Advisories · Weakness
CWE-233.
Every Advisory and CVE whose sources give the weakness CWE-233, newest first.
- CVSS 6.9 Medium
Lookyloo: Potential sub-system DoS due to parameter missmatch in notification
- lookyloo
- CWE-233
- CVSS 6.2 Medium
Insufficient parameter validation in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety
- BlackBerry Ltd QNX Software Development Platform
- BlackBerry Ltd QNX OS for Safety
- CWE-233
- CVSS 9.4 CriticalCritical · CVSS 9+
This vulnerability in Veeam Service Provider Console allows for remote code execution.
- Veeam Service Provider Console
- CWE-233
- CVSS 3.8 Low
Arqit SKA-Platform Improper Handling of Parameters Vulnerability
- Arqit Symmetric Key Agreement Platform
- CWE-233
- CVSS 6.9 Medium
WebDrive 18.00.5057 Denial of Service via Secure WebDAV
- WebDrive
- CWE-233
- CVSS 8.1 High
Improper Handling of Parameters in GitLab
- GitLab
- CWE-233
- CVSS 8.7 High
Improper handling of parameters in the AMD Secure Processor (ASP) could allow a privileged attacker to pass an arbitrary memory value to functions in the trusted execution environment resulting in ar…
- AMD Radeon™ RX 6000 Series Graphics Products
- AMD Radeon™ PRO W6000 Series Graphics Products
- CWE-233
- CVSS 4.9 Medium
Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can cause abnormal device behavior by crafting specific messages.
- HIKSEMI HS-AFS-S1H1
- CWE-233
- CVSS 7.2 High
Improper Parameter Check in ThreadX Syscall Implementation
- Eclipse Foundation ThreadX
- CWE-233
- CVSS 5.7 Medium
Incomplete validation of kernel object pointers in system calls
- Eclipse Foundation ThreadX
- CWE-233
- CVSS 7.7 HighCritical · CVSS 7+ and EPSS
Fortinet FortiWeb: A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below…
- Fortinet FortiWeb
- CWE-233
- CVSS 5.9 Medium
Debezium database connector has a script injection vulnerability
- CWE-233
<2.3.0.Alpha1 · fixed in 2.3.0.Alpha1
GHSA-hvw5-3mgw-7rcf · CVE-2023-1419 - CVSS 6.9 Medium
Eclipse Glassfish improperly handles http parameters
- Open redirect
- CWE-233
<7.0.17 · fixed in 7.0.17
GHSA-jq3f-mfmg-747x · CVE-2024-9329 - CVSS 6.1 Medium
ID4Portais in version < V.2022.837.002a returns message parameter unsanitized in the response, resulting in a HTML Injection vulnerability.
- CWE-233
- CVSS 7.3 High
Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to perform privilege escalation via a malicious file.
- Google Omaha
- CWE-233
- CVSS 4.8 Medium
Cross Site Scripting vulnerability in TOTOLINK X2000R before v1.0.0-B20231213.1013 allows a remote attacker to execute arbitrary code via the Guest Access Control parameter in the Wireless Page.
- CWE-233
- CVSS 8.8 High
TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the webWlanIdx parameter in the setWebWlanIdx function.
- CWE-233
- CVSS 6.0 Medium
Cisco IOS XE Software: A vulnerability in the Unified Threat Defense (UTD) configuration CLI of Cisco IOS XE…
- Cisco IOS XE Software
- CWE-233
- CVSS 9.8 CriticalCritical · CVSS 9+
An issue in EpointWebBuilder 5.1.0-sp1, 5.2.1-sp1, 5.4.1 and 5.4.2 allows a remote attacker to execute arbitrary code via the infoid parameter of the URL.
- Code injection
- CWE-233
- CVSS 5.3 Medium
Improper Handling of Parameters in moodle
- CWE-233
<4.1.9 || >=4.2.0, <4.2.6 || >=4.3.0, <4.3.3 · fixed in 4.1.9, 4.2.6, 4.3.3
GHSA-6vjf-48fh-vxxj · CVE-2024-25979 - CVSS 5.3 Medium
Head Unit Denial-of-Service via Apple CarPlay service
- JOYNEXT MIB3 Infotainment Unit
- CWE-233
- CVSS 6.3 Medium
Resque vulnerable to Reflected Cross Site Scripting through pathnames
- Cross-site scripting (XSS)
- CWE-233
<2.1.0 · fixed in 2.1.0
GHSA-r8xx-8vm8-x6wj · CVE-2023-50724 - CVSS 6.3 Medium
Resque vulnerable to reflected XSS in resque-web failed and queues lists
- Cross-site scripting (XSS)
- CWE-233
<2.2.1 · fixed in 2.2.1
GHSA-gc3j-vvwf-4rp8 · CVE-2023-50725 - CVSS 6.3 Medium
Resque vulnerable to reflected XSS in Queue Endpoint
- Cross-site scripting (XSS)
- CWE-233
<2.6.0 · fixed in 2.6.0
GHSA-r9mq-m72x-257g · CVE-2023-50727 -
The SystemUI module has a vulnerability of repeated app restart due to improper parameters.
- Huawei HarmonyOS
- Huawei EMUI
- CWE-233
- CVSS 6.5 Medium
IDOR in Yordam Library Automation System
- Yordam Information Technologies Library Automation System
- CWE-233
- CVSS 6.5 Medium
IDOR in Yordam Library Automation System
- Yordam Information Technologies Library Automation System
- CWE-233
- CVSS 7.2 High
Cisco IOx Application Hosting Environment Command Injection Vulnerability
- Cisco IOS
- CWE-233
- CVSS 9.8 CriticalCritical · CVSS 9+
Pi-Star_DV_Dash (for Pi-Star DV) before 5aa194d mishandles the module parameter.
- CWE-233
- CVSS 7.5 High
Ansible leaks password to logs
- CWE-233
>=2.5.0, <7.0.0 · fixed in 7.0.0
GHSA-cpx3-93w7-457x · CVE-2022-3697 - CVSS 5.3 Medium
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1).
- Siemens SINEMA Remote Connect Server
- CWE-233
- CVSS 6.6 Medium
MobiSoft - MobiPlus User Take Over and Improper Handling of url Parameters
- MobiSoft eharmony
- CWE-233
- CVSS 5.5 Medium
Pillow denial of service
- CWE-233
- CWE-252
<8.2.0 · fixed in 8.2.0
GHSA-g6rj-rv7j-xwp4 · CVE-2021-28675 - CVSS 4.3 Medium
Zephyr Bluetooth unchecked packet data results in denial of service
- zephyr
- CWE-233
- CVSS 8.8 High
Junos OS: J-Web can be compromised through reflected client-side HTTP parameter pollution attacks.
- Juniper Networks Junos OS
- CWE-233
- CVSS 8.6 High
Cisco Nexus 9000 Series Fabric Switches ACI Mode BGP Route Installation Denial of Service Vulnerability
- Cisco NX-OS System Software in ACI Mode
- CWE-233