
- apple mac os x, darwin streaming server, mac os x server +1 more +3 moreApache for Apple Mac OS X 10.2.8 and 10.3.6 restricts access to files in a case sensitive manner,...7.5 High
- oracle sun one application serverSun ONE Application Server 7.0 for Windows 2000/XP allows remote attackers to obtain JSP source...7.5 High
- Show moreLoading…