Acceptance of Extraneous Untrusted Data With Trusted Data
CWE-349
The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.
We track 18 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.6.
Latest Acceptance of Extraneous Untrusted Data With Trusted Data vulnerabilities
- 9.3 Critical severity
assent: Authentication Bypass by Spoofing
Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback. Apple post
- 9.2 Critical severity
Advanced Authentication Server: Acceptance of Extraneous Untrusted Data With Trusted Data
Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8,
- 8.7 High severity
payy: Acceptance of Extraneous Untrusted Data With Trusted Data
Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory compliant transactions. Prior to version 1.3.0, agg_agg forwards the compacted message stream from its inner proofs into a public messages: [Field; 1000] array, but it never checks that the
- 8.8 High severity
Kiro IDE: Acceptance of Extraneous Untrusted Data With Trusted Data
The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message
- 9.2 Critical severity
server: Improper Authentication
Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior to 1.2.3 have an improper authentication vulnerability in the application's OAuth2 login flow. The application relies on client-side state by
- 9.3 Critical severity
Unbound: Acceptance of Extraneous Untrusted Data With Trusted Data
In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome i
- 9.8 Critical severity
Wyse Management Suite: Acceptance of Extraneous Untrusted Data With Trusted Data
Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Exe
- 10.0 Critical severity
Unbound: Acceptance of Extraneous Untrusted Data With Trusted Data
NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be used to trick Unbound to cache such records. If a
- 7.8 High severity
OpenClaw: Acceptance of Extraneous Untrusted Data With Trusted Data
OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to execute malicious code by crafting a .npmrc file with a git executable override. During npm install execution in the sta
- 8.6 High severity
BIND 9: Acceptance of Extraneous Untrusted Data With Trusted Data
Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 t
- 8.7 High severity
Unbound: Acceptance of Extraneous Untrusted Data With Trusted Data
A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send EC
- 8.6 High severity
BIND 9: Acceptance of Extraneous Untrusted Data With Trusted Data
A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack. This issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 through 9.20.10-
- 7.5 High severity
nuxt: Acceptance of Extraneous Untrusted Data With Trusted Data
Nuxt is an open-source web development framework for Vue.js. Prior to 3.16.0, by sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site. It is possibl
- 7.1 High severity
check-jsonschema: Acceptance of Extraneous Untrusted Data With Trusted Data
check-jsonschema is a CLI and set of pre-commit hooks for jsonschema validation. The default cache strategy uses the basename of a remote schema as the name of the file in the cache, e.g. `https://example.org/schema.json` will be stored as `schema.json`. This
- 7.2 High severity
EC-CUBE 4 series: Acceptance of Extraneous Untrusted Data With Trusted Data
Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series. If this vulnerability is exploited, an attacker who obtained the administrative privilege may install an arbitrary PHP package. If the obsolete versions of PHP
- 8.9 High severity
dnsjava: Insufficient Verification of Data Authenticity
dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability is fixed in 3.6.0.
- 9.8 Critical severity
IntelliJ IDEA: Insufficient Verification of Data Authenticity
In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the project configuration
- 7.2 High severity
RUGGEDCOM RM1224 LTE(4G) EU: Acceptance of Extraneous Untrusted Data With Trusted Data
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V7.2.2), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V7.2.2), SCALANCE M