CWE-436: Interpretation Conflict
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
A kind of CWE-435 Interaction Error.
From the CWE List. © The MITRE Corporation.
Newest
- nodemailerNodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment6.9 Medium
- kornelski http-cache-semanticshttp-cache-semantics through 4.2.0 Cross-Client Cache Disclosure via Vary Wildcard8.2 High
- internlm lmdeployLMDeploy URL parser disagreement permits SSRF filter bypass7.5 High
- nodemailerNodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass8.3 High
- nodemailerNodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment8.3 High
- openclaw clawscanOpenClaw ClawScan File Classifier static_scanner.go IsBinaryFile interpretation conflict2.4 Low
- fast-urifast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization4.8 Medium
- traefikTraefik entrypoint header-name sanitization bypassed via request trailers7.0 High
- google chromeInterpretation conflict in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed...6.5 Medium
- roocodeinc roo-codeRoo-Code 3.54.0 Auto-Approve Bypass via Shell Parser Word-Boundary Mismatch7.7 High
- microsoft visual studio codeVisual Studio Code Security Feature Bypass Vulnerability8.2 High
- @fastify/middie, fastify fastify\/middie +1 more@fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target9.1 Critical
- fast-urifast-uri vulnerable to host confusion via an unclosed bracket in the URI authority7.5 High
- mikel mailMail: Email address spoofing via malformed RFC 2047 encoded-words5.3 Medium
- envoyproxy envoyEnvoy: RBAC Authorization Bypass via Path Parameters7.5 High
- envoyproxy envoyEnvoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)5.3 Medium
- goauthentik authentikauthentik: Account Takeover via SAML NameID Comment Truncation9.4 Critical
- python software foundation cpython, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morestringprep.map_table_b2() deviates from RFC 3454 Table B.26.0 Medium
- ondata ckan-mcp-serverCKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning6.5 Medium
- jovancoding network-aiNetwork-AI SandboxPolicy before 5.15.1 Blocklist Bypass via Quote Mismatch8.7 High
- jovancoding network-aiNetwork-AI ClaudeHookBridge Deny Pattern Bypass via Truncation8.7 High
- ibm iIBM i is Affected By security restrictions bypass in Navigator for i3.0 Low
- apache airflowApache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id7.5 High
- @fastify/static, fastify fastify-static +1 more@fastify/static vulnerable to route guard bypass via non-canonical path segments7.5 High
- fast-urifast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references7.5 High
- guzzleGuzzle: Noncanonical host can bypass host-based checks7.2 High
- fast-urifast-uri vulnerable to host confusion via backslash authority introducer7.5 High
- nodejs undiciundici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives5.9 Medium
- vlang vV 0.5.2 SSRF Bypass via Parser Differential in net.urllib and net.http7.7 High
- red hat openshift container platform 4.12, openshift container platform 4.13, openshift container platform 4.14 +8 more +10 moreOpenshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreams8.5 High
- fast-urifast-uri vulnerable to host confusion via literal backslash authority delimiter7.5 High
- wordpress, wordpress core +1 moreWordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution9.8 Critical
- cap-go capgoCapgo - Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore Decoding5.3 Medium
- elysiajs elysiaElysia: Inefficient Algorithmic Complexity and Interpretation Conflict7.5 High
- guzzle psr7, guzzlephp psr-7 +1 moreguzzlehttp/psr7: Host Confusion via Weak URI Host Validation4.2 Medium
github.com/tinfoil-factory/netfoilGonetfoil has a domain name filter bypass via multiple questions5.9 Medium- @fastify/middie, fastify fastify\/middie +1 more@fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values9.1 Critical
- cedar-policy authorization-for-expressjs@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation8.8 High
- fast-uri, red hat cluster observability operator 1.5.0, confidential compute attestation +49 more +51 morefast-uri vulnerable to host confusion via failed IDN canonicalization7.5 High
- octoprintOctoPrint: File exfiltration possible via query parameters on upload endpoints7.0 High
- vllm-project vllm, red hat ai inference server, enterprise linux ai (rhel ai) 3 +1 more +3 moreVllm: vllm: image exif rotation & png trns transparency not normalized, causing mismatch between model input and expectations4.8 Medium
- umputun remark42Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing8.2 High
- fastapiexpert python-multipartPython-Multipart: Semicolon treated as querystring field separator enables parameter smuggling3.7 Low
- fastapiexpert python-multipartPython-Multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters3.7 Low
- nodemailerNodemailer before 9.1.0 Denial of Service via addressparser8.7 High
- jetbrains runtime, sensiolabs symfony +1 moreSymfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch8.3 High
- typo3 html sanitizerTYPO3 HTML Sanitizer allows Cross-Site Scripting2.1 Low
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification2.3 Low
- hapijs contentParameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parameters7.7 High
- @fedify fedifyFedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring7.0 High
- Show moreLoading…