cve.bz

CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data

Filter

The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.

What the weakness is: CWE-349 at MITRE

Related attack patterns (CAPEC): 3
  • CAPEC-75 Manipulating Writeable Configuration Files Likelihood: High · Severity: Very High
  • CAPEC-141 Cache Poisoning Likelihood: High · Severity: High
  • CAPEC-142 DNS Cache Poisoning Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-349, as MITRE names them. Credits.

Ask an AI about CWE-349

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/349.html and https://cve.bz/cve/cwe/349?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 1.9CVE-2026-59263

    A manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user. Such documents are corrupt and should not be opened. Users are recommended to upgrade to version 4.1.…

  2. 9.3CVE-2026-117656EPSS 0.2%

    Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization…

  3. 9.2CVE-2026-112256EPSS 0.2%

    Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advanced Authentication Server: from 6.…

  4. 6.9CVE-2026-102527EPSS 0.2%

    Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_og/d/*.png route accepts unsigned requests while resolvePathCacheKey() produces cache keys from the request path, site URL, and normalized …

  5. 4.6CVE-2026-100755EPSS 0.09%

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain deployment configurations, could have allowed an authenticated user to poison cac…

  6. 8.7CVE-2026-48100EPSS 0.2%

    Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory compliant transactions. Prior to version 1.3.0, agg_agg forwards the compacted message stream from its inner proofs into a public messages: [Field; 1000] array, but it …

  7. 8.6CVE-2026-95985EPSS 0.1%

    The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace,…

  8. 2.3CVE-2026-62364EPSS 0.08%

    wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLC_KE…

  9. 6.5CVE-2026-19033EPSS 0.2%

    For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a…

  10. 5.8CVE-2026-78301EPSS 0.2%

    A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configu…

  11. 9.2CVE-2026-54047EPSS 0.3%

    Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior to 1.2.3 have an improper authentication vulnerability in the application's OAuth2 login flow. The application relies on…

  12. 6.5CVE-2026-74916EPSS 0.2%

    The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered …

  13. 4.3CVE-2026-15387EPSS 0.2%

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have influen…

  14. 4.8CVE-2026-54625EPSS 0.2%

    django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key functio…

  15. 5.7CVE-2026-50252EPSS 0.2%

    In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port …

  16. 9.8CVE-2026-41120EPSS 0.4%

    Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leadi…

  17. 7.5CVE-2026-33612EPSS 0.1%

    A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to cache poisoning.

  18. 2.3CVE-2026-46342EPSS 0.09%

    Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.1.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, the /__nuxt_i…

  19. 9.1CVE-2026-45602EPSS 0.4%

    No cwe for this issue in Windows DHCP Server allows an unauthorized attacker to perform tampering over a network.

  20. 5.7CVE-2026-42960EPSS 0.3%

    NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be used to trick Unbound to cac…

  21. 5.9CVE-2026-44572EPSS 0.3%

    Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path handled by middleware that returns a redire…

  22. 8.4CVE-2026-32162EPSS 1.9%

    Acceptance of extraneous untrusted data with trusted data in Windows COM allows an unauthorized attacker to elevate privileges locally.

  23. 8.4CVE-2026-35641EPSS 0.1%

    OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to execute malicious code by crafting a .npmrc file with a git executable override. During npm install…

  24. 8.2CVE-2026-1642EPSS 0.4%

    A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond t…

  25. 5.4CVE-2025-68269EPSS 0.1%

    In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSH

  26. 0.0CVE-2025-1680EPSS 0.2%

    An acceptance of extraneous untrusted data with trusted data vulnerability has been identified in Moxa’s Ethernet switches, which allows attackers with administrative privileges to manipulate HTTP Host headers by injecting a specially craf…

  27. 8.6CVE-2025-40778EPSS 0.7%

    Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 thro…

  28. 5.7CVE-2025-11411EPSS 0.3%

    NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks. Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick resolvers to update their deleg…

  29. 5.3CVE-2025-11703EPSS 0.2%

    The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 9.0.48. This is due to the plugin not serving cached data from server-side responses and instead relying o…

  30. 8.7CVE-2025-5994EPSS 0.2%

    A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND …

  31. 8.6CVE-2025-40776EPSS 0.2%

    A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack. This issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.…

  32. 6.8CVE-2025-48804EPSS 0.7%

    Acceptance of extraneous untrusted data with trusted data in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

  33. 4.3CVE-2025-46339EPSS 0.2%

    FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to poison feed favicons by adding a given URL as a feed with the proxy set to an attacker-controlled one and disabled SSL verifying. The favicon hash is …

  34. 4.3CVE-2025-20255EPSS 0.2%

    A vulnerability in client join services of Cisco Webex Meetings could allow an unauthenticated, remote attacker to manipulate cached HTTP responses within the meeting join service. This vulnerability is due to improper handling of malic…

  35. 7.5CVE-2025-29842EPSS 0.4%

    Acceptance of extraneous untrusted data with trusted data in UrlMon allows an unauthorized attacker to bypass a security feature over a network.

  36. 7.5CVE-2025-29816EPSS 0.5%

    Improper input validation in Microsoft Office Word allows an unauthorized attacker to bypass a security feature over a network.

  37. 7.5CVE-2025-27415EPSS 0.4%

    Nuxt is an open-source web development framework for Vue.js. Prior to 3.16.0, by sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of …

  38. 7.1CVE-2024-53848EPSS 0.1%

    check-jsonschema is a CLI and set of pre-commit hooks for jsonschema validation. The default cache strategy uses the basename of a remote schema as the name of the file in the cache, e.g. `https://example.org/schema.json` will be stored as…

  39. 7.8CVE-2024-52555EPSS 0.1%

    In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible via type definitions installer script

  40. 6.5CVE-2024-42483EPSS 0.3%

    ESP-NOW Component provides a connectionless Wi-Fi communication protocol. An replay attacks vulnerability was discovered in the implementation of the ESP-NOW because the caches is not differentiated by message types, it is a single, shared…

  41. 7.2CVE-2024-41924EPSS 0.3%

    Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series. If this vulnerability is exploited, an attacker who obtained the administrative privilege may install an arbitrary PHP package. If the obso…

  42. 8.9CVE-2024-25638EPSS 0.4%

    dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability is fixed in 3.6.0.

  43. 5.4CVE-2024-34083EPSS 0.2%

    aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted con…

  44. 3.7CVE-2024-21094EPSS 0.8%

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22, 17.0.10, 2…

  45. 9.8CVE-2023-51655EPSS 0.3%

    In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the project configuration

  46. 8.6CVE-2023-44317EPSS 0.4%

    A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V7.2.2), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions …

  47. 5.3CVE-2023-5548EPSS 0.3%

    Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection.

  48. 5.5CVE-2023-3749EPSS 0.1%

    A local user could edit the VideoEdge configuration file and interfere with VideoEdge operation.

  49. 8.1CVE-2021-21374EPSS 1.0%

    Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due …

  50. 7.8CVE-2020-8023EPSS 0.4%

    A acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the start script of openldap2 of SUSE Enterprise Storage 5, SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise …