Skip to content
OpenAdvisories

Weakness (CWE)

CWE-235: Improper Handling of Extra Parameters

Variant Draft

The product does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.

Source: MITRE CWE-235

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium —
    GHSA-92hr-gmr6-h8cp

    Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling

    Fix: PR #7906 (ether/etherpad). A set of medium/low hardening fixes: - **Weak RNG for tokens (CWE-330):** author/session/readonly IDs were generated with `Math.random()` (client and server). Now use `crypto.getRandomValues`. - **Login timing / no failure dela…

    ep_etherpad-lite npm
  • Medium 6.5
    CVE-2026-20083

    A vulnerability in the Secure Copy Protocol (SCP) server feature of Cisco IOS XE Software could allow an authenticated,…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 6.3
    CVE-2017-20160

    flitto express-param fetchParams.js parameter pollution

    A vulnerability was found in flitto express-param up to 0.x. It has been classified as critical. This affects an unknown part of the file lib/fetchParams.js. The manipulation leads to improper handling of extra parameters. It is possible to initiate the attac…

    flitto express-param express-param npm