# CWE-1286.

Every Advisory and CVE whose sources give the weakness CWE-1286, newest first.

## Records, newest first (an older page)

- [Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict](https://agentprime.io/advisories/GHSA-mm7p-fcc7-pg87.md)
  `GHSA-mm7p-fcc7-pg87`, `CVE-2025-13033` · npm `nodemailer`: affected `<7.0.7`, fixed in `7.0.7` · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2025 · Tags: CWE-20, CWE-436, CWE-1286
- [IBM Planning Analytics Local information disclosure](https://agentprime.io/advisories/CVE-2025-36262.md)
  `CVE-2025-36262` · CVE record: IBM Planning Analytics Local · CVSS 4.9 Medium · Not analysed yet · Published 30 Sept 2025 · Tags: CWE-1286
- [github.com/nyaruka/phonenumbers Vulnerable to Improper Validation of Syntactic Correctness of Input](https://agentprime.io/advisories/GHSA-fmjh-f678-cv3x.md)
  `GHSA-fmjh-f678-cv3x`, `CVE-2025-10954`, `GO-2025-3987` · Go `github.com/nyaruka/phonenumbers`: affected `<1.2.2`, fixed in `1.2.2` · CVSS 6.9 Medium · Not analysed yet · Published 27 Sept 2025 · Tags: CWE-1286
- [Asterisk remotely exploitable leak of RTP UDP ports and internal resources](https://agentprime.io/advisories/CVE-2025-54995.md)
  `CVE-2025-54995` · CVE record: asterisk asterisk · CVSS 6.5 Medium · Not analysed yet · Published 28 Aug 2025 · Tags: Denial of service, CWE-1286
- [Microsoft Exchange Server Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2025-25007.md)
  `CVE-2025-25007` · CVE record: Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 and 3 more · CVSS 5.3 Medium · Not analysed yet · Published 12 Aug 2025 · Tags: CWE-1286
- [golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability](https://agentprime.io/advisories/GHSA-6v2p-p543-phr9.md)
  `GHSA-6v2p-p543-phr9`, `CVE-2025-22868`, `GO-2025-3488` · Go `golang.org/x/oauth2`: affected `<0.27.0`, fixed in `0.27.0` · CVSS 7.5 High · Not analysed yet · Published 18 Jul 2025 · Tags: CWE-1286
- [Unauthenticated Denial of Service (DoS) via malformed WS-Scan request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.](https://agentprime.io/advisories/CVE-2024-51983.md)
  `CVE-2024-51983` · CVE record: Brother Industries, Ltd HL-L8260CDN and 4 more · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.12 · Not analysed yet · Published 25 Jun 2025 · Tags: CWE-1286
- [Unauthenticated Denial of Service (DoS) via malformed PJL request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, and Ricoh.](https://agentprime.io/advisories/CVE-2024-51982.md)
  `CVE-2024-51982` · CVE record: Brother Industries, Ltd HL-L8260CDN and 4 more · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.11 · Not analysed yet · Published 25 Jun 2025 · Tags: CWE-1286
- [Denial of service due to improper handling of malformed input.](https://agentprime.io/advisories/CVE-2025-30415.md)
  `CVE-2025-30415` · CVE record: Acronis Acronis Cyber Protect Cloud Agent and 1 more · CVSS 7.5 High · Not analysed yet · Published 4 Jun 2025 · Tags: CWE-1286
- [F5OS-A/C CLI vulnerability](https://agentprime.io/advisories/CVE-2025-43878.md)
  `CVE-2025-43878` · CVE record: F5 F5OS - Appliance and 1 more · CVSS 8.3 High · Not analysed yet · Published 7 May 2025 · Tags: CWE-149, CWE-1286
- [A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipulate the wireless network configuration f…](https://agentprime.io/advisories/CVE-2025-24348.md)
