CWE-807: Reliance on Untrusted Inputs in a Security Decision
The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +29 more +31 moreWindows Kerberos Elevation of Privilege Vulnerability7.5 High
- mega-fence project mega-fenceMega-Fence (webgate-lib.*) 25.1.914 and prior trusts the first value of the X-Forwarded-For (XFF)...6.5 Medium
- 1panel-dev 1panel1Panel – CAPTCHA Bypass via Client-Controlled Flag7.5 High
- yhirose cpp-httplibcpp-httplib Untrusted HTTP Header Handling: X-Forwarded-For/X-Real-IP Trust5.3 Medium
- yhirose cpp-httplibcpp-httplib Untrusted HTTP Header Handling: Internal Header Shadowing (REMOTE*/LOCAL*)10.0 Critical
- turkguven software technologies inc. perfektiveAuthentication Bypass in Turkguven's Perfektive7.3 High
- oobabooga text-generation-webuioobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability9.8 Critical
- oobabooga text-generation-webuioobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability9.8 Critical
- smub easy digital downloads – ecommerce payments and subscriptions made easyEasy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation5.3 Medium
- microsoft windows 11 version 22h2, windows 11 version 22h3, windows 11 version 23h2 +6 more +8 moreWindows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability7.0 High
- litestar-org litestarX-Forwarded-For Header Spoofing Bypasses Litestar Rate Limiting7.5 High
- github.com/gorilla/csrfImproper validation of TrustedOrigins allows CSRF attacks in github.com/gorilla/csrf7.3 High
- dogukanurker flaskblogflaskBlog allows arbitrary privilege escalation9.3 Critical
- dogukanurker flaskblogflaskBlog Stored XSS Vulnerability5.3 Medium
- sophos firewall, firewall firmware +1 moreA business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21...8.1 High
- cyberark conjurConjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) Vulnerable to Bypass of IAM Authenticator9.1 Critical
- suse opensuse tumbleweedThe logrotate configuration in the python-mailman of openSUSE allows the mailman user to sent SIGHUP to arbitrary proceess4.8 Medium
- lucee serverLucee before 5.4.7.3 LTS and 6 before 6.1.1.118, when an attacker can place files on the server, is vulnerable to a protection mechanism failure that can let an attacker run code that would be expecte…8.8 High
- palo alto networks globalprotect app, globalprotect uwp app +1 moreGlobalProtect App: Local Privilege Escalation (PE) Vulnerability7.1 High
- aws temporary elevated access management (team) for aws iam identity centerRequest approval spoofing in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center5.3 Medium
- lexmark print management clientLexmark has identified a vulnerability in our Lexmark Print Management Client (LPMC).9.3 Critical
- xe xAnubis has a bot protection bypass when a sophisticated attacker asks to pass a challenge of difficulty 02.3 Low
- ecovacs cloud service, home +1 moreECOVACS lawnmower and vacuum cloud service live video PIN bypass6.0 Medium
- traffic alert and collision avoidance system (tcas) ii collision avoidance systemsTraffic Alert and Collision Avoidance System (TCAS) II has a Reliance on Untrusted Inputs in a Security Decision vulnerability6.0 Medium
- ibm security reaqta, security qradar edr +1 moreIBM Security ReaQta improper input validation4.3 Medium
- i3 verticals truefilingTrueFiling authorization bypass via user-controlled keys6.3 Medium
- 2n access commanderIn 2N Access Commander versions 3.1.1.2 and prior, an Insufficient Verification of Data...6.3 Medium
- 63moons aero, wave 2.0 +1 moreAuthentication bypass Vulnerability in Aero9.3 Critical
- sinatraSinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision5.4 Medium
- zephyrproject zephyrBT: Encryption procedure host vulnerability8.2 High
- checkmkPrivilege escalation in mk_informix plugin5.2 Medium
- google chromeInsufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 127.0.6533...4.3 Medium
- tpm2 software tools, tpm2-software tpm2-tools +1 moreMissing check in tpm2_checkquote allows attackers to misrepresent the TPM state9.1 Critical
- checkmkPrivilege escalation in mk_informix plugin8.8 High
- gallagher command centre diagnostics service, command centre +1 moreA reliance on untrusted inputs in a security decision could be exploited by a privileged user to...5.5 Medium
- etsi tetra standard, midnightblue tetra\ +1 moreDCK pinning attack in TETRA7.5 High
- gofiber fiberCSRF Token Reuse Vulnerability in fiber10.0 Critical
- palo alto networks globalprotect app, paloaltonetworks globalprotect +1 moreGlobalProtect App: Local Privilege Escalation (PE) Vulnerability7.8 High
- cisco firepower management center, secure firewall management center +1 moreCisco Firepower Management Center Software Information Disclosure Vulnerability4.3 Medium
- opensuse build service, open build service +1 morelogin-proxy sends password to attacker-provided domain8.1 High
- convoypanel panelAuthentication bypass in Pterodactyl8.1 High
- rancher, rancher suse linux enterprise server 15, suse linux enterprise server 15 +2 moreRancher: Privilege escalation vulnerability via malicious Connection header8.8 High
- ratpackCached redirect poisoning via X-Forwarded-Host header7.0 High
- mattermost serverMattermost Server server restarts may provide attackers with API access9.8 Critical
- pyup safetyMalicious package may avoid detection in python auditing5.0 Medium
- synacor zimbra collaboration suite, zimbra collaboration suite (zcs) +1 moreZimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8...7.5 High
- sony neural network librariesSony Neural Network Libraries reliance on untrusted inputs prior to v1.0.109.8 Critical
- hackerone nextcloud server, nextcloud server +1 moreNextcloud Server before 9.0.55 and 10.0.2 suffers from a bypass in the quota limitation. Due to...4.3 Medium