CWE-184.

Microsoft OneNote Security Feature Bypass Vulnerability

• Microsoft 365 Apps for Enterprise
• Microsoft Office 2019
• CWE-184

Picklescan missing detection when calling built-in python library function timeit.timeit()

• CWE-184

<0.0.25 · fixed in 0.0.25

Picklescan failed to detect to some unsafe global function in Numpy library

• Insecure deserialization
• CWE-184

<0.0.25 · fixed in 0.0.25

Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate

• CWE-184

<0.0.25 · fixed in 0.0.25

picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that uses Pickle and include a malicious p...

• CWE-184
• CWE-646

<0.0.22 · fixed in 0.0.22

Duplicate Advisory: Remote Code Execution via Malicious Pickle File Bypassing Static Analysis

• CWE-184

<=0.0.21 · no fixed version yet

Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion

• CWE-184

<1.0.476 || >=1.1.0, <1.1.11 || >=1.2.0, <1.2.7 · fixed in 1.0.476, 1.1.11, 1.2.7

HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through

• Cross-site scripting (XSS)
• CWE-184

<0.4.0 · fixed in 0.4.0

Wasmtime doesn't fully sandbox all the Windows device filenames

• CWE-67
• CWE-184

>=0.0.0-0, <24.0.2 || >=25.0.0, <25.0.3 || >=26.0.0, <26.0.1 · fixed in 24.0.2, 25.0.3, 26.0.1

Incomplete List of Disallowed Inputs in Kubernetes in k8s.io/kubernetes

• CWE-184

>=1.16.0, <1.18.19 || >=1.19.0, <1.19.11 || >=1.20.0, <1.20.7 || >=1.21.0, <1.21.1 · fixed in 1.18.19, 1.19.11, 1.20.7, 1.21.1

Ankitects Anki LaTeX Blocklist Bypass vulnerability

• CWE-184

<24.6 · fixed in 24.6

Incomplete Input Validation in GlideExpression Script

• ServiceNow Now Platform
• CWE-184

Incomplete Input Validation in SecurelyAccess API

• ServiceNow Now Platform
• CWE-184

Microsoft Outlook Remote Code Execution Vulnerability

• Microsoft 365 Apps for Enterprise
• Microsoft Office 2019
• CWE-184

Incomplete disallowed remote addresses list in MyBB

• mybb
• Server-side request forgery (SSRF)
• CWE-184

Cisco IOS XE Software: A vulnerability in the NETCONF feature of Cisco IOS XE Software could allow an…

• Cisco IOS XE Software
• CWE-184

KaTeX missing normalization of the protocol in URLs allows bypassing forbidden protocols

• CWE-184
• CWE-697

>=0.11.0, <0.16.10 · fixed in 0.16.10

AiLux imx6 bundle: A CWE-184 “Incomplete List of Disallowed Inputs” vulnerability in the embedded Chromium…

• AiLux imx6 bundle
• CWE-184

Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code

• CWE-184
• CWE-697

<7.23.2 || >=8.0.0-alpha.0, <8.0.0-alpha.4 · fixed in 7.23.2, 8.0.0-alpha.4

Privilege Escalation in Bookreen

• Unisign Bookreen
• CWE-184

Apache NiFi Insufficient Property Validation vulnerability

• CWE-184
• CWE-697

>=1.21.0, <1.23.1 · fixed in 1.23.1

SolarWinds Platform Incomplete List of Disallowed Inputs Vulnerability

• SolarWinds Platform
• CWE-184

Grav Server-side Template Injection (SSTI) via Denylist Bypass Vulnerability

• Code injection
• CWE-184

<1.7.42 · fixed in 1.7.42

Grav Server-side Template Injection (SSTI) via Twig Default Filters

• Code injection
• CWE-184

<1.7.42 · fixed in 1.7.42

Shopware Has Improper Control of Generation of Code in Twig rendered views

• Code injection
• CWE-184

<6.4.20.1 · fixed in 6.4.20.1

SvelteKit vulnerable to Cross-Site Request Forgery

• Cross-site request forgery (CSRF)
• CWE-184

<1.15.1 · fixed in 1.15.1

The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may not normally be accessible to users.

