CWE-472

External Control of Assumed-Immutable Web Parameter

Parent: CWE-642 - External Control of Critical State Data

The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.

140 vulnerabilities with CWE-472

CVE-2023-28512 MEDIUM

IBM Watson CP4D Data Stores <4.6.3 - Info Disclosure

CVSS 5.9

CVE-2022-30597 MEDIUM

Moodle - Info Disclosure

CVSS 5.3

CVE-2021-27770 MEDIUM

HCL Sametime - Server-Side Request Forgery via FaviconService Base64-Encoded URL

CVSS 6.8

CVE-2021-27769 MEDIUM

Information Disclosure - Info Disclosure

CVSS 5.3

CVE-2021-1295 CRITICAL

Cisco Small Business VPN Routers - RCE

CVSS 9.8

CVE-2021-1294 CRITICAL

Cisco Small Business RV160-260 - RCE

CVSS 9.8

CVE-2021-1293 CRITICAL

Cisco Small Business RV160-260 - RCE

CVSS 9.8

CVE-2021-1292 CRITICAL

Cisco Small Business RV160-260 - RCE

CVSS 9.8

CVE-2021-1291 CRITICAL

Cisco Small Business RV160-260 - RCE

CVSS 9.8

CVE-2021-1290 CRITICAL

Cisco Small Business RV160-260 - RCE

CVSS 9.8

CVE-2021-1289 CRITICAL

Cisco Small Business RV160-260 - RCE

CVSS 9.8

CVE-2020-1765 LOW

OTRS <5.0.39, <6.0.24, <7.0.13 - Info Disclosure

CVSS 3.5

CVE-2019-13927 MEDIUM

Siemens Desigo PX Automation Controllers - Denial of Service via Crafted HTTP Message

CVSS 5.3

CVE-2017-5261 HIGH

Cambium Networks cnPilot <4.3.2-R4 - Path Traversal

CVSS 8.8

CVE-2017-5260 HIGH

Cambium Networks cnPilot <4.3.2-R4 - Info Disclosure

CVSS 8.8

Details

Vulnerabilities 140

Links