Common Weakness Enumeration

CWE-231

Allowed

Improper Handling of Extra Values

Abstraction: Variant · Status: Draft

API response cwe.mitre.org

The product does not handle or incorrectly handles when more values are provided than expected.

9 vulnerabilities reference this CWE, most recent first.

CVE-2026-22888 (GCVE-0-2026-22888)

Vulnerability from cvelistv5 – Published: 2026-02-02 06:37 – Updated: 2026-02-02 16:28
VLAI
Summary
Improper input verification issue exists in Cybozu Garoon 5.0.0 to 6.0.3, which may lead to unauthorized alteration of portal settings, potentially blocking access to the product.
Severity
4.9 (Medium)
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-231 - Improper handling of extra values
Assigner
References
Impacted products
Vendor Product Version
Cybozu, Inc. Cybozu Garoon Affected: 5.0.0 to 6.0.3
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22888",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-02T15:13:27.952765Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-02T16:28:09.211Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cybozu Garoon",
          "vendor": "Cybozu, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "5.0.0 to 6.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper input verification issue exists in Cybozu Garoon 5.0.0 to 6.0.3, which may lead to unauthorized alteration of portal settings, potentially blocking access to the product."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-231",
              "description": "Improper handling of extra values",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-02T06:37:33.802Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://kb.cybozu.support/article/39083/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN35265756/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-22888",
    "datePublished": "2026-02-02T06:37:33.802Z",
    "dateReserved": "2026-01-27T00:34:57.984Z",
    "dateUpdated": "2026-02-02T16:28:09.211Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-20268 (GCVE-0-2024-20268)

