CWE-436: Interpretation Conflict
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
A kind of CWE-435 Interaction Error.
From the CWE List. © The MITRE Corporation.
Newest
- git-ecosystem git-credential-managerCarriage-return character in remote URL allows malicious repository to leak credentials in Git Credential Manager7.4 High
- fortinet fortios, fortiproxy +1 moreAn improper neutralization of crlf sequences in http headers ('http response splitting') in...6.4 Medium
- oisf suricataSuricata generic detection bypass using TCP urgent support7.5 High
- ibm aspera faspexIBM Aspera Faspex bypass security5.9 Medium
- ciliumCilium's Gateway API route matching order contradicts specification4.0 Medium
- openstack novaOpenStack Nova vulnerable to unauthorized access to potentially sensitive data6.5 Medium
- phpseclibName confusion in x509 Subject Alternative Name fields7.5 High
- gnu wgeturl.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and...9.1 Critical
- cisco adaptive security appliance, adaptive security appliance (asa) software, adaptive security appliance software +3 more +5 moreA vulnerability in the activation of an access control list (ACL) on Cisco Adaptive Security...5.8 Medium
- btcdbtcd susceptible to consensus failures7.5 High
- softing secure integration serverSofting Secure Integration Server Interpretation Conflict Remote Code Execution Vulnerability6.6 Medium
- palo alto networks pan-os, cloud ngfw, prisma access +2 morePAN-OS: Predefined Decryption Exclusions Does Not Work as Intended5.3 Medium
- hcl software bigfix platformHCL BigFix Platform is susceptible to a Denial of Service attack3.5 Low
- curl, apple macos, fedoraproject fedora +12 more +14 moreUsage of disabled protocol3.5 Low
- carrierwave project carrierwaveCarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remained6.8 Medium
amavisAlpine,amavisd-newDebian +1 moreAmavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an...7.4 High- ibm powerscIBM PowerSC weak security5.3 Medium
- brefphp brefBref Body Parsing Inconsistency in Event-Driven Functions3.7 Low
- brefphp brefBref Multiple Value Headers Not Supported in ApiGatewayFormatV24.8 Medium
- trillium, trillium trillium-http +1 moretrillium-http and trillium-client vulnerable to HTTP Request/Response Splitting6.8 Medium
- bosch nexo-os, rexroth nexo cordless nutrunner nxa011s-36v (0608842011), nexo cordless nutrunner nxa011s-36v-b (0608842012) +18 more +20 moreThe vulnerability allows a remote attacker to inject arbitrary HTTP response headers or...5.3 Medium
- fishshell fish, fish-shell +1 moreCommand substitution output can trigger shell expansion in fish shell3.9 Low
- fortinet ips engine, fortios ips engine +1 moreA interpretation conflict in Fortinet IPS Engine versions 7.321, 7.166 and 6.158 allows attacker...6.7 Medium
- go standard library net/http, golang go +1 moreInsufficient sanitization of Host header in net/http6.5 Medium
- goauthentik authentikAuthentik lacks Proxy IP headers validation8.3 High
- huawei bisheng-wnm, bisheng-wnm firmware +1 moreThere is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of...7.5 High
- huawei bisheng-wnm, bisheng-wnm firmware +1 moreThere is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of...7.5 High
- splunk, splunk cloud platform, enterprise +2 moreHTTP Response Splitting via the ‘rest’ SPL Command7.2 High
nyholm/psr7PackagistImproper Input Validation in nyholm/psr75.3 Mediumhttpsoft/http-messagePackagistImproper header validation in httpsoft/http-message5.3 Medium- slimframework slim psr-7, slimphp slim-psr7 +1 moreInsecure header validation in slim/psr76.5 Medium
- guzzle psr7, guzzlephp psr-7, fedoraproject fedora +2 moreImproper header name validation in guzzlehttp/psr75.3 Medium
- openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 moreTransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts5.3 Medium
- linux kernelIn the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the...5.5 Medium
- huawei bisheng-wnm, bisheng-wnm firmware +1 moreThere is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325. Successful...7.5 High
- huawei bisheng-wnm, bisheng-wnm firmware +1 moreThere is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325. Successful...7.5 High
- fortinet fortios, fortiproxy +1 moreA improper neutralization of crlf sequences in http headers ('http response splitting') in...4.0 Medium
- zulip, zulip server +1 moreUser uploads proxied from S3 lack `Content-Security-Policy` headers, may be served with `Content-Disposition: inline` in zulip4.4 Medium
- dompdfURI validation failure on SVG parsing. Bypass of CVE-2023-2392410.0 Critical
- onshift turbogearsOnShift TurboGears HTTP Header controllers.py response splitting6.3 Medium
- owasp modsecurity, debian linux +1 moreIn ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed...7.5 High
- apache http serverApache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting5.3 Medium
- apache shiro, vmware spring boot +1 moreApache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP request7.5 High
- netty, debian linux +1 moreNetty vulnerable to HTTP Response splitting from assigning header value iterator6.5 Medium
- solarwinds security event manager, sem +1 moreInsecure Methods Vulnerability5.3 Medium
- ruby-lang cgi, ruby, fedoraproject fedora +2 moreHTTP response splitting in CGI8.8 High
- cisco ios xe software, ios xe +1 moreCisco IOS XE Software IPv6 VPN over MPLS Denial of Service Vulnerability7.4 High
- asus rt-ax88u firmwareAn HTTP response splitting attack in web application in ASUS RT-AX88U before v3.0.0.4.388.20558...6.5 Medium
- zulipIP address leak via image proxy bypass in Zulip Server4.3 Medium
- zitadelBroken Authorization in ZITADEL Actions8.7 High
- Show moreLoading…