CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data
The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- hickory-dns Hickory DNS 0.25.0 through 0.25.2 Missing Bailiwick Filtering on Negative Responses 6.3 Medium
- esengine deepseek-reasonix esengine DeepSeek-Reasonix doc.go discoverDocs llm prompting input 5.3 Medium
- apache openoffice Apache OpenOffice: Carefully crafted documents could display different data when opened with different programs, instead of being reported as corrupt. 1.9 Low
- pow-auth assent Unverified Sign in with Apple callback parameter can override verified ID token claims 9.3 Critical
- opentext advanced authentication server Logon bypass (trust of attacker-controlled completed-methods list) 9.2 Critical
-
gixcrates.io gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options() 7.3 High - nuxt-modules og-image Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes 6.9 Medium
- gitlab Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab 4.6 Medium
- polybase payy Payy: agg_agg trailing message slots are unconstrained and allow forged burn messages 8.7 High
- amazon kiro ide Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces 8.6 High
- weblateorg wlc wlc may disclose API tokens to project-configured URLs 2.3 Low
- isc bind 9 Unauthenticated IXFR deltas are applied to the live zone before TSIG verification 6.5 Medium
- isc bind 9 Out-of-zone database nodes can become authoritative zone cuts 5.8 Medium
- devolutions server Laci Synchroni Backend Vulnerable to Account Takeover / User Impersonation via Client-Side Configuration Manipulation 9.2 Critical
- unknown wp fastest cache WP Fastest Cache 0.8.7.7 - 1.5.0 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters 6.5 Medium
- gitlab Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab 4.3 Medium
- django cms association django-cms django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning) 4.8 Medium
- nlnet labs unbound Possible cache poisoning attack by mapping source port population per thread 5.7 Medium
- dell wyse management suite Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous... 9.8 Critical
- powerdns recursor ZoneToCache can poison the cache 7.5 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 more Windows Dynamic Host Configuration Protocol (DHCP) Tampering Vulnerability 9.1 Critical
- nlnet labs unbound Possible cache poisoning via promiscuous records for the authority section 5.7 Medium
- @clerk nuxt, nuxt nuxt\/nitro-server +1 more Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning 2.3 Low
- gitoxide, gitoxide gix, gix-submodule +2 more gitoxide - Command Injection via Partial .gitmodules Override in gix-submodule 7.3 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +18 more +20 more Windows COM Elevation of Privilege Vulnerability 8.4 High
- openclaw OpenClaw < 2026.4.2 - Insufficient Scope in Zalo Webhook Replay Dedupe Keys 6.3 Medium
- openclaw OpenClaw < 2026.3.24 - Arbitrary Code Execution via .npmrc in Local Plugin/Hook Installation 8.4 High
- f5 nginx plus, nginx open source, nginx gateway fabric +2 more +4 more NGINX vulnerability 8.2 High
- vercel next.js Next.js: Middleware / Proxy redirects can be cache-poisoned 3.7 Low
- jetbrains intellij idea In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote... 5.4 Medium
- moxa tn-4500a series, tn-5500a series, tn-g4500 series +1 more +3 more An acceptance of extraneous untrusted data with trusted data vulnerability has been identified in... 0.0 None
- nlnet labs unbound Possible domain hijacking via promiscuous records in the authority section 5.7 Medium
- isc bind 9 Cache poisoning attacks with unsolicited RRs 8.6 High
- wpgmaps wp go maps (formerly wp google maps) WP Go Maps (formerly WP Google Maps) <= 9.0.48 - Unauthenticated Cache Poisoning 5.3 Medium
- nlnet labs unbound Cache poisoning via the ECS-enabled Rebirthday Attack 8.7 High
- isc bind 9 Birthday Attack against Resolvers supporting ECS 8.6 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +27 more +29 more Windows BitLocker Security Feature Bypass Vulnerability 6.8 Medium
- freshrss FreshRSS vulnerable to favicon cache poisoning via proxy 4.3 Medium
- cisco webex meetings A vulnerability in client join services of Cisco Webex Meetings could allow an unauthenticated,... 4.3 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +23 more +25 more UrlMon Security Feature Bypass Vulnerability 7.5 High
- microsoft office, word, 365 apps +9 more +11 more Microsoft Word Security Feature Bypass Vulnerability 7.5 High
- @clerk nuxt Nuxt allows DOS via cache poisoning with payload rendering response 7.5 High
- python-jsonschema check-jsonschema check-jsonschema default caching for remote schemas allows for cache confusion 7.1 High
-
dawidd6/action-download-artifactGitHub Actions Artifact poisoning vulnerability in action-download-artifact v5 and earlier 8.7 High - jetbrains webstorm In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible via... 6.3 Medium
- vercel next.js Cache Poisoning in next.js 7.5 High
- espressif esp-now ESP-NOW Replay Attacks Vulnerability 6.5 Medium
- joomial project cms, joomla joomla\! +1 more [20240802] - Core - Cache Poisoning in Pagination 9.1 Critical
- ec-cube, ec-cube co.,ltd. 4 series +1 more Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4... 7.2 High
- dnsjava DNSJava DNSSEC Bypass 8.9 High
- Show olderLoading…