Vulnerability from cvelistv5 – Published: 2024-10-23 17:06 – Updated: 2024-10-24 17:51
VLAI
Title
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SNMP Denial of Service Vulnerability
Summary
A vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause an unexpected reload of the device. This vulnerability is due to insufficient input validation of SNMP packets. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device using IPv4 or IPv6. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition. This vulnerability affects all versions of SNMP (versions 1, 2c, and 3) and requires a valid SNMP community string or valid SNMPv3 user credentials.
Severity
7.7 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-231 - Improper Handling of Extra Values
Assigner
References
Impacted products
Vendor Product Version
Cisco Cisco Adaptive Security Appliance (ASA) Software Affected: 9.14.1
Affected: 9.14.1.10
Affected: 9.14.1.6
Affected: 9.14.1.15
Affected: 9.14.1.19
Affected: 9.14.1.30
Affected: 9.15.1
Affected: 9.14.2
Affected: 9.14.2.4
Affected: 9.15.1.7
Affected: 9.14.2.8
Affected: 9.15.1.10
Affected: 9.14.2.13
Affected: 9.15.1.15
Affected: 9.14.2.15
Affected: 9.16.1
Affected: 9.15.1.16
Affected: 9.14.3
Affected: 9.16.1.28
Affected: 9.14.3.1
Affected: 9.14.3.9
Affected: 9.16.2
Affected: 9.16.2.3
Affected: 9.14.3.11
Affected: 9.15.1.17
Affected: 9.15.1.1
Affected: 9.14.3.13
Affected: 9.16.2.7
Affected: 9.14.3.15
Affected: 9.17.1
Affected: 9.16.2.11
Affected: 9.14.3.18
Affected: 9.16.2.13
Affected: 9.14.4
Affected: 9.16.2.14
Affected: 9.17.1.7
Affected: 9.15.1.21
Affected: 9.16.3.3
Affected: 9.14.4.6
Affected: 9.16.3
Affected: 9.16.3.14
Affected: 9.17.1.9
Affected: 9.14.4.7
Affected: 9.17.1.10
Affected: 9.18.1
Affected: 9.14.4.12
Affected: 9.16.3.15
Affected: 9.18.1.3
Affected: 9.17.1.11
Affected: 9.14.4.13
Affected: 9.18.2
Affected: 9.16.3.19
Affected: 9.17.1.13
Affected: 9.14.4.14
Affected: 9.17.1.15
Affected: 9.14.4.15
Affected: 9.16.3.23
Affected: 9.18.2.5
Affected: 9.16.4
Affected: 9.14.4.17
Affected: 9.17.1.20
Affected: 9.18.2.7
Affected: 9.19.1
Affected: 9.16.4.9
Affected: 9.18.2.8
Affected: 9.14.4.22
Affected: 9.16.4.14
Affected: 9.18.3
Affected: 9.19.1.5
Affected: 9.14.4.23
Affected: 9.16.4.18
Affected: 9.17.1.30
Affected: 9.19.1.9
Affected: 9.18.3.39
Affected: 9.16.4.19
Affected: 9.19.1.12
Affected: 9.18.3.46
Affected: 9.16.4.27
Affected: 9.19.1.18
Affected: 9.18.3.53
Affected: 9.18.3.55
Affected: 9.16.4.38
Affected: 9.17.1.33
Affected: 9.16.4.39
Affected: 9.18.3.56
Affected: 9.20.1
Affected: 9.16.4.42
Affected: 9.19.1.22
Affected: 9.18.4
Affected: 9.20.1.5
Affected: 9.18.4.5
Affected: 9.19.1.24
Affected: 9.16.4.48
Affected: 9.18.4.8
Affected: 9.20.2
Affected: 9.19.1.27
Affected: 9.14.4.24
Create a notification for this product.
Cisco Cisco Firepower Threat Defense Software Affected: 6.6.0
Affected: 6.6.0.1
Affected: 6.6.1
Affected: 6.7.0
Affected: 6.6.3
Affected: 6.7.0.1
Affected: 6.6.4
Affected: 6.7.0.2
Affected: 7.0.0
Affected: 7.0.0.1
Affected: 6.6.5
Affected: 7.0.1
Affected: 7.1.0
Affected: 6.6.5.1
Affected: 7.0.1.1
Affected: 6.7.0.3
Affected: 7.1.0.1
Affected: 6.6.5.2
Affected: 7.0.2
Affected: 7.2.0
Affected: 7.0.2.1
Affected: 7.0.3
Affected: 6.6.7
Affected: 7.1.0.2
Affected: 7.2.0.1
Affected: 7.0.4
Affected: 7.2.1
Affected: 7.0.5
Affected: 7.3.0
Affected: 7.2.2
Affected: 7.2.3
Affected: 6.6.7.1
Affected: 7.3.1
Affected: 7.1.0.3
Affected: 7.2.4
Affected: 7.0.6
Affected: 7.2.5
Affected: 7.2.4.1
Affected: 7.3.1.1
Affected: 7.4.0
Affected: 7.0.6.1
Affected: 7.2.5.1
Affected: 7.4.1
Affected: 7.4.1.1
Affected: 6.6.7.2
Affected: 7.2.5.2
Affected: 7.3.1.2
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20268",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-23T18:40:10.565850Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-24T17:51:17.009Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Adaptive Security Appliance (ASA) Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "9.14.1"
            },
            {
              "status": "affected",
              "version": "9.14.1.10"
            },
            {
              "status": "affected",
              "version": "9.14.1.6"
            },
            {
              "status": "affected",
              "version": "9.14.1.15"
            },
            {
              "status": "affected",
              "version": "9.14.1.19"
            },
            {
              "status": "affected",
              "version": "9.14.1.30"
            },
            {
              "status": "affected",
              "version": "9.15.1"
            },
            {
              "status": "affected",
              "version": "9.14.2"
            },
            {
              "status": "affected",
              "version": "9.14.2.4"
            },
            {
              "status": "affected",
              "version": "9.15.1.7"
            },
            {
              "status": "affected",
              "version": "9.14.2.8"
            },
            {
              "status": "affected",
              "version": "9.15.1.10"
            },
            {
              "status": "affected",
              "version": "9.14.2.13"
            },
            {
              "status": "affected",
              "version": "9.15.1.15"
            },
            {
              "status": "affected",
              "version": "9.14.2.15"
            },
            {
              "status": "affected",
              "version": "9.16.1"
