CWE-349
AllowedAcceptance of Extraneous Untrusted Data With Trusted Data
Abstraction: Base · Status: Draft
The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.
82 vulnerabilities reference this CWE, most recent first.
GHSA-P2WF-95F3-Q546
Vulnerability from github – Published: 2023-12-21 12:30 – Updated: 2023-12-21 12:30In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the project configuration
{
"affected": [],
"aliases": [
"CVE-2023-51655"
],
"database_specific": {
"cwe_ids": [
"CWE-345",
"CWE-349"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-21T10:15:36Z",
"severity": "MODERATE"
},
"details": "In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the project configuration",
"id": "GHSA-p2wf-95f3-q546",
"modified": "2023-12-21T12:30:28Z",
"published": "2023-12-21T12:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51655"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q677-7PJP-5HQ5
Vulnerability from github – Published: 2024-08-20 18:31 – Updated: 2024-11-18 16:27The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.
{
"affected": [],
"aliases": [
"CVE-2024-27185"
],
"database_specific": {
"cwe_ids": [
"CWE-349",
"CWE-444"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-20T16:15:10Z",
"severity": "MODERATE"
},
"details": "The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.",
"id": "GHSA-q677-7pjp-5hq5",
"modified": "2024-11-18T16:27:06Z",
"published": "2024-08-20T18:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27185"
},
{
"type": "WEB",
"url": "https://developer.joomla.org/security-centre/942-20240802-core-cache-poisoning-in-pagination.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:A/V:X/RE:X/U:Clear",
"type": "CVSS_V4"
}
]
}
GHSA-Q6MV-284R-MP36
Vulnerability from github – Published: 2024-12-02 17:29 – Updated: 2024-12-02 17:29Impact
The default cache strategy uses the basename of a remote schema as the name of the file in the cache, e.g. https://example.org/schema.json will be stored as schema.json. This naming allows for conflicts. If an attacker can get a user to run check-jsonschema against a malicious schema URL, e.g., https://example.evil.org/schema.json, they can insert their own schema into the cache and it will be picked up and used instead of the appropriate schema.
Such a cache confusion attack could be used to allow data to pass validation which should have been rejected.
Patches
A patch is in progress but has not yet been released.
Workarounds
- Users can use
--no-cacheto disable caching. - Users can use
--cache-filenameto select filenames for use in the cache, or to ensure that other usages do not overwrite the cached schema. (Note: this flag is being deprecated as part of the remediation effort.) - Users can explicitly download the schema before use as a local file, as in
curl -LOs https://example.org/schema.json; check-jsonschema --schemafile ./schema.json
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "check-jsonschema"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.30.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-53848"
],
"database_specific": {
"cwe_ids": [
"CWE-349"
],
"github_reviewed": true,
"github_reviewed_at": "2024-12-02T17:29:05Z",
"nvd_published_at": "2024-11-29T19:15:09Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nThe default cache strategy uses the basename of a remote schema as the name of the file in the cache, e.g. `https://example.org/schema.json` will be stored as `schema.json`. This naming allows for conflicts. If an attacker can get a user to run `check-jsonschema` against a malicious schema URL, e.g., `https://example.evil.org/schema.json`, they can insert their own schema into the cache and it will be picked up and used instead of the appropriate schema.\n\nSuch a cache confusion attack could be used to allow data to pass validation which should have been rejected.\n\n### Patches\n\nA patch is in progress but has not yet been released.\n\n### Workarounds\n\n- Users can use `--no-cache` to disable caching.\n- Users can use `--cache-filename` to select filenames for use in the cache, or to ensure that other usages do not overwrite the cached schema. (Note: this flag is being deprecated as part of the remediation effort.)\n- Users can explicitly download the schema before use as a local file, as in `curl -LOs https://example.org/schema.json; check-jsonschema --schemafile ./schema.json`",
"id": "GHSA-q6mv-284r-mp36",
"modified": "2024-12-02T17:29:05Z",
"published": "2024-12-02T17:29:05Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/python-jsonschema/check-jsonschema/security/advisories/GHSA-q6mv-284r-mp36"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53848"
},
{
"type": "WEB",
"url": "https://github.com/python-jsonschema/check-jsonschema/commit/c52714b85e6725b1b24516fbdedacb333b939152"
},
{
"type": "PACKAGE",
"url": "https://github.com/python-jsonschema/check-jsonschema"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N",
"type": "CVSS_V4"
}
],
"summary": "check-jsonschema default caching for remote schemas allows for cache confusion"
}
GHSA-Q7Q2-QF2Q-RW3W
Vulnerability from github – Published: 2022-05-17 03:07 – Updated: 2024-11-18 16:26Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.4"
},
{
"fixed": "1.4.13"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.5"
},
{
"fixed": "1.5.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.6"
},
{
"fixed": "1.6.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.7a1"
},
{
"fixed": "1.7b4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-1418"
],
"database_specific": {
"cwe_ids": [
"CWE-349"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-16T22:54:50Z",
"nvd_published_at": "2014-05-16T15:55:00Z",
"severity": "CRITICAL"
},
"details": "Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.",
"id": "GHSA-q7q2-qf2q-rw3w",
"modified": "2024-11-18T16:26:23Z",
