Interpretation Conflict
CWE-436
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
We track 88 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.3. 2 have been exploited in real attacks.
Latest Interpretation Conflict vulnerabilities
- 7.5 High severity
psr7: Interpretation Conflict
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is us
- 7.5 High severity
BiSheng-WNM: Interpretation Conflict
There is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation of this vulnerability may cause the printer service to be abnormal.
- 9.8 Critical severity
dompdf: Interpretation Conflict
Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can still call arbitrary URLs with arbitrary protocols. Dompdf parses the href attribute of `image` tags and respects `xlink
- 7.5 High severity
Modsecurity: Interpretation Conflict
In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is related to CVE-2022-39956 but can be considered independent changes to the ModSecurity (C language) c
- 7.5 High severity
Apache Shiro: Interpretation Conflict
When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro a
- 7.4 High severity
Cisco IOS XE Software: Interpretation Conflict
A vulnerability in the implementation of IPv6 VPN over MPLS (6VPE) with Zone-Based Firewall (ZBFW) of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability
- 8.8 High severity
zitadel: Incorrect Authorization
ZITADEL combines the ease of Auth0 and the versatility of Keycloak.**Actions**, introduced in ZITADEL **1.42.0** on the API and **1.56.0** for Console, is a feature, where users with role.`ORG_OWNER` are able to create Javascript Code, which is invoked by the
- 7.5 High severity
Go: Interpretation Conflict
cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.