• Lenovo XClarity Controller
• CWE-184

Apache Kylin vulnerable to Command injection by Useless configuration

• Command injection
• CWE-184

>=2.0.0, <4.0.3 · fixed in 4.0.3

Exposure of local files in github.com/cortexproject/cortex

• Path traversal
• CWE-184

>=1.13.0, <1.13.2 || >=1.14.0, <1.14.1 · fixed in 1.13.2, 1.14.1

lansweeper: A cross-site scripting (xss) sanitization vulnerability bypass exists in the SanitizeHtml…

• lansweeper
• CWE-184

Crafted link in Zulip message can cause disclosure of credentials

• zulip-mobile
• CWE-184
• CWE-436

JetBrains Ktor before 2.1.0 was vulnerable to a Reflect File Download attack

• CWE-184
• CWE-697

<2.1.0 · fixed in 2.1.0

Agent-to-controller access control allows reading/writing most content of build directories in Jenkins

• CWE-184

<2.303.3 || >=2.304, <2.319 · fixed in 2.303.3, 2.319

Incomplete List of Disallowed Inputs in Jenkins

• CWE-184

<2.32.2 || >=2.34, <2.44 · fixed in 2.32.2, 2.44

Junos OS: QFX5000 Series and EX4600 Series: Control traffic might be dropped if a high rate of specific multicast traffic is received

• Juniper Networks Junos OS
• CWE-184

denylist of executable filename extensions possible to bypass under windows

• The Document Foundation LibreOffice
• CWE-184

grub2: A flaw was found in grub2 in versions prior to 2.06…

• grub2
• CWE-184

Cisco Data Center Network Manager REST API Vulnerabilities

• Cisco Data Center Network Manager
• CWE-184

Cisco Data Center Network Manager REST API Vulnerabilities

• Cisco Data Center Network Manager
• CWE-184

Cisco Data Center Network Manager REST API Vulnerabilities

• Cisco Data Center Network Manager
• CWE-184

Denial of Service in http-proxy

• CWE-184
• CWE-693

<1.18.1 · fixed in 1.18.1

Cisco Data Center Network Manager Command Injection Vulnerability

• Cisco Data Center Network Manager
• CWE-184

Deserialization of Untrusted Data in jackson-databind

• Insecure deserialization
• CWE-184

>=2.8.0, <2.8.11.1 || >=2.9.0, <2.9.4 || <2.7.9.5 · fixed in 2.8.11.1, 2.9.4, 2.7.9.5

Privilege escalation in NetHack

• NetHack
• CWE-184

Incomplete List of Disallowed Inputs in SOFA-Hessian

• Insecure deserialization
• CWE-184

>=4.0.0, <4.0.2 || <3.3.6 · fixed in 4.0.2, 3.3.6

It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509.

• Artifex ghostscript
• CWE-184

jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution

• Insecure deserialization
• CWE-184

>=2.8.0, <2.8.11 || >=2.9.0, <2.9.4 || >=2.0.0, <2.6.7.3 || >=2.7.0, <2.7.9.2 · fixed in 2.8.11, 2.9.4, 2.6.7.3, 2.7.9.2

FasterXML jackson-databind allows unauthenticated remote code execution

• Insecure deserialization
• CWE-184

>=2.8.0, <2.8.11.1 || >=2.9.0, <2.9.5 || >=2.7.0, <2.7.9.3 || <2.6.7.5 · fixed in 2.8.11.1, 2.9.5, 2.7.9.3, 2.6.7.5

jackson-databind is vulnerable to a deserialization flaw

• Insecure deserialization
• CWE-184

<2.6.7.1 || >=2.7.0, <2.7.9.1 || >=2.8.0, <2.8.9 · fixed in 2.6.7.1, 2.7.9.1, 2.8.9

[UNKNOWN] sudo: sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if…

• [UNKNOWN] sudo
• CWE-184

private_address_check contains Incomplete List of Disallowed Inputs

• CWE-184

<0.4.1 · fixed in 0.4.1

Safemode Gem Has Incomplete List of Disallowed Inputs

• CWE-184

<1.3.2 · fixed in 1.3.2