CWE-184: Incomplete List of Disallowed Inputs
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
Also known as Denylist / Deny List, Blocklist / Block List, Blacklist / Black List.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- shopware, shopware ag 6 +1 moreImproper Control of Generation of Code in Twig Rendered Views in Shopware8.8 High
- svelte sveltekit, sveltejs kit +1 moreSvelteKit has Insufficient Cross-Site Request Forgery Protection8.8 High
- lenovo xclarity controller, thinkagile hx1021 firmware, thinkagile hx1320 firmware +96 more +98 moreThe Remote Mount feature can potentially be abused by valid, authenticated users to make...2.7 Low
- apache kylinApache Kylin: Command injection by Useless configuration8.8 High
- cortexproject cortexAlertmanager can expose local files content via specially crafted config6.5 Medium
- lansweeperA cross-site scripting (xss) sanitization vulnerability bypass exists in the SanitizeHtml...9.1 Critical
- zulip, zulip zulip-mobile +1 moreCrafted link in Zulip message can cause disclosure of credentials8.0 High
- jetbrains ktorJetBrains Ktor before 2.1.0 was vulnerable to a Reflect File Download attack4.7 Medium
- trend micro apex central, trend micro, inc. micro apex central, trendmicro apex one +2 moreAn arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated...9.8 Critical
- microsoft exchange, exchange server, exchange server 2016 cumulative update 21 +3 more +5 moreMicrosoft Exchange Server Remote Code Execution Vulnerability8.8 High
- jenkinsAgent-to-controller access control allows reading/writing most content of build directories in Jenkins9.1 Critical
- juniper junos, juniper networks junos os +1 moreJunos OS: QFX5000 Series and EX4600 Series: Control traffic might be dropped if a high rate of specific multicast traffic is received6.5 Medium
- kubernetesHoles in EndpointSlice Validation Enable Host Network Hijack2.7 Low
- libreofficedenylist of executable filename extensions possible to bypass under windows8.8 High
- gnu grub2, fedoraproject fedora, netapp cloud backup +6 more +8 moreA flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of...7.5 High
- cisco data center network managerCisco Data Center Network Manager REST API Vulnerabilities4.6 Medium
- cisco data center network managerCisco Data Center Network Manager REST API Vulnerabilities4.6 Medium
- cisco data center network managerCisco Data Center Network Manager REST API Vulnerabilities4.6 Medium
http-proxynpm,@rootio/http-proxyRoot +1 moreDenial of Service in http-proxy7.5 High- cisco data center network managerCisco Data Center Network Manager Command Injection Vulnerability8.2 High
- nethackPrivilege escalation in NetHack3.9 Low
- cure53 dompurifyDOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING5.1 Medium
- antfin sofa-hessianIncomplete List of Disallowed Inputs in SOFA-Hessian9.8 Critical
- artifex ghostscript, redhat enterprise linux desktop, enterprise linux server +4 more +6 moreIt was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker could possibly...7.3 High
- [unknown] jenkinsIncomplete List of Disallowed Inputs in Jenkins3.1 Low
- fasterxml jackson-databind, debian linux, oracle communications billing and revenue management +2 more +4 moreFasterXML jackson-databind allows unauthenticated remote code execution9.8 Critical
- monstraMonstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and...8.8 High
- fasterxml jackson-databind, debian linux, netapp e-series santricity os controller +6 more +8 moreDeserialization of Untrusted Data in jackson-databind8.1 High
- hackerone private address check ruby gem, private address check project address check +1 moreprivate_address_check contains Incomplete List of Disallowed Inputs9.8 Critical
- fasterxml jackson-databind, debian linux, netapp oncommand balance +21 more +23 morejackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution9.8 Critical
- fasterxml jackson-databind, debian linux, netapp oncommand balance +18 more +20 morejackson-databind is vulnerable to a deserialization flaw9.8 Critical
- sugarcrmIncomplete blacklist vulnerability in SuiteCRM 7.2.2 allows remote authenticated users to execute...7.8 High
- red hat, inc. rubygem-safemode, safemode project safemode +1 moreSafemode Gem Has Incomplete List of Disallowed Inputs9.8 Critical
- alinto sogoIncomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users...4.3 Medium
- [unknown] sudosudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if...6.4 Medium