Skip to content
OpenAdvisories

Weakness (CWE)

CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data

Base Draft

The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.

Source: MITRE CWE-349

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.6
    CVE-2025-40778 Public exploit

    Cache poisoning attacks with unsolicited RRs

    Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 …

    ISC BIND 9 bind9 bind9 Debian Ubuntu Alpine
  • Medium 6.8
    CVE-2025-48804 Public exploit

    Windows BitLocker Security Feature Bypass Vulnerability

    Acceptance of extraneous untrusted data with trusted data in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • High 7.5
    CVE-2025-27415 Public exploit

    Nuxt allows DOS via cache poisoning with payload rendering response

    Nuxt is an open-source web development framework for Vue.js. Prior to 3.16.0, by sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site. It is possib…

    nuxt nuxt nuxt npm
  • High 7.5
    CVE-2024-46982 Public exploit EPSS 59%

    Cache Poisoning in next.js

    Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this craft…

    vercel next.js next npm