Weakness (CWE)
CWE-233: Improper Handling of Parameters
The product does not properly handle when the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined.
Source: MITRE CWE-233
36 results · Feed
-
Medium 6.9
Lookyloo: Potential sub-system DoS due to parameter missmatch in notification
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.39.4, an unauthenticated user can trigger Lookyloo's "report a capture" email on demand (this is expected). The…
-
Medium 6.2
Insufficient parameter validation in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety
Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to cause a crash of the QNX Neutrino kernel.
-
Critical 9.4
This vulnerability in Veeam Service Provider Console allows for remote code execution.
-
Low 3.8
Arqit SKA-Platform Improper Handling of Parameters Vulnerability
Improper management of the idle timeout parameter in the Keycloak interface of the Arqit SKA-Platform enables an attacker to impersonate an authenticated tenant user via an unexpired browser session. This issue affects Symmetric Key Agreement Platform: before…
-
Medium 6.2
WebDrive 18.00.5057 Denial of Service via Secure WebDAV
WebDrive 18.00.5057 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the username field during Secure WebDAV connection setup. Attackers can input a buffer-overflow payl…
-
High 8.1
Improper Handling of Parameters in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations that could have allowed an authenticated user with minimal workspace permissions t…
-
High 8.7
Improper handling of parameters in the AMD Secure Processor (ASP) could allow a privileged attacker to pass an arbitrar…
-
Medium 4.9
Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products ca…
-
High 7.2
Improper Parameter Check in ThreadX Syscall Implementation
In Eclipse ThreadX before 6.4.3, when memory protection is enabled, syscall parameters verification wasn't enough, allowing an attacker to obtain an arbitrary memory read/write.
-
Medium 5.7
Incomplete validation of kernel object pointers in system calls
In Eclipse ThreadX before version 6.4.3, an attacker can cause a denial of service (crash) by providing a pointer to a reserved or unmapped memory region. Vulnerable system calls had a check of pointers, but that check wasn't verifying whether the pointer is …
-
High 7.7
A improper handling of parameters vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7,…
-
Medium 5.9
Debezium: script injection via connector parameter
A script injection vulnerability was found in the Debezium database connector, where it does not properly sanitize some parameters. This flaw allows an attacker to send a malicious request to inject a parameter that may allow the viewing of unauthorized data.
-
Medium 6.9
Glassfish redirect to untrusted site
In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is '/management/domain'. By modifying the URL value to a malicious site, an attacker may success…
-
Medium 6.1
ID4Portais in version < V.2022.837.002a returns message parameter unsanitized in the response, resulting in a HTML Inje…
-
High 7.3CVE-2023-7261 Public exploit
Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to perform…
-
Medium 4.8
Cross Site Scripting vulnerability in TOTOLINK X2000R before v1.0.0-B20231213.1013 allows a remote attacker to execute …
-
High 8.8
TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the web…
-
Medium 6.0
A vulnerability in the Unified Threat Defense (UTD) configuration CLI of Cisco IOS XE Software could allow an authentic…
-
Critical 9.8
An issue in EpointWebBuilder 5.1.0-sp1, 5.2.1-sp1, 5.4.1 and 5.4.2 allows a remote attacker to execute arbitrary code v…
-
Medium 5.3
Msa-24-0002: forum search accepted random parameters in its url
The URL parameters accepted by forum search were not limited to the allowed parameters.
-
Medium 5.3
Head Unit Denial-of-Service via Apple CarPlay service
The Real-Time Streaming Protocol implementation in the MIB3 infotainment incorrectly handles requests to /logs URI, when the id parameter equals to zero. This issue allows an attacker connected to the in-vehicle Wi-Fi network to cause denial-of-service of the…
-
Medium 6.3
Resque vulnerable to reflected XSS in Queue Endpoint
Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. Reflected XSS issue occurs when /queues is appended with /"><svg%20onload=alert(domain)>. This issue has been patched in version 2.…
-
Medium 6.3
Resque vulnerable to reflected XSS in resque-web failed and queues lists
Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. The following paths in resque-web have been found to be vulnerable to reflected XSS: "/failed/?class=<script>alert(document.cookie)…
-
Medium 6.3
Resque vulnerable to reflected cross site scripting through pathname
Resque (pronounced like "rescue") is a Redis-backed library for creating background jobs, placing those jobs on multiple queues, and processing them later. resque-web in resque versions before 2.1.0 are vulnerable to reflected XSS through the current_queue pa…
-
Unscored —
The SystemUI module has a vulnerability of repeated app restart due to improper parameters. Successful exploitation of …
-
Medium 6.5
IDOR in Yordam Library Automation System
Improper Handling of Parameters vulnerability in Bordam Information Technologies Library Automation System allows Collect Data as Provided by Users. This issue affects Library Automation System: before 19.2.
-
Medium 6.5
IDOR in Yordam Library Automation System
Improper Handling of Parameters vulnerability in Bordam Information Technologies Library Automation System allows Collect Data as Provided by Users. This issue affects Library Automation System: before 19.2.
-
High 7.2
Cisco IOx Application Hosting Environment Command Injection Vulnerability
A vulnerability in the Cisco IOx application hosting environment could allow an authenticated, remote attacker to execute arbitrary commands as root on the underlying host operating system. This vulnerability is due to incomplete sanitization of parameters th…
-
Critical 9.8
Pi-Star_DV_Dash (for Pi-Star DV) before 5aa194d mishandles the module parameter.
-
High 7.5
Ansible leaks password to logs
A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading …
-
Medium 5.3
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application con…
-
Medium 6.6
MobiSoft - MobiPlus User Take Over and Improper Handling of url Parameters
MobiSoft - MobiPlus User Take Over and Improper Handling of url Parameters Attacker can navigate to specific url which will expose all the users and password in clear text. http://IP/MobiPlusWeb/Handlers/MainHandler.ashx?MethodName=GridData&GridName=Users
-
Medium 5.5
Pillow denial of service
An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.
-
Medium 4.3
Zephyr Bluetooth unchecked packet data results in denial of service
Zephyr Bluetooth unchecked packet data results in denial of service. Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Parameters (CWE-233). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-f6vh-…
-
High 8.8
Junos OS: J-Web can be compromised through reflected client-side HTTP parameter pollution attacks.
The improper handling of client-side parameters in J-Web of Juniper Networks Junos OS allows an attacker to perform a number of different malicious actions against a target device when a user is authenticated to J-Web. An attacker may be able to supersede exi…
-
High 8.6
Cisco Nexus 9000 Series Fabric Switches ACI Mode BGP Route Installation Denial of Service Vulnerability
A vulnerability with the Border Gateway Protocol (BGP) for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an unauthenticated, remote attacker to cause a routing process to crash, which could lead to a deni…