"published": "2022-05-17T03:07:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-1418"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/1abcf3a808b35abae5d425ed4d44cb6e886dc769"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/28e23306aa53bbbb8fb87db85f99d970b051026c"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/4001ec8698f577b973c5a540801d8a0bbea1205b"
},
{
"type": "PACKAGE",
"url": "https://github.com/django/django"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2014-19.yaml"
},
{
"type": "WEB",
"url": "https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html"
},
{
"type": "WEB",
"url": "http://ubuntu.com/usn/usn-2212-1"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2014/dsa-2934"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/05/14/10"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/05/15/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Django Vulnerable to Cache Poisoning"
}
GHSA-RG7M-23R6-4M52
Vulnerability from github – Published: 2024-11-15 18:30 – Updated: 2024-11-15 18:30In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible via type definitions installer script
{
"affected": [],
"aliases": [
"CVE-2024-52555"
],
"database_specific": {
"cwe_ids": [
"CWE-349"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-15T16:15:38Z",
"severity": "MODERATE"
},
"details": "In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible via type definitions installer script",
"id": "GHSA-rg7m-23r6-4m52",
"modified": "2024-11-15T18:30:51Z",
"published": "2024-11-15T18:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52555"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RM2J-X595-Q9CJ
Vulnerability from github – Published: 2022-05-14 03:49 – Updated: 2024-09-16 22:35Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a crafted request.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.3"
},
{
"fixed": "1.3.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2011-4139"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-349"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-16T22:47:59Z",
"nvd_published_at": "2011-10-19T10:55:00Z",
"severity": "HIGH"
},
"details": "Django before 1.2.7 and 1.3.x before 1.3.1 uses a request\u0027s HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a crafted request.",
"id": "GHSA-rm2j-x595-q9cj",
"modified": "2024-09-16T22:35:46Z",
"published": "2022-05-14T03:49:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4139"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/2f7fadc38efa58ac0a8f93f936b82332a199f396"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/c613af4d6485586c79d692b70a9acac429f3ca9d"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=737366"
},
{
"type": "PACKAGE",
"url": "https://github.com/django/django"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2011-4.yaml"
},
{
"type": "WEB",
"url": "https://hermes.opensuse.org/messages/14700881"
},
{
"type": "WEB",
"url": "https://www.djangoproject.com/weblog/2011/sep/09"
},
{
"type": "WEB",
"url": "https://www.djangoproject.com/weblog/2011/sep/10/127"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2011/09/11/1"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2011/09/13/2"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2011/dsa-2332"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Django Vulnerable to Cache Poisoning"
}
GHSA-RXMX-G7HR-8MX4
Vulnerability from github – Published: 2026-04-07 18:15 – Updated: 2026-05-07 16:44Summary
Before OpenClaw 2026.4.2, Zalo webhook replay dedupe keys were not scoped strongly enough across chat and sender dimensions. Legitimate events from different conversations or senders could collide and be dropped as duplicates.
Impact
Cross-conversation or cross-sender collisions could cause silent message suppression and break bot workflows. This was an availability issue in webhook event processing.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected versions:
<= 2026.4.1 - Patched versions:
>= 2026.4.2 - Latest published npm version:
2026.4.1
Fix Commit(s)
ef7c553dd16ee579f1d1a363f5881a99726c1412— scope Zalo webhook replay dedupe across the missing event dimensions
Release Process Note
The fix is present on main and is staged for OpenClaw 2026.4.2. Publish this advisory after the 2026.4.2 npm release is live.
Thanks @D0ub1e-D for reporting.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2026.4.1"
},
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.4.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-41354"
],
"database_specific": {
"cwe_ids": [
"CWE-349",
"CWE-440"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-07T18:15:59Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n\nBefore OpenClaw 2026.4.2, Zalo webhook replay dedupe keys were not scoped strongly enough across chat and sender dimensions. Legitimate events from different conversations or senders could collide and be dropped as duplicates.\n\n## Impact\n\nCross-conversation or cross-sender collisions could cause silent message suppression and break bot workflows. This was an availability issue in webhook event processing.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `\u003c= 2026.4.1`\n- Patched versions: `\u003e= 2026.4.2`\n- Latest published npm version: `2026.4.1`\n\n## Fix Commit(s)\n\n- `ef7c553dd16ee579f1d1a363f5881a99726c1412` \u2014 scope Zalo webhook replay dedupe across the missing event dimensions\n\n## Release Process Note\n\nThe fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.\n\nThanks @D0ub1e-D for reporting.",
"id": "GHSA-rxmx-g7hr-8mx4",
"modified": "2026-05-07T16:44:15Z",
"published": "2026-04-07T18:15:59Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-rxmx-g7hr-8mx4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41354"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/ef7c553dd16ee579f1d1a363f5881a99726c1412"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-insufficient-scope-in-zalo-webhook-replay-dedupe-keys"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders"
}
GHSA-WGJV-9J3Q-JHG8
Vulnerability from github – Published: 2024-05-20 14:59 – Updated: 2026-06-10 13:41Summary
Servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a MitM attack.
