CWE-158.

Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c)

• cesanta mongoose
• Memory corruption
• CWE-158

WebPros cPanel: Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail…

• WebPros cPanel
• CWE-158

socket.getaddrinfo() accepts embedded null bytes in host and port

• Python Software Foundation CPython
• CWE-158

Botan: Python binding bcrypt APIs truncate passwords containing embedded NULs

• randombit botan
• CWE-158

Authentication bypass by spoofing in OpenVPN

• OpenVPN
• Authentication bypass
• CWE-158

Aegisub executes arbitrary code through automatically loaded Automation scripts

• TypesettingTools Aegisub
• CWE-158
• CWE-829

Apache log4net: NUL character truncates OutputDebugStringAppender records

• Apache Software Foundation Apache log4net
• CWE-158

Apache log4net: NUL character truncates EventLogAppender records

• Apache Software Foundation Apache log4net
• CWE-158

Path Traversal through Search Head Clustering in Splunk Enterprise

• Splunk Enterprise
• CWE-158

Electron: shell.openPath path validation bypass via embedded null byte

• CWE-20
• CWE-158

<39.8.6 || >=40.0.0-alpha.1, <40.9.0 || >=41.0.0-alpha.1, <41.1.1 || >=42.0.0-alpha.1, <42.0.0-beta.1 · fixed in 39.8.6, 40.9.0, 41.1.1, 42.0.0-beta.1

Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass)

• envoy
• CWE-158

jq: Embedded NUL in jq import paths causes local redaction-policy bypass and preserves sensitive fields in published artifacts

• jq
• CWE-20
• CWE-158

jq: Embedded NUL truncates top-level jq programs loaded with -f

• jq
• CWE-158

mutt before 2.3.2 does not check for '\0' in url_pct_decode.

• mutt
• CWE-158

mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest.

• mutt
• CWE-158

An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename to be shown in the a…

• Facebook WhatsApp Desktop for Windows
• CWE-158

free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error

• CWE-158
• CWE-248

<1.4.2 · fixed in 1.4.2

Heap-buffer-over-read in _mongoc_http_send via strstr on non-null-terminated buffer

• MongoDB Inc MongoDB C Driver
• CWE-158

Out-of-bounds character read vulnerability in Bluetooth.

• Huawei HarmonyOS
• CWE-158

PhastPress <= 3.7 - Unauthenticated Arbitrary File Read via Null Byte Injection

• kiboit PhastPress
• CWE-158

Unauthenticated Arbitrary File Read via Null Byte Injection

• DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter
• CWE-158

OpenBSD OpenSSH: ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI…

• OpenBSD OpenSSH
• CWE-158

Denial of Service in CivetWeb

• CivetWeb
• CWE-158

BMC Control-M/Agent unescaped NULL byte in access control list checks

• BMC Control-M/Agent
• CWE-158

wftpserver Wing FTP Server: In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes…

• wftpserver Wing FTP Server
• CWE-158

Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-158

Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server

• MongoDB Inc MongoDB Server
• CWE-158

PHP-FPM logs from children may be altered

• PHP
• Other injection
• CWE-158

Xorg-x11-server: selinux unlabeled glx pbuffer

• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• CWE-158

Red Lion Crimson Improper Neutralization of Null Byte or NUL Character

• Red Lion Crimson
• CWE-158

Dell BIOS versions contain an Improper Neutralization of Null Byte vulnerability.

• Dell CPG BIOS
• CWE-158

Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities

• Cisco TelePresence Video Communication Server (VCS) Expressway
• CWE-158

Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities

• Cisco TelePresence Video Communication Server (VCS) Expressway
• CWE-158

Improper neutralization of null byte leads to read overrun

• MongoDB Inc. MongoDB Server
• CWE-158

IMPROPER NEUTRALIZATION OF NULL BYTE OR NUL CHARACTER CWE-158

• Secomea GateManager all versions prior to 9.2c
• CWE-158

Dell Client Consumer and Commercial platforms: Select Dell Client Consumer and Commercial platforms include an issue that allows the…

• Dell Client Consumer and Commercial platforms
• CWE-158

Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 S…

• CWE-158