# CWE-436. Every Advisory and CVE whose sources give the weakness CWE-436, newest first. ## Records, newest first (an older page) - [URI validation failure on SVG parsing. Bypass of CVE-2023-23924](https://agentprime.io/advisories/GHSA-56gj-mvh6-rp75.md) `GHSA-56gj-mvh6-rp75`, `CVE-2023-24813`, `PKSA-2kw5-jd8w-5mvh` · Packagist `dompdf/dompdf`: affected `>=2.0.2, <2.0.3`, fixed in `2.0.3` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Feb 2023 · Tags: CWE-436 - [In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall.](https://agentprime.io/advisories/CVE-2022-48279.md) `CVE-2022-48279` · CVE record · CVSS 7.5 High · Not analysed yet · Published 20 Jan 2023 · Tags: CWE-436 - [Apache Shiro Interpretation Conflict vulnerability](https://agentprime.io/advisories/GHSA-7cxr-h8wm-fg4c.md) `GHSA-7cxr-h8wm-fg4c`, `CVE-2023-22602` · Maven `org.apache.shiro:shiro-root`: affected `<1.11.0`, fixed in `1.11.0` · CVSS 7.5 High · Not analysed yet · Published 14 Jan 2023 · Tags: CWE-436 - [Netty vulnerable to HTTP Response splitting from assigning header value iterator](https://agentprime.io/advisories/GHSA-hh82-3pmq-7frp.md) `GHSA-hh82-3pmq-7frp`, `CVE-2022-41915` · Maven `io.netty:netty-codec-http`: affected `>=4.1.83.Final, <4.1.86.Final`, fixed in `4.1.86.Final` · CVSS 6.5 Medium · Not analysed yet · Published 12 Dec 2022 · Tags: Other injection, CWE-436 - [HTTP response splitting in CGI](https://agentprime.io/advisories/GHSA-vc47-6rqg-c7f5.md) `GHSA-vc47-6rqg-c7f5`, `BIT-ruby-2021-33621`, `BIT-ruby-min-2021-33621`, `CVE-2021-33621` · RubyGems `cgi`: affected `<0.1.0.2 || >=0.2.0, <0.2.2 || >=0.3.0, <0.3.5`, fixed in `0.1.0.2`, `0.2.2`, `0.3.5` · CVSS 8.8 High · Not analysed yet · Published 19 Nov 2022 · Tags: Other injection, CWE-436 - [IP address leak via image proxy bypass in Zulip Server](https://agentprime.io/advisories/CVE-2022-36048.md) `CVE-2022-36048` · CVE record: zulip zulip · CVSS 4.3 Medium · Not analysed yet · Published 31 Aug 2022 · Tags: CWE-436 - [Broken Authorization in ZITADEL Actions](https://agentprime.io/advisories/GHSA-c8fj-4pm8-mp2c.md) `GHSA-c8fj-4pm8-mp2c`, `CVE-2022-36051` · Go `github.com/zitadel/zitadel`: affected `>=1.42.0, <1.87.1 || >=2.0.0, <2.2.0`, fixed in `1.87.1`, `2.2.0` · CVSS 8.7 High · Not analysed yet · Published 30 Aug 2022 · Tags: Broken access control, CWE-436 - [Crafted link in Zulip message can cause disclosure of credentials](https://agentprime.io/advisories/CVE-2022-35962.md) `CVE-2022-35962` · CVE record: zulip zulip-mobile · CVSS 8.0 High · Not analysed yet · Published 29 Aug 2022 · Tags: CWE-184, CWE-436 - [Failed payment recorded has completed in Silverstripe Omnipay](https://agentprime.io/advisories/GHSA-48f2-m7jg-866x.md) `GHSA-48f2-m7jg-866x`, `CVE-2022-29254`, `PKSA-pzbs-nwxn-sxp7` · Packagist `silverstripe/silverstripe-omnipay`: affected `<2.5.2 || >=3.0.0, <3.0.2 || >=3.1.0, <3.1.4 || >=3.2.0, <3.2.1`, fixed in `2.5.2`, `3.0.2`, `3.1.4`, `3.2.1` · CVSS 3.7 Low · Not analysed yet · Published 6 Jun 2022 · Tags: CWE-436, CWE-437 - [PAN-OS: URL Category Exceptions Match More URLs Than Intended in URL Filtering](https://agentprime.io/advisories/CVE-2022-0011.md) `CVE-2022-0011` · CVE record: Palo Alto Networks PAN-OS and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 10 Feb 2022 · Tags: CWE-436 - [Ethereum Contains Consensus Flaw During Block Processing](https://agentprime.io/advisories/GHSA-9856-9gg9-qcmq.md) `GHSA-9856-9gg9-qcmq`, `CVE-2021-39137`, `GO-2022-0254` · Go `github.com/ethereum/go-ethereum`: affected `>=1.10.0, <1.10.8`, fixed in `1.10.8` · CVSS 6.5 Medium · Not analysed yet · Published 30 Aug 2021 · Tags: CWE-436 - [Misinterpretation of malicious XML input](https://agentprime.io/advisories/GHSA-h6q6-9hqw-rwfv.md) `GHSA-h6q6-9hqw-rwfv`, `CVE-2021-21366` · npm `xmldom`: affected `<0.5.0`, fixed in `0.5.0` · CVSS 4.3 Medium · Not analysed yet · Published 12 Mar 2021 · Tags: CWE-115, CWE-436 - [NFX250, NFX350, QFX5K Series, EX2300 Series, EX3400 Series, EX4300 Multigigabit, EX4600 Series: Certain genuine traffic received by the Junos OS device will be discarded instead of forwarded.](https://agentprime.io/advisories/CVE-2021-0207.md) `CVE-2021-0207` · CVE record: Juniper Networks Junos OS · CVSS 7.5 High · Not analysed yet · Published 15 Jan 2021 · Tags: CWE-115, CWE-436 - [The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives.](https://agentprime.io/advisories/CVE-2019-19589.md) `CVE-2019-19589` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Dec 2019 · Tags: CWE-436 Newest: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .