CWE-155.

Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug

• Denial of service
• Broken access control

<0.18.1 · fixed in 0.18.1

Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite

• Authentication bypass
• CWE-155

>=0.6.41, <0.11.1 · fixed in 0.11.1

Pyenv: Glob/wildcard metacharacters bypass is_version_safe(), causing silent version/interpreter substitution via unquoted expansion (CVE-2022-35861 residual)

• pyenv
• Command injection
• CWE-155

Shescape: Path disclosure on Unix with Zsh

• Command injection
• CWE-155

<2.1.14 || >=3.0.0, <3.0.1 · fixed in 2.1.14, 3.0.1

ClipBucket: SQL Wildcard Injection in Subtitle Edit Endpoint Allows Mass Subtitle Overwrite

• MacWarrior clipbucket-v5
• Other injection
• CWE-155

AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN

• Weak cryptography or TLS
• CWE-155

>=0.32.0, <0.39.0 · fixed in 0.39.0

Improper Neutralization of Wildcards or Matching Symbols in CloudEdge Online Cameras and App

• CloudEdge App
• CWE-155

GlobalProtect: Authenticated Code Injection Through Wildcard on macOS

• Palo Alto Networks GlobalProtect App
• CWE-155

laravel-crud-wizard-free has File Validation Bypass

• CWE-155

<3.4.17 · fixed in 3.4.17

Laravel has a File Validation Bypass

• CWE-155

<10.48.29 || >=11.0.0, <11.44.1 || >=12.0.0, <12.1.1 · fixed in 10.48.29, 11.44.1, 12.1.1

KubeWarden's AdmissionPolicy and AdmissionPolicyGroup policies can be used to alter PolicyReport resources in github.com/kubewarden/kubewarden-controller

• Broken access control
• CWE-155

>=1.7.0, <1.21.0 · fixed in 1.21.0

New Rock Technologies Cloud Connected Devices Improper Neutralization of Wildcards or Matching Symbols

• New Rock Technologies OM500 IP-PBX
• New Rock Technologies MX8G VoIP Gateway
• CWE-155

Expedition: Wildcard Expansion Vulnerability

• Palo Alto Networks Cloud NGFW
• Palo Alto Networks Expedition
• CWE-155

Ruijie Reyee OS Improper Neutralization of Wildcards or Matching Symbols

• Ruijie Reyee OS
• CWE-155

PAN-OS: Arbitrary File Read Vulnerability in the Command Line Interface (CLI)

• Palo Alto Networks PAN-OS
• Palo Alto Networks Cloud NGFW
• CWE-155

Resource allocation without limits in Axis Communications AB AXIS OS

• Axis Communications AB AXIS OS
• Denial of service
• CWE-155

Lookup operations do not take into account wildcards in SpiceDB in github.com/authzed/spicedb

• CWE-20
• CWE-155

>=1.3.0, <1.4.0 · fixed in 1.4.0

Axis Communications AB AXIS OS: Sandro Poppi, member of the AXIS OS Bug Bounty Program…

• Axis Communications AB AXIS OS
• CWE-155

Axis Communications AB AXIS OS: Sandro Poppi, member of the AXIS OS Bug Bounty Program…

• Axis Communications AB AXIS OS
• CWE-155

Information Disclosure

• OTRS AG ((OTRS)) Community Edition
• OTRS
• CWE-155

Improper Neutralization of Wildcards or Matching Symbols

• Information disclosure
• CWE-155

>=2.1.0, <2.1.8 || >=2.0.0, <2.1.8 || <1.11.22 · fixed in 2.1.8, 1.11.22