References
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "aiosmtpd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-34083"
],
"database_specific": {
"cwe_ids": [
"CWE-349"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-20T14:59:07Z",
"nvd_published_at": "2024-05-18T19:15:49Z",
"severity": "MODERATE"
},
"details": "### Summary\nServers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a MitM attack.\n\n### References\n* [NO STARTTLS: Similar vulnerabilities discovered by previous researchers.](https://nostarttls.secvuln.info/)",
"id": "GHSA-wgjv-9j3q-jhg8",
"modified": "2026-06-10T13:41:53Z",
"published": "2024-05-20T14:59:07Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-wgjv-9j3q-jhg8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34083"
},
{
"type": "WEB",
"url": "https://github.com/aio-libs/aiosmtpd/commit/b3a4a2c6ecfd228856a20d637dc383541fcdbfda"
},
{
"type": "PACKAGE",
"url": "https://github.com/aio-libs/aiosmtpd"
},
{
"type": "WEB",
"url": "https://nostarttls.secvuln.info"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "aiosmtpd STARTTLS unencrypted commands injection"
}
GHSA-X7F7-RGGG-4JVV
Vulnerability from github – Published: 2026-05-20 12:30 – Updated: 2026-05-21 00:30NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be used to trick Unbound to cache such records. If an adversary is able to attach such records in a reply (i.e., spoofed packet, fragmentation attack) he would be able to poison Unbound's cache. A malicious actor can exploit the possible poisonous effect by injecting RRSets other than NS that are also accompanied by address records in a reply, for example MX. This could be achieved by trying to spoof a reply packet or fragmentation attacks. Unbound would then accept the relative address records in the additional section and cache them if the authority RRSet has enough trust at this point, i.e., in-zone data for the delegation point. Unbound 1.25.1 contains a patch with a fix that disregards address records from the additional section if they are not explicitly relevant only to authority NS records, mitigating the possible poison effect. This is a complement fix to CVE-2025-11411.
{
"affected": [],
"aliases": [
"CVE-2026-42960"
],
"database_specific": {
"cwe_ids": [
"CWE-349"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-20T10:16:28Z",
"severity": "MODERATE"
},
"details": "NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be used to trick Unbound to cache such records. If an adversary is able to attach such records in a reply (i.e., spoofed packet, fragmentation attack) he would be able to poison Unbound\u0027s cache. A malicious actor can exploit the possible poisonous effect by injecting RRSets other than NS that are also accompanied by address records in a reply, for example MX. This could be achieved by trying to spoof a reply packet or fragmentation attacks. Unbound would then accept the relative address records in the additional section and cache them if the authority RRSet has enough trust at this point, i.e., in-zone data for the delegation point. Unbound 1.25.1 contains a patch with a fix that disregards address records from the additional section if they are not explicitly relevant only to authority NS records, mitigating the possible poison effect. This is a complement fix to CVE-2025-11411.",
"id": "GHSA-x7f7-rggg-4jvv",
"modified": "2026-05-21T00:30:27Z",
"published": "2026-05-20T12:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42960"
},
{
"type": "WEB",
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42960.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber",
"type": "CVSS_V4"
}
]
}
GHSA-XCW6-8574-9QV2
Vulnerability from github – Published: 2025-04-08 18:34 – Updated: 2025-04-08 18:34Improper input validation in Microsoft Office Word allows an unauthorized attacker to bypass a security feature over a network.
{
"affected": [],
"aliases": [
"CVE-2025-29816"
],
"database_specific": {
"cwe_ids": [
"CWE-349"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-08T18:16:07Z",
"severity": "HIGH"
},
"details": "Improper input validation in Microsoft Office Word allows an unauthorized attacker to bypass a security feature over a network.",
"id": "GHSA-xcw6-8574-9qv2",
"modified": "2025-04-08T18:34:57Z",
"published": "2025-04-08T18:34:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29816"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29816"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-141: Cache Poisoning
An attacker exploits the functionality of cache technologies to cause specific data to be cached that aids the attackers' objectives. This describes any attack whereby an attacker places incorrect or harmful material in cache. The targeted cache can be an application's cache (e.g. a web browser cache) or a public cache (e.g. a DNS or ARP cache). Until the cache is refreshed, most applications or clients will treat the corrupted cache value as valid. This can lead to a wide range of exploits including redirecting web browsers towards sites that install malware and repeatedly incorrect calculations based on the incorrect value.
CAPEC-142: DNS Cache Poisoning
A domain name server translates a domain name (such as www.example.com) into an IP address that Internet hosts use to contact Internet resources. An adversary modifies a public DNS cache to cause certain names to resolve to incorrect addresses that the adversary specifies. The result is that client applications that rely upon the targeted cache for domain name resolution will be directed not to the actual address of the specified domain name but to some other address. Adversaries can use this to herd clients to sites that install malware on the victim's computer or to masquerade as part of a Pharming attack.
CAPEC-75: Manipulating Writeable Configuration Files
Generally these are manually edited files that are not in the preview of the system administrators, any ability on the attackers' behalf to modify these files, for example in a CVS repository, gives unauthorized access directly to the application, the same as authorized users.