  `CVE-2025-24348` · CVE record: Bosch Rexroth AG ctrlX OS - Device Admin · CVSS 5.4 Medium · Not analysed yet · Published 30 Apr 2025 · Tags: CWE-1286
- [A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipulate the network configuration file via a…](https://agentprime.io/advisories/CVE-2025-24347.md)
  `CVE-2025-24347` · CVE record: Bosch Rexroth AG ctrlX OS - Device Admin · CVSS 6.5 Medium · Not analysed yet · Published 30 Apr 2025 · Tags: CWE-1286
- [A vulnerability in the “Proxy” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to manipulate the “/etc/environment” file via a crafted HTTP req…](https://agentprime.io/advisories/CVE-2025-24346.md)
  `CVE-2025-24346` · CVE record: Bosch Rexroth AG ctrlX OS - Device Admin · CVSS 7.5 High · Not analysed yet · Published 30 Apr 2025 · Tags: CWE-1286
- [A vulnerability in the “Hosts” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipulate the “hosts” file in an unintended manner via a cr…](https://agentprime.io/advisories/CVE-2025-24345.md)
  `CVE-2025-24345` · CVE record: Bosch Rexroth AG ctrlX OS - Device Admin · CVSS 6.3 Medium · Not analysed yet · Published 30 Apr 2025 · Tags: CWE-1286
- [Westermo WeOS 5 through 5.23.0 allows a reboot via a malformed ESP packet.](https://agentprime.io/advisories/CVE-2025-46419.md)
  `CVE-2025-46419` · CVE record: Westermo WeOS · CVSS 5.9 Medium · Not analysed yet · Published 24 Apr 2025 · Tags: CWE-1286
- [Traefik affected by Go oauth2/jws Improper Validation of Syntactic Correctness of Input vulnerability](https://agentprime.io/advisories/GHSA-3wqc-mwfx-672p.md)
  `GHSA-3wqc-mwfx-672p` · Go `github.com/traefik/traefik/v2` and 1 more: affected `<2.11.24`, fixed in `2.11.24` · CVSS 7.5 High · Not analysed yet · Published 18 Apr 2025 · Tags: CWE-1286
- [IBM App Connect Enterprise Certified Container denial of service](https://agentprime.io/advisories/CVE-2024-52362.md)
  `CVE-2024-52362` · CVE record: IBM App Connect Enterprise Certified Container · CVSS 4.3 Medium · Not analysed yet · Published 12 Mar 2025 · Tags: CWE-1286
- [In Modem, there is a possible memory corruption due to incorrect error handling.](https://agentprime.io/advisories/CVE-2025-20644.md)
  `CVE-2025-20644` · CVE record: MediaTek, Inc. MT2735, MT2737, MT6833, MT6833P, MT6853, MT6853T, MT6855, MT6855T, MT6873, MT6875, MT6875T, MT6877, MT6877T, MT6877TT, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895TT, MT6896, MT6980, MT6980D, MT6983, MT6983T, MT6985, MT6985T, MT6989, MT6989T, MT6990, MT8673, MT8791T, MT8795T, MT8798 · CVSS 6.5 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: CWE-1286
- [Siemens SIMATIC S7-1200 CPU 1211C AC/DC/Rly: A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly…](https://agentprime.io/advisories/CVE-2025-24812.md)
  `CVE-2025-24812` · CVE record: Siemens SIMATIC S7-1200 CPU 1211C AC/DC/Rly and 4 more · CVSS 7.1 High · Not analysed yet · Published 11 Feb 2025 · Tags: CWE-1286
- [Routinator crashes when illegal characters are present in manifest file names](https://agentprime.io/advisories/CVE-2025-0638.md)
  `CVE-2025-0638` · CVE record: NLnet Labs Routinator · CVSS 7.5 High · Not analysed yet · Published 22 Jan 2025 · Tags: CWE-1286
- [Axis Communications AB AXIS OS: Erik de Jong, member of the AXIS OS Bug Bounty Program…](https://agentprime.io/advisories/CVE-2024-8160.md)
