Insufficient Type Distinction
CWE-351
The product does not properly distinguish between different types of elements in a way that leads to insecure behavior.
We track 7 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.1. 1 has been exploited in real attacks.
Latest Insufficient Type Distinction vulnerabilities
- 8.8 High severity
BigFix RunBookAI: Improper Neutralization of Special Elements used in a Command
HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability. A flaw in a component's input handling was identified that could permit unauthorized command execution.
- 8.7 High severity
skops: Insufficient Type Distinction
skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below contain an inconsistency in MethodNode, which can be exploited to access unexpected object fields through dot notation. This can be used to ac
- 8.7 High severity
skops: Insufficient Type Distinction
skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below contain a inconsistency in the OperatorFuncNode which can be exploited to hide the execution of untrusted operator methods. This can then be u
- 7.5 High severity
Dnn.Platform: Insufficient Type Distinction
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 9.13.2, when uploading files (e.g. when uploading assets), the file extension is checked to see if it's an allowed file type but the actual c
- 7.8 High severity
RARLAB WinRAR Code Execution Exploited
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has th
- 7.8 High severity
WebAccess/SCADA: Insufficient Verification of Data Authenticity
If an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech WebAccess version 8.4.5, a web shell could be used to give the attacker full control of the SCADA server.
- 7.5 High severity
Swift Corelib-Foundation: Incorrect Type Conversion or Cast
A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a JSON document containing a type mismatch. This vulnerability is caused by the interaction between a deserialization mecha