            },
            {
              "status": "affected",
              "version": "9.15.1.16"
            },
            {
              "status": "affected",
              "version": "9.14.3"
            },
            {
              "status": "affected",
              "version": "9.16.1.28"
            },
            {
              "status": "affected",
              "version": "9.14.3.1"
            },
            {
              "status": "affected",
              "version": "9.14.3.9"
            },
            {
              "status": "affected",
              "version": "9.16.2"
            },
            {
              "status": "affected",
              "version": "9.16.2.3"
            },
            {
              "status": "affected",
              "version": "9.14.3.11"
            },
            {
              "status": "affected",
              "version": "9.15.1.17"
            },
            {
              "status": "affected",
              "version": "9.15.1.1"
            },
            {
              "status": "affected",
              "version": "9.14.3.13"
            },
            {
              "status": "affected",
              "version": "9.16.2.7"
            },
            {
              "status": "affected",
              "version": "9.14.3.15"
            },
            {
              "status": "affected",
              "version": "9.17.1"
            },
            {
              "status": "affected",
              "version": "9.16.2.11"
            },
            {
              "status": "affected",
              "version": "9.14.3.18"
            },
            {
              "status": "affected",
              "version": "9.16.2.13"
            },
            {
              "status": "affected",
              "version": "9.14.4"
            },
            {
              "status": "affected",
              "version": "9.16.2.14"
            },
            {
              "status": "affected",
              "version": "9.17.1.7"
            },
            {
              "status": "affected",
              "version": "9.15.1.21"
            },
            {
              "status": "affected",
              "version": "9.16.3.3"
            },
            {
              "status": "affected",
              "version": "9.14.4.6"
            },
            {
              "status": "affected",
              "version": "9.16.3"
            },
            {
              "status": "affected",
              "version": "9.16.3.14"
            },
            {
              "status": "affected",
              "version": "9.17.1.9"
            },
            {
              "status": "affected",
              "version": "9.14.4.7"
            },
            {
              "status": "affected",
              "version": "9.17.1.10"
            },
            {
              "status": "affected",
              "version": "9.18.1"
            },
            {
              "status": "affected",
              "version": "9.14.4.12"
            },
            {
              "status": "affected",
              "version": "9.16.3.15"
            },
            {
              "status": "affected",
              "version": "9.18.1.3"
            },
            {
              "status": "affected",
              "version": "9.17.1.11"
            },
            {
              "status": "affected",
              "version": "9.14.4.13"
            },
            {
              "status": "affected",
              "version": "9.18.2"
            },
            {
              "status": "affected",
              "version": "9.16.3.19"
            },
            {
              "status": "affected",
              "version": "9.17.1.13"
            },
            {
              "status": "affected",
              "version": "9.14.4.14"
            },
            {
              "status": "affected",
              "version": "9.17.1.15"
            },
            {
              "status": "affected",
              "version": "9.14.4.15"
            },
            {
              "status": "affected",
              "version": "9.16.3.23"
            },
            {
              "status": "affected",
              "version": "9.18.2.5"
            },
            {
              "status": "affected",
              "version": "9.16.4"
            },
            {
              "status": "affected",
              "version": "9.14.4.17"
            },
            {
              "status": "affected",
              "version": "9.17.1.20"
            },
            {
              "status": "affected",
              "version": "9.18.2.7"
            },
            {
              "status": "affected",
              "version": "9.19.1"
            },
            {
              "status": "affected",
              "version": "9.16.4.9"
            },
            {
              "status": "affected",
              "version": "9.18.2.8"
            },
            {
              "status": "affected",
              "version": "9.14.4.22"
            },
            {
              "status": "affected",
              "version": "9.16.4.14"
            },
            {
              "status": "affected",
              "version": "9.18.3"
            },
            {
              "status": "affected",
              "version": "9.19.1.5"
            },
            {
              "status": "affected",
              "version": "9.14.4.23"
            },
