CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data
baseThe product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (68)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-14773US | medium6.5 | — | ||
An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 throug… | ||||
| CVE-2026-42960US | critical10.0 | — | ||
NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that complement DNS replies i… | ||||
| CVE-2019-9535US | critical9.8 | — | ||
A vulnerability exists in the way that iTerm2 integrates with tmux's control mode, which may allow an attacker to execute arbitrary commands by providing malicious output to the te… | ||||
| CVE-2023-51655US | critical9.8OT elevated | — | ||
In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the project configuration | ||||
| CVE-2026-50252US | critical9.3 | — | ||
In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When… | ||||
| CVE-2018-1131US | high8.8 | — | ||
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could s… | ||||
| CVE-2021-21374US | high8.1 | — | ||
Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTP… | ||||
| CVE-2026-35641US | high7.8 | — | ||
OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to execute malicious code by crafting a .np… | ||||
| CVE-2024-52555US | high7.8 | — | ||
In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible via type definitions installer script | ||||
| CVE-2024-46982US | — | Exploit | ||
Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered r… | ||||
| CVE-2020-8023US | high7.8 | — | ||
A acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the start script of openldap2 of SUSE Enterprise Storage 5, SUSE Linux Enterprise Debuginfo 11-SP3, SUS… | ||||
| CVE-2021-32499US | high7.5 | — | ||
SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the command line arguments to pass in any value to the Emulator executable. | ||||
| CVE-2023-46446US | medium6.8OT elevated | — | ||
An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack… | ||||
| CVE-2020-26200US | medium6.8OT elevated | — | ||
A component of Kaspersky custom boot loader allowed loading of untrusted UEFI modules due to insufficient check of their authenticity. This component is incorporated in Kaspersky R… | ||||
| CVE-2014-1418US | medium6.4 | — | ||
Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which al… | ||||
| CVE-2026-19033US | medium6.5 | — | ||
For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. Th… | ||||
| CVE-2024-42483US | medium6.5OT elevated | — | ||
ESP-NOW Component provides a connectionless Wi-Fi communication protocol. An replay attacks vulnerability was discovered in the implementation of the ESP-NOW because the caches is… | ||||
| CVE-2022-1834US | medium6.5 | — | ||
When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. Thi… | ||||
| CVE-2026-44572US | medium5.9 | — | ||
Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal re… | ||||
| CVE-2023-46445US | medium5.9OT elevated | — | ||
An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a "Rogue Extension Negotiation." | ||||
03
attack patterns (3)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan