# CWE-233.

Every Advisory and CVE whose sources give the weakness CWE-233, newest first.

## Records, newest first

- [Lookyloo: Potential sub-system DoS due to parameter missmatch in notification](https://agentprime.io/advisories/CVE-2026-55835.md)
  `CVE-2026-55835` · CVE record: Lookyloo lookyloo · CVSS 6.9 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-233
- [Insufficient parameter validation in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety](https://agentprime.io/advisories/CVE-2026-0515.md)
  `CVE-2026-0515` · CVE record: BlackBerry Ltd QNX Software Development Platform and 2 more · CVSS 6.2 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-233
- [This vulnerability in Veeam Service Provider Console allows for remote code execution.](https://agentprime.io/advisories/CVE-2026-32998.md)
  `CVE-2026-32998` · CVE record: Veeam Service Provider Console · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 May 2026 · Tags: CWE-233
- [Arqit SKA-Platform Improper Handling of Parameters Vulnerability](https://agentprime.io/advisories/CVE-2026-33585.md)
  `CVE-2026-33585` · CVE record: Arqit Symmetric Key Agreement Platform · CVSS 3.8 Low · Not analysed yet · Published 13 May 2026 · Tags: CWE-233
- [WebDrive 18.00.5057 Denial of Service via Secure WebDAV](https://agentprime.io/advisories/CVE-2018-25233.md)
  `CVE-2018-25233` · CVE record: Webdrive WebDrive · CVSS 6.9 Medium · Not analysed yet · Published 30 Mar 2026 · Tags: CWE-233
- [Improper Handling of Parameters in GitLab](https://agentprime.io/advisories/CVE-2026-2370.md)
  `CVE-2026-2370` · CVE record: GitLab GitLab · CVSS 8.1 High · Not analysed yet · Published 29 Mar 2026 · Tags: CWE-233
- [Improper handling of parameters in the AMD Secure Processor (ASP) could allow a privileged attacker to pass an arbitrary memory value to functions in the trusted execution environment resulting in ar…](https://agentprime.io/advisories/CVE-2023-20514.md)
  `CVE-2023-20514` · CVE record: AMD AMD Radeon™ RX 6000 Series Graphics Products and 4 more · CVSS 8.7 High · Not analysed yet · Published 11 Feb 2026 · Tags: CWE-233
- [Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can cause abnormal device behavior by crafting specific messages.](https://agentprime.io/advisories/CVE-2026-22626.md)
  `CVE-2026-22626` · CVE record: HIKSEMI HS-AFS-S1H1 · CVSS 4.9 Medium · Not analysed yet · Published 30 Jan 2026 · Tags: CWE-233
- [Improper Parameter Check in ThreadX Syscall Implementation](https://agentprime.io/advisories/CVE-2025-55080.md)
  `CVE-2025-55080` · CVE record: Eclipse Foundation ThreadX · CVSS 7.2 High · Not analysed yet · Published 15 Oct 2025 · Tags: CWE-233
- [Incomplete validation of kernel object pointers in system calls](https://agentprime.io/advisories/CVE-2025-55078.md)
  `CVE-2025-55078` · CVE record: Eclipse Foundation ThreadX · CVSS 5.7 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: CWE-233
- [Fortinet FortiWeb: A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below…](https://agentprime.io/advisories/CVE-2025-52970.md)
  `CVE-2025-52970` · CVE record: Fortinet FortiWeb · CVSS 7.7 High · Critical (CVSS 7+ and EPSS) · EPSS 0.10 · Not analysed yet · Published 12 Aug 2025 · Tags: CWE-233
- [Debezium database connector has a script injection vulnerability](https://agentprime.io/advisories/GHSA-hvw5-3mgw-7rcf.md)
  `GHSA-hvw5-3mgw-7rcf`, `CVE-2023-1419` · Maven `io.debezium:debezium-connector-mysql` and 2 more: affected `<2.3.0.Alpha1`, fixed in `2.3.0.Alpha1` · CVSS 5.9 Medium · Not analysed yet · Published 17 Nov 2024 · Tags: CWE-233
