CWE-1288.

JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)

• Eclipse Foundation Eclipse KeyPont - GOSE
• Weak cryptography or TLS
• CWE-20

TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in ssl

• Erlang OTP
• CWE-1288

Junos OS and Junos OS Evolved: An attacker causes l2cpd denial of service when MVRP is used

• Juniper Networks Junos OS
• Juniper Networks Junos OS Evolved
• CWE-1288

Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash if a malformed MCAST-TREE NLRI is received and readvertised

• Juniper Networks Junos OS
• Juniper Networks Junos OS Evolved
• CWE-1288

`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction

• CWE-1288

>=1.1.47, <2.4.0 · fixed in 2.4.0

Windows TCP/IP Security Feature Bypass Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-1288

OOBR in rpcap client in libpcap before 1.10.7

• The Tcpdump Group libpcap
• CWE-126
• CWE-1288

OpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwrite

• CalcProgrammer1 OpenRGB
• CWE-1288

CVAT: Denial of service with regards to automatic annotation

• cvat
• CWE-1288

Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.7
• CWE-1288

Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change

• Red Hat Build of Keycloak
• Red Hat Data Grid 8
• CWE-1288

Windows Secure Kernel Mode Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-1288

Keycloak-services: keycloak-services: oidc email_verified claim incorrectly applied to userinfo email

• Red Hat Build of Keycloak
• Red Hat Data Grid 8
• CWE-1288

RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()

• Linux kernel
• CWE-20
• CWE-1288

Keycloak Services has Improper Validation of Consistency within Input

• CWE-1288

>=26.5.0, <=26.6.4 || <=26.4.7 · no fixed version yet

smb: client: validate the whole DACL before rewriting it in cifsacl

• Linux kernel
• Memory corruption
• CWE-1288

OpenStack Keystone has an Incorrect Authorization Issue

• Broken access control
• CWE-1288

>=13.0.0, <=29.0.1 · no fixed version yet

drm/amd/display: Do not skip unrelated mode changes in DSC validation

• Linux kernel
• Memory corruption
• CWE-1288

crypto: algif_aead - Revert to operating out-of-place

• Linux kernel
• CWE-669
• CWE-1288

Innomic VibroLine Configurator and avibia Configurator allow unintended device reset via USB

• Innomic VibroLine Configurator 5.0
• AvibiaLine Configurator 5.0
• CWE-1288

Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables

• CWE-1288

<1.1.2 · fixed in 1.1.2

Improper validation of payload elements

• arcinfo PcVue
• CWE-940
• CWE-1288

vLLM has a Weakness in MultiModalHasher Image Hashing Implementation

• CWE-1023
• CWE-1288

>=0.7.0, <0.9.0 · fixed in 0.9.0

Improper Validation of Consistency within Input in GitLab

• GitLab
• CWE-1288

tough root metadata version is not checked for sequential versioning

• CWE-1288

<0.20.0 · fixed in 0.20.0

MongoDB Server secondaries may crash due to forced index constraints

• MongoDB Inc MongoDB Server
• CWE-1288

Junos OS and Junos OS Evolved: With BGP traceoptions enabled, receipt of specifically malformed BGP update causes RPD crash

• Juniper Networks Junos OS
• Juniper Networks Junos OS Evolved
• CWE-1288

389-ds-base: malformed userpassword hash may cause denial of service

• Red Hat Directory Server 11.5 E4S for RHEL 8
• Red Hat Directory Server 11.7 for RHEL 8
• CWE-1288

An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330.

• CWE-1288

An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330.

• CWE-1288

JetBrains TeamCity: In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files…

• JetBrains TeamCity
• CWE-1288

In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameter

• JetBrains TeamCity
• CWE-1288

A command injection vulnerability exists in local RACADM.

• Integrated Dell Remote Access Controller 8
• CWE-1288

Candid infinite decoding loop through specially crafted payload

• Denial of service
• CWE-20

>=0.9.0, <0.9.10 · fixed in 0.9.10

Vulnerability in Networking Stack Impacts QNX Software Development Platform (SDP)

• BlackBerry QNX Software Development Platform (SDP)
• CWE-1288

WAGO: DoS in multiple products in multiple versions using Codesys

• Wago 750-8202/xxx-xxx
• Wago 750-8203/xxx-xxx
• CWE-1288

WAGO: DoS in multiple versions of multiple products

• Wago 750-8202/xxx-xxx
• Wago 750-8203/xxx-xxx
• CWE-1288

xmldom allows multiple root nodes in a DOM

• CWE-20
• CWE-1288

<=0.6.0 · no fixed version yet

Invalid RPKI data could disable Route Origin Validation on RTR clients.

• NLnet Labs Routinator
• CWE-1288