CWE-183: Permissive List of Allowed Inputs
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.
Also known as Allowlist / Allow List, Safelist / Safe List, Whitelist / White List.
A kind of CWE-697 Incorrect Comparison.
From the CWE List. © The MITRE Corporation.
Newest
- siemens sinec security monitorA vulnerability has been identified in Siemens SINEC Security Monitor (All versions < V4.9.0)....5.3 Medium
- hushline hush line, scidsg hushline +1 moreCSP bypass in Hush Line6.3 Medium
- es iperf3, red hat enterprise linux 7, enterprise linux 8 +5 more +7 moreIperf3: possible denial of service5.3 Medium
- papercut mf, ng, ng, papercut mf +2 moreUnauthorized write operations in PaperCut NG/MF7.2 High
- grafana, grafana enterprise +1 moreGrafana is an open-source platform for monitoring and observability. In Grafana Enterprise,...6.6 Medium
- fortinet fortiosA permissive list of allowed inputs vulnerability [CWE-183] in FortiGate version 7.2.3 and below,...4.1 Medium
- dell powerpath management appliancePowerPath Management Appliance with version 3.3 contains Privilege Escalation vulnerability. An...6.7 Medium
- dell wyse device agentWyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A...6.0 Medium
- cisco webex meetingsCisco Webex Meetings Email Content Injection Vulnerability5.3 Medium
- cisco adaptive security appliance, adaptive security appliance software, adaptive security appliance (asa) software +9 more +11 moreCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Identity-Based Rule Bypass Vulnerability5.3 Medium
- postgresql, debian linux +1 moreIncorrect Comparison, Permissive List of Allowed Inputs, and Privilege Context Switching Error in PostgreSQL7.5 High
- keycloakIncorrect Permission Assignment for Critical Resource and Permissive List of Allowed Inputs in Keycloak4.9 Medium
- jenkins puppet enterprise pipelineIncorrect Authorization in Puppet Enterprise Pipeline Jenkins Plugin9.9 Critical
- jenkins project kubernetes :: pipeline :: kubernetes steps plugin, jenkins kubernetes pipeline +1 moreIncorrect Authorization in Jenkins Kubernetes :: Pipeline :: Kubernetes Steps Plugin9.9 Critical
- cure53 dompurifyDOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR5.1 Medium
- cure53 dompurifyDOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)6.0 Medium
- jenkins pipeline remote loader, jenkins project pipeline remote loader plugin +1 moreUnsafe entry in Script Security list of approved signatures in Pipeline Remote Loader Plugin9.9 Critical