  `CVE-2024-8160` · CVE record: Axis Communications AB AXIS OS · CVSS 3.8 Low · Not analysed yet · Published 26 Nov 2024 · Tags: CWE-1286
- [Axis Communications AB AXIS OS: 51l3nc3, member of the AXIS OS Bug Bounty Program…](https://agentprime.io/advisories/CVE-2024-8772.md)
  `CVE-2024-8772` · CVE record: Axis Communications AB AXIS OS · CVSS 4.3 Medium · Not analysed yet · Published 26 Nov 2024 · Tags: CWE-1286
- [Eclipse Jetty URI parsing of invalid authority](https://agentprime.io/advisories/GHSA-qh8g-58pp-2wxh.md)
  `GHSA-qh8g-58pp-2wxh`, `CVE-2024-6763` · Maven `org.eclipse.jetty:jetty-http`: affected `>=7.0.0, <12.0.12`, fixed in `12.0.12` · CVSS 3.7 Low · Not analysed yet · Published 14 Oct 2024 · Tags: CWE-1286
- [Denial of Service in TYPO3 Bookmark Toolbar](https://agentprime.io/advisories/GHSA-ffcv-v6pw-qhrp.md)
  `GHSA-ffcv-v6pw-qhrp`, `CVE-2024-34537`, `PKSA-9vjc-5m3y-9mrq` · Packagist `typo3/cms-backend`: affected `>=10.0.0, <10.4.46 || >=11.0.0, <11.5.40 || >=12.0.0, <12.4.21 || >=13.0.0, <13.3.1`, fixed in `10.4.46`, `11.5.40`, `12.4.21`, `13.3.1` · CVSS 2.7 Low · Not analysed yet · Published 8 Oct 2024 · Tags: CWE-248, CWE-1286
- [Axis Communications AB AXIS OS: 51l3nc3, member of the AXIS OS Bug Bounty Program…](https://agentprime.io/advisories/CVE-2024-6173.md)
  `CVE-2024-6173` · CVE record: Axis Communications AB AXIS OS · CVSS 6.5 Medium · Not analysed yet · Published 10 Sept 2024 · Tags: CWE-1286
- [SPIP porte_plume Plugin Arbitrary PHP Execution](https://agentprime.io/advisories/CVE-2024-7954.md)
  `CVE-2024-7954` · CVE record: SPIP SPIP · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.90 · Not analysed yet · Published 23 Aug 2024 · Tags: Code injection, CWE-1286
- [Junos OS and Junos OS Evolved: A malformed CFM packet or specific transit traffic leads to FPC crash](https://agentprime.io/advisories/CVE-2024-39542.md)
  `CVE-2024-39542` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 8.7 High · Not analysed yet · Published 11 Jul 2024 · Tags: CWE-1286
- [github.com/google/nftable IP addresses were encoded in the wrong byte order](https://agentprime.io/advisories/GHSA-qjvf-8748-9w7h.md)
  `GHSA-qjvf-8748-9w7h`, `CVE-2024-6284`, `GO-2024-2977` · Go `github.com/google/nftables`: affected `>=0.1.0, <0.2.0`, fixed in `0.2.0` · CVSS 6.3 Medium · Not analysed yet · Published 4 Jul 2024 · Tags: CWE-20, CWE-1286, CWE-1389
- [An issue in FinalWire AIRDA Extreme, AIDA64 Engineer, AIDA64 Business, AIDA64 Network Audit through 7.00.6742 allows a local attacker to escalate privileges via the DeviceIoControl call associated wi…](https://agentprime.io/advisories/CVE-2024-26507.md)
  `CVE-2024-26507` · CVE record · CVSS 7.8 High · Not analysed yet · Published 10 Jun 2024 · Tags: CWE-1286
- [Improper input validation in the user management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to cause a partial DoS of web interface via HTTP POST r…](https://agentprime.io/advisories/CVE-2023-43850.md)
  `CVE-2023-43850` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 28 May 2024 · Tags: CWE-1286
- [Junos OS and Junos OS Evolved: A malformed BGP tunnel encapsulation attribute will lead to an rpd crash](https://agentprime.io/advisories/CVE-2024-21598.md)
