Undefined Behavior for Input to API
CWE-475
The behavior of this function is undefined unless its control parameter is set to a specific value.
We track 8 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.8.
Latest Undefined Behavior for Input to API vulnerabilities
- 8.1 High severity
OpenSearch: Undefined Behavior for Input to API
Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index p
- 7.5 High severity
Red Hat Enterprise Linux 10: Undefined Behavior for Input to API
A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets w
- 7.5 High severity
Other issue in the JavaScript Engine component.
Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
- 7.1 High severity
openexr: Incorrect Type Conversion or Cast
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9, a misaligned memory write vulnerability exists in LossyDctDecoder_exe
- 7.5 High severity
Trend Micro Apex Central: Unrestricted Upload of File with Dangerous Type
An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to upload arbitrary files on affected installations.
- 9.8 Critical severity
Trend Micro Apex Central: Undefined Behavior for Input to API
A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to gain remote code execution on affected installations.
- 7.5 High severity
gradio-app/gradio: Undefined Behavior for Input to API
A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack. The component uses pd.read_csv to process input values, which can accept compressed files. An attacker can exploit this by uploading a malicious
- 7.5 High severity
ClamAV: Undefined Behavior for Input to API
A vulnerability in the HTML parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to an issue in the C to Rust foreign function interface. An attacker could