CWE-436.

URI validation failure on SVG parsing. Bypass of CVE-2023-23924

• CWE-436

>=2.0.2, <2.0.3 · fixed in 2.0.3

In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall.

• CWE-436

Apache Shiro Interpretation Conflict vulnerability

• CWE-436

<1.11.0 · fixed in 1.11.0

Netty vulnerable to HTTP Response splitting from assigning header value iterator

• Other injection
• CWE-436

>=4.1.83.Final, <4.1.86.Final · fixed in 4.1.86.Final

HTTP response splitting in CGI

• Other injection
• CWE-436

<0.1.0.2 || >=0.2.0, <0.2.2 || >=0.3.0, <0.3.5 · fixed in 0.1.0.2, 0.2.2, 0.3.5

IP address leak via image proxy bypass in Zulip Server

• zulip
• CWE-436

Broken Authorization in ZITADEL Actions

• Broken access control
• CWE-436

>=1.42.0, <1.87.1 || >=2.0.0, <2.2.0 · fixed in 1.87.1, 2.2.0

Crafted link in Zulip message can cause disclosure of credentials

• zulip-mobile
• CWE-184
• CWE-436

Failed payment recorded has completed in Silverstripe Omnipay

• CWE-436
• CWE-437

<2.5.2 || >=3.0.0, <3.0.2 || >=3.1.0, <3.1.4 || >=3.2.0, <3.2.1 · fixed in 2.5.2, 3.0.2, 3.1.4, 3.2.1

PAN-OS: URL Category Exceptions Match More URLs Than Intended in URL Filtering

• Palo Alto Networks PAN-OS
• Palo Alto Networks Prisma Access
• CWE-436

Ethereum Contains Consensus Flaw During Block Processing

• CWE-436

>=1.10.0, <1.10.8 · fixed in 1.10.8

Misinterpretation of malicious XML input

• CWE-115
• CWE-436

<0.5.0 · fixed in 0.5.0

NFX250, NFX350, QFX5K Series, EX2300 Series, EX3400 Series, EX4300 Multigigabit, EX4600 Series: Certain genuine traffic received by the Junos OS device will be discarded instead of forwarded.

• Juniper Networks Junos OS
• CWE-115
• CWE-436

The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives.

• CWE-436