CWE-349.

Apache OpenOffice: Carefully crafted documents could display different data when opened with different programs, instead of being reported as corrupt.

• Apache Software Foundation Apache OpenOffice
• CWE-349

Unverified Sign in with Apple callback parameter can override verified ID token claims

• Authentication bypass
• CWE-349

>=0.1.25, <0.3.2 · fixed in 0.3.2

Logon bypass (trust of attacker-controlled completed-methods list)

• OpenText Advanced Authentication Server
• CWE-349

gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()

• CWE-349

>=0.88.0, <0.90.0 · fixed in 0.90.0

Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes

• CWE-349

>=6.2.5, <6.7.0 · fixed in 6.7.0

Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab

• GitLab
• CWE-349

Payy: agg_agg trailing message slots are unconstrained and allow forged burn messages

• polybase payy
• CWE-349

Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces

• Amazon Kiro IDE
• CWE-349
• CWE-829

wlc may disclose API tokens to project-configured URLs

• Information disclosure
• CWE-349

<2.0.1 · fixed in 2.0.1

Unauthenticated IXFR deltas are applied to the live zone before TSIG verification

• ISC BIND 9
• CWE-349

Out-of-zone database nodes can become authoritative zone cuts

• ISC BIND 9
• CWE-349

Laci Synchroni Backend Vulnerable to Account Takeover / User Impersonation via Client-Side Configuration Manipulation

• LaciSynchroni server
• Authentication bypass
• CWE-349

WP Fastest Cache 0.8.7.7 - 1.5.0 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters

• WP Fastest Cache
• CWE-349

Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab

• GitLab
• CWE-349

django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

• CWE-349
• CWE-524

<5.0.8 · fixed in 5.0.8

Possible cache poisoning attack by mapping source port population per thread

• NLnet Labs Unbound
• CWE-349

Dell Wyse Management Suite: Dell Wyse Management Suite, versions prior to WMS 5.5 HF1…

• Dell Wyse Management Suite
• CWE-349

ZoneToCache can poison the cache

• PowerDNS Recursor
• CWE-349

Windows Dynamic Host Configuration Protocol (DHCP) Tampering Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-229
• CWE-349

Possible cache poisoning via promiscuous records for the authority section

• NLnet Labs Unbound
• CWE-349

Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning

• Cross-site scripting (XSS)
• HTTP request smuggling

>=3.1.0, <3.21.6 || >=4.0.0-alpha.1, <4.4.6 · fixed in 3.21.6, 4.4.6

Next.js's Middleware / Proxy redirects can be cache-poisoned

• CWE-349

>=12.2.0, <15.5.16 || >=16.0.0, <16.2.5 · fixed in 15.5.16, 16.2.5

gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules

• Command injection
• CWE-183

>=0.31.0, <0.83.0 · fixed in 0.83.0

Windows COM Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1809
• Microsoft Windows 10 Version 21H2
• CWE-349

OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders

• CWE-349
• CWE-440

<2026.4.2 · fixed in 2026.4.2

OpenClaw has an Arbitrary Malicious Code Execution Vulnerability

• CWE-349
• CWE-426

<2026.3.24 · fixed in 2026.3.24

NGINX vulnerability

• F5 NGINX Open Source
• F5 NGINX Plus
• CWE-349

JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of…

• JetBrains IntelliJ IDEA
• CWE-349

An acceptance of extraneous untrusted data with trusted data vulnerability has been identified in Moxa’s Ethernet switches, which allows attackers with administrative privileges to manipulate HTTP Ho…

• Moxa TN-4500A Series
• Moxa TN-5500A Series
• CWE-349

Cache poisoning attacks with unsolicited RRs

• ISC BIND 9
• CWE-349

Possible domain hijacking via promiscuous records in the authority section

• NLnet Labs Unbound
• CWE-349

WP Go Maps (formerly WP Google Maps) <= 9.0.48 - Unauthenticated Cache Poisoning

• wpgmaps WP Go Maps (formerly WP Google Maps)
• CWE-349

Cache poisoning via the ECS-enabled Rebirthday Attack

• NLnet Labs Unbound
• CWE-349

Birthday Attack against Resolvers supporting ECS

• ISC BIND 9
• CWE-349

Windows BitLocker Security Feature Bypass Vulnerability

• Microsoft Windows 10 Version 1507
• Microsoft Windows 10 Version 1607
• CWE-349

FreshRSS vulnerable to favicon cache poisoning via proxy

• FreshRSS
• CWE-349

Cisco Webex Meetings: A vulnerability in client join services of Cisco Webex Meetings could allow an…

• Cisco Webex Meetings
• CWE-349

UrlMon Security Feature Bypass Vulnerability

• Microsoft Windows 10 Version 1507
• Microsoft Windows 10 Version 1607
• CWE-349

Microsoft Word Security Feature Bypass Vulnerability

• Microsoft 365 Apps for Enterprise
• Microsoft Office 2016
• CWE-349

Nuxt allows DOS via cache poisoning with payload rendering response

• CWE-349

>=3.0.0, <3.16.0 · fixed in 3.16.0

check-jsonschema default caching for remote schemas allows for cache confusion

• CWE-349

<0.30.0 · fixed in 0.30.0

JetBrains WebStorm: In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible…

• JetBrains WebStorm
• CWE-349

Next.js Cache Poisoning

• Broken access control
• CWE-349

>=13.5.1, <13.5.7 || >=14.0.0, <14.2.10 · fixed in 13.5.7, 14.2.10

ESP-NOW Replay Attacks Vulnerability

• espressif esp-now
• CWE-349

Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series.

• EC-CUBE CO.,LTD. EC-CUBE 4 series
• CWE-349

DNSJava DNSSEC Bypass

• CWE-345
• CWE-349

<3.6.0 · fixed in 3.6.0

aiosmtpd STARTTLS unencrypted commands injection

• CWE-349

<1.4.6 · fixed in 1.4.6

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).

• Oracle Corporation Java SE JDK and JRE
• CWE-349

JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted…

• JetBrains IntelliJ IDEA
• CWE-349

Siemens RUGGEDCOM RM1224 LTE(4G) EU: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2)…

• Siemens RUGGEDCOM RM1224 LTE(4G) EU
• Siemens RUGGEDCOM RM1224 LTE(4G) NAM
• CWE-349

Moodle Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability

• CWE-345
• CWE-349

<4.3.0-rc2 · fixed in 4.3.0-rc2

AsyncSSH Rogue Session Attack

• Information disclosure
• Broken access control

<2.14.1 · fixed in 2.14.1

AsyncSSH Rogue Extension Negotiation

• CWE-345
• CWE-349

<2.14.1 · fixed in 2.14.1

VideoEdge config

• Sensormatic Electronics, a subsidiary of Johnson Controls, Inc. VideoEdge
• CWE-349

Deserialization of Untrusted Data in Infinispan

• Insecure deserialization
• CWE-349

>=9.3.0.Alpha1, <9.3.1.Final · fixed in 9.3.1.Final

Symfony HTTP Foundation web cache poisoning

• CWE-349

>=2.7.0, <2.7.49 || >=2.8.0, <2.8.44 || >=3.0.0, <3.3.18 || >=3.4.0, <3.4.14 || >=4.0.0, <4.0.14 || >=4.1.0, <4.1.3 · fixed in 2.7.49, 2.8.44, 3.3.18, 3.4.14, 4.0.14, 4.1.3

Nimble fails to validate certificates due to insecure httpClient defaults

• nim-lang security
• CWE-348
• CWE-349

Local privilege escalation from ldap to root when using OPENLDAP_CONFIG_BACKEND=ldap in openldap2

• SUSE Enterprise Storage 5
• SUSE Linux Enterprise Debuginfo 11-SP3
• CWE-349

The Linux Foundation kernel: A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7…

• The Linux Foundation kernel
• CWE-349

iTerm2, up to and including version 3.3.5, with tmux integration is vulnerable to remote command execution

• iTerm2
• CWE-349