- [Eclipse Glassfish improperly handles http parameters](https://agentprime.io/advisories/GHSA-jq3f-mfmg-747x.md)
  `GHSA-jq3f-mfmg-747x`, `CVE-2024-9329` · Maven `org.glassfish.main.admin:rest-service`: affected `<7.0.17`, fixed in `7.0.17` · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2024 · Tags: Open redirect, CWE-233
- [ID4Portais in version < V.2022.837.002a returns message parameter unsanitized in the response, resulting in a HTML Injection vulnerability.](https://agentprime.io/advisories/CVE-2023-40819.md)
  `CVE-2023-40819` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 6 Aug 2024 · Tags: CWE-233
- [Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to perform privilege escalation via a malicious file.](https://agentprime.io/advisories/CVE-2023-7261.md)
  `CVE-2023-7261` · CVE record: Google Omaha · CVSS 7.3 High · Not analysed yet · Published 7 Jun 2024 · Tags: CWE-233
- [Cross Site Scripting vulnerability in TOTOLINK X2000R before v1.0.0-B20231213.1013 allows a remote attacker to execute arbitrary code via the Guest Access Control parameter in the Wireless Page.](https://agentprime.io/advisories/CVE-2024-33433.md)
  `CVE-2024-33433` · CVE record · CVSS 4.8 Medium · Not analysed yet · Published 13 May 2024 · Tags: CWE-233
- [TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the webWlanIdx parameter in the setWebWlanIdx function.](https://agentprime.io/advisories/CVE-2024-31808.md)
  `CVE-2024-31808` · CVE record · CVSS 8.8 High · Not analysed yet · Published 8 Apr 2024 · Tags: CWE-233
- [Cisco IOS XE Software: A vulnerability in the Unified Threat Defense (UTD) configuration CLI of Cisco IOS XE…](https://agentprime.io/advisories/CVE-2024-20306.md)
  `CVE-2024-20306` · CVE record: Cisco Cisco IOS XE Software · CVSS 6.0 Medium · Not analysed yet · Published 27 Mar 2024 · Tags: CWE-233
- [An issue in EpointWebBuilder 5.1.0-sp1, 5.2.1-sp1, 5.4.1 and 5.4.2 allows a remote attacker to execute arbitrary code via the infoid parameter of the URL.](https://agentprime.io/advisories/CVE-2024-24525.md)
  `CVE-2024-24525` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Feb 2024 · Tags: Code injection, CWE-233
- [Improper Handling of Parameters in moodle](https://agentprime.io/advisories/GHSA-6vjf-48fh-vxxj.md)
  `GHSA-6vjf-48fh-vxxj`, `BIT-moodle-2024-25979`, `CVE-2024-25979`, `PKSA-8zq5-86tq-npgn` · Packagist `moodle/moodle`: affected `<4.1.9 || >=4.2.0, <4.2.6 || >=4.3.0, <4.3.3`, fixed in `4.1.9`, `4.2.6`, `4.3.3` · CVSS 5.3 Medium · Not analysed yet · Published 19 Feb 2024 · Tags: CWE-233
- [Head Unit Denial-of-Service via Apple CarPlay service](https://agentprime.io/advisories/CVE-2023-28898.md)
  `CVE-2023-28898` · CVE record: JOYNEXT MIB3 Infotainment Unit · CVSS 5.3 Medium · Not analysed yet · Published 12 Jan 2024 · Tags: CWE-233
- [Resque vulnerable to Reflected Cross Site Scripting through pathnames](https://agentprime.io/advisories/GHSA-r8xx-8vm8-x6wj.md)
  `GHSA-r8xx-8vm8-x6wj`, `CVE-2023-50724` · RubyGems `resque`: affected `<2.1.0`, fixed in `2.1.0` · CVSS 6.3 Medium · Not analysed yet · Published 18 Dec 2023 · Tags: Cross-site scripting (XSS), CWE-233
- [Resque vulnerable to reflected XSS in resque-web failed and queues lists](https://agentprime.io/advisories/GHSA-gc3j-vvwf-4rp8.md)
  `GHSA-gc3j-vvwf-4rp8`, `CVE-2023-50725` · RubyGems `resque`: affected `<2.2.1`, fixed in `2.2.1` · CVSS 6.3 Medium · Not analysed yet · Published 18 Dec 2023 · Tags: Cross-site scripting (XSS), CWE-233
- [Resque vulnerable to reflected XSS in Queue Endpoint](https://agentprime.io/advisories/GHSA-r9mq-m72x-257g.md)