  `CVE-2024-21598` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 8.7 High · Not analysed yet · Published 12 Apr 2024 · Tags: CWE-1286
- [PAN-OS: Firewall Denial of Service (DoS) via Malformed NTLM Packets](https://agentprime.io/advisories/CVE-2024-3384.md)
  `CVE-2024-3384` · CVE record: Palo Alto Networks PAN-OS and 2 more · CVSS 7.5 High · Not analysed yet · Published 10 Apr 2024 · Tags: CWE-1286
- [DoS on IDS parsing of malformed Radius packets in Guardian before 23.4.1](https://agentprime.io/advisories/CVE-2024-0218.md)
  `CVE-2024-0218` · CVE record: Nozomi Networks Guardian · CVSS 8.2 High · Not analysed yet · Published 10 Apr 2024 · Tags: CWE-1286
- [DJI Mini 3 Pro: An Improper Input Validation vulnerability affecting the FTP service running on the DJI…](https://agentprime.io/advisories/CVE-2023-6950.md)
  `CVE-2023-6950` · CVE record: DJI Mini 3 Pro · CVSS 3.0 Low · Not analysed yet · Published 2 Apr 2024 · Tags: CWE-1286
- [Express.js Open Redirect in malformed URLs](https://agentprime.io/advisories/GHSA-rv95-896h-c2vc.md)
  `GHSA-rv95-896h-c2vc`, `CVE-2024-29041` · npm `express`: affected `<4.19.2 || >=5.0.0-alpha.1, <5.0.0-beta.3`, fixed in `4.19.2`, `5.0.0-beta.3` · CVSS 6.1 Medium · Not analysed yet · Published 25 Mar 2024 · Tags: Open redirect, CWE-1286
- [Junos OS: MX Series and SRX Series: Processing of a specific SIP packet causes NAT IP allocation to fail](https://agentprime.io/advisories/CVE-2024-21616.md)
  `CVE-2024-21616` · CVE record: Juniper Networks Junos OS · CVSS 7.5 High · Not analysed yet · Published 12 Jan 2024 · Tags: CWE-1286
- [Junos OS: EX4100, EX4400, EX4600, QFX5000 Series: A high rate of specific ICMP traffic will cause the PFE to hang](https://agentprime.io/advisories/CVE-2024-21595.md)
  `CVE-2024-21595` · CVE record: Juniper Networks Junos OS · CVSS 7.5 High · Not analysed yet · Published 12 Jan 2024 · Tags: CWE-1286
- [Junos OS and Junos OS Evolved: The rpd will crash upon receiving a malformed BGP UPDATE message](https://agentprime.io/advisories/CVE-2023-44204.md)
  `CVE-2023-44204` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 12 Oct 2023 · Tags: CWE-1286
- [DoS on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0](https://agentprime.io/advisories/CVE-2023-32649.md)
  `CVE-2023-32649` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 8.2 High · Not analysed yet · Published 19 Sept 2023 · Tags: CWE-1286
- [DoS via SAML configuration in Guardian/CMC before 22.6.2](https://agentprime.io/advisories/CVE-2023-23903.md)
  `CVE-2023-23903` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 9 Aug 2023 · Tags: CWE-1286
- [Partial DoS on Reports section due to null report name in Guardian/CMC before 22.6.2](https://agentprime.io/advisories/CVE-2023-24015.md)
  `CVE-2023-24015` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 9 Aug 2023 · Tags: CWE-1286
- [Denial-of-Service vulnerability in Axis Network Door Controller's and Axis Network Intercom's OSDP communication](https://agentprime.io/advisories/CVE-2023-21405.md)
  `CVE-2023-21405` · CVE record: Axis Communications AB AXIS A1001 Network Door Controller and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 25 Jul 2023 · Tags: CWE-754, CWE-1286
- [SRX Series and MX Series: An FPC core is observed when IDP is enabled on the device and a specific malformed SSL packet is received](https://agentprime.io/advisories/CVE-2023-28985.md)
  `CVE-2023-28985` · CVE record: Juniper Networks Junos OS · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2023 · Tags: CWE-1286
- [The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character.](https://agentprime.io/advisories/CVE-2023-27043.md)
  `CVE-2023-27043` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 18 Apr 2023 · Tags: CWE-20, CWE-1286
- [Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in the device.](https://agentprime.io/advisories/CVE-2021-44695.md)
  `CVE-2021-44695` · CVE record: Siemens SIMATIC Drive Controller CPU 1504D TF and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 13 Dec 2022 · Tags: CWE-1286
- [Junos OS Evolved: PTX Series: An attacker can cause a kernel panic by sending a malformed TCP packet to the device](https://agentprime.io/advisories/CVE-2022-22192.md)
  `CVE-2022-22192` · CVE record: Juniper Networks Junos OS Evolved · CVSS 7.5 High · Not analysed yet · Published 18 Oct 2022 · Tags: CWE-1286
- [protobuf-cpp and protobuf-python have potential Denial of Service issue](https://agentprime.io/advisories/GHSA-8gq9-2x98-w8hf.md)
  `GHSA-8gq9-2x98-w8hf`, `CVE-2022-1941`, `PYSEC-2026-899` · PyPI `protobuf`: affected `<3.18.3 || >=3.19.0, <3.19.5 || >=3.20.0, <3.20.2 || >=4.0.0, <4.21.6`, fixed in `3.18.3`, `3.19.5`, `3.20.2`, `4.21.6` · CVSS 7.5 High · Not analysed yet · Published 23 Sept 2022 · Tags: Memory corruption, CWE-1286
- [Junos OS: In a scenario with dhcp-security and option-82 configured jdhcpd crashes upon receipt of a malformed DHCP packet](https://agentprime.io/advisories/CVE-2022-22176.md)
  `CVE-2022-22176` · CVE record: Juniper Networks Junos OS · CVSS 7.4 High · Not analysed yet · Published 19 Jan 2022 · Tags: CWE-1286
- [A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and Line Feed (CRLF) control characters and include arbitrary S…](https://agentprime.io/advisories/CVE-2021-31988.md)
  `CVE-2021-31988` · CVE record: Axis Communications AB AXIS OS · No CVSS score · Not analysed yet · Published 5 Oct 2021 · Tags: CWE-1286
- [A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass blocked network recipients.](https://agentprime.io/advisories/CVE-2021-31987.md)
  `CVE-2021-31987` · CVE record: Axis Communications AB AXIS OS · No CVSS score · Not analysed yet · Published 5 Oct 2021 · Tags: CWE-1286
- [Command Injection Vulnerability in Video Station](https://agentprime.io/advisories/CVE-2021-28812.md)
  `CVE-2021-28812` · CVE record: QNAP Systems Inc. Video Station · CVSS 8.8 High · Not analysed yet · Published 3 Jun 2021 · Tags: Command injection, CWE-1286
- [Philips Patient Monitoring Devices Improper Validation of Syntactic Correctness of Input](https://agentprime.io/advisories/CVE-2020-16220.md)
  `CVE-2020-16220` · CVE record: Philips Patient Information Center iX (PICiX) and 1 more · No CVSS score · Not analysed yet · Published 11 Sept 2020 · Tags: CWE-1286

Newest: <https://agentprime.io/advisories/tag/cwe-1286.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-1286&cursor=WyIyMDI1LTEwLTA5VDIyOjE1OjU3LjAwMDAwMFoiLCJHSFNBLXE1cjYtOXF3cS1nMndqIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-1286/?cursor=WyIyMDI1LTEwLTA5VDIyOjE1OjU3LjAwMDAwMFoiLCJHSFNBLXE1cjYtOXF3cS1nMndqIl0>. Everything for agents: <https://agentprime.io/llms.txt>.