  `GHSA-r9mq-m72x-257g`, `CVE-2023-50727` · RubyGems `resque`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 6.3 Medium · Not analysed yet · Published 18 Dec 2023 · Tags: Cross-site scripting (XSS), CWE-233
- [The SystemUI module has a vulnerability of repeated app restart due to improper parameters.](https://agentprime.io/advisories/CVE-2023-26549.md)
  `CVE-2023-26549` · CVE record: Huawei HarmonyOS and 1 more · No CVSS score · Not analysed yet · Published 27 Mar 2023 · Tags: CWE-233
- [IDOR in Yordam Library Automation System](https://agentprime.io/advisories/CVE-2021-45478.md)
  `CVE-2021-45478` · CVE record: Yordam Information Technologies Library Automation System · CVSS 6.5 Medium · Not analysed yet · Published 2 Mar 2023 · Tags: CWE-233
- [IDOR in Yordam Library Automation System](https://agentprime.io/advisories/CVE-2021-45477.md)
  `CVE-2021-45477` · CVE record: Yordam Information Technologies Library Automation System · CVSS 6.5 Medium · Not analysed yet · Published 2 Mar 2023 · Tags: CWE-233
- [Cisco IOx Application Hosting Environment Command Injection Vulnerability](https://agentprime.io/advisories/CVE-2023-20076.md)
  `CVE-2023-20076` · CVE record: Cisco Cisco IOS · CVSS 7.2 High · Not analysed yet · Published 12 Feb 2023 · Tags: CWE-233
- [Pi-Star_DV_Dash (for Pi-Star DV) before 5aa194d mishandles the module parameter.](https://agentprime.io/advisories/CVE-2022-45182.md)
  `CVE-2022-45182` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Nov 2022 · Tags: CWE-233
- [Ansible leaks password to logs](https://agentprime.io/advisories/GHSA-cpx3-93w7-457x.md)
  `GHSA-cpx3-93w7-457x`, `CVE-2022-3697`, `PYSEC-2026-768` · PyPI `ansible`: affected `>=2.5.0, <7.0.0`, fixed in `7.0.0` · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2022 · Tags: CWE-233
- [A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1).](https://agentprime.io/advisories/CVE-2022-32261.md)
  `CVE-2022-32261` · CVE record: Siemens SINEMA Remote Connect Server · CVSS 5.3 Medium · Not analysed yet · Published 14 Jun 2022 · Tags: CWE-233
- [MobiSoft - MobiPlus User Take Over and Improper Handling of url Parameters](https://agentprime.io/advisories/CVE-2022-22792.md)
  `CVE-2022-22792` · CVE record: MobiSoft eharmony · CVSS 6.6 Medium · Not analysed yet · Published 16 Feb 2022 · Tags: CWE-233
- [Pillow denial of service](https://agentprime.io/advisories/GHSA-g6rj-rv7j-xwp4.md)
  `GHSA-g6rj-rv7j-xwp4`, `BIT-pillow-2021-28675`, `CVE-2021-28675`, `PYSEC-2021-139` · PyPI `pillow`: affected `<8.2.0`, fixed in `8.2.0` · CVSS 5.5 Medium · Not analysed yet · Published 8 Jun 2021 · Tags: CWE-233, CWE-252
- [Zephyr Bluetooth unchecked packet data results in denial of service](https://agentprime.io/advisories/CVE-2020-10069.md)
  `CVE-2020-10069` · CVE record: zephyrproject-rtos zephyr · CVSS 4.3 Medium · Not analysed yet · Published 24 May 2021 · Tags: CWE-233
- [Junos OS: J-Web can be compromised through reflected client-side HTTP parameter pollution attacks.](https://agentprime.io/advisories/CVE-2021-0269.md)
  `CVE-2021-0269` · CVE record: Juniper Networks Junos OS · CVSS 8.8 High · Not analysed yet · Published 22 Apr 2021 · Tags: CWE-233
- [Cisco Nexus 9000 Series Fabric Switches ACI Mode BGP Route Installation Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2021-1230.md)
  `CVE-2021-1230` · CVE record: Cisco Cisco NX-OS System Software in ACI Mode · CVSS 8.6 High · Not analysed yet · Published 24 Feb 2021 · Tags: CWE-233

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-233>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-233/>. Everything for agents: <https://agentprime.io/llms.txt>.