            {
              "status": "affected",
              "version": "9.16.4.18"
            },
            {
              "status": "affected",
              "version": "9.17.1.30"
            },
            {
              "status": "affected",
              "version": "9.19.1.9"
            },
            {
              "status": "affected",
              "version": "9.18.3.39"
            },
            {
              "status": "affected",
              "version": "9.16.4.19"
            },
            {
              "status": "affected",
              "version": "9.19.1.12"
            },
            {
              "status": "affected",
              "version": "9.18.3.46"
            },
            {
              "status": "affected",
              "version": "9.16.4.27"
            },
            {
              "status": "affected",
              "version": "9.19.1.18"
            },
            {
              "status": "affected",
              "version": "9.18.3.53"
            },
            {
              "status": "affected",
              "version": "9.18.3.55"
            },
            {
              "status": "affected",
              "version": "9.16.4.38"
            },
            {
              "status": "affected",
              "version": "9.17.1.33"
            },
            {
              "status": "affected",
              "version": "9.16.4.39"
            },
            {
              "status": "affected",
              "version": "9.18.3.56"
            },
            {
              "status": "affected",
              "version": "9.20.1"
            },
            {
              "status": "affected",
              "version": "9.16.4.42"
            },
            {
              "status": "affected",
              "version": "9.19.1.22"
            },
            {
              "status": "affected",
              "version": "9.18.4"
            },
            {
              "status": "affected",
              "version": "9.20.1.5"
            },
            {
              "status": "affected",
              "version": "9.18.4.5"
            },
            {
              "status": "affected",
              "version": "9.19.1.24"
            },
            {
              "status": "affected",
              "version": "9.16.4.48"
            },
            {
              "status": "affected",
              "version": "9.18.4.8"
            },
            {
              "status": "affected",
              "version": "9.20.2"
            },
            {
              "status": "affected",
              "version": "9.19.1.27"
            },
            {
              "status": "affected",
              "version": "9.14.4.24"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Cisco Firepower Threat Defense Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "6.6.0"
            },
            {
              "status": "affected",
              "version": "6.6.0.1"
            },
            {
              "status": "affected",
              "version": "6.6.1"
            },
            {
              "status": "affected",
              "version": "6.7.0"
            },
            {
              "status": "affected",
              "version": "6.6.3"
            },
            {
              "status": "affected",
              "version": "6.7.0.1"
            },
            {
              "status": "affected",
              "version": "6.6.4"
            },
            {
              "status": "affected",
              "version": "6.7.0.2"
            },
            {
              "status": "affected",
              "version": "7.0.0"
            },
            {
              "status": "affected",
              "version": "7.0.0.1"
            },
            {
              "status": "affected",
              "version": "6.6.5"
            },
            {
              "status": "affected",
              "version": "7.0.1"
            },
            {
              "status": "affected",
              "version": "7.1.0"
            },
            {
              "status": "affected",
              "version": "6.6.5.1"
            },
            {
              "status": "affected",
              "version": "7.0.1.1"
            },
            {
              "status": "affected",
              "version": "6.7.0.3"
            },
            {
              "status": "affected",
              "version": "7.1.0.1"
            },
            {
              "status": "affected",
              "version": "6.6.5.2"
            },
            {
              "status": "affected",
              "version": "7.0.2"
            },
            {
              "status": "affected",
              "version": "7.2.0"
            },
            {
              "status": "affected",
              "version": "7.0.2.1"
            },
            {
              "status": "affected",
              "version": "7.0.3"
            },
            {
              "status": "affected",
              "version": "6.6.7"
            },
            {
              "status": "affected",
              "version": "7.1.0.2"
            },
            {
              "status": "affected",
              "version": "7.2.0.1"
            },
            {
              "status": "affected",
              "version": "7.0.4"
            },
            {
              "status": "affected",
              "version": "7.2.1"
            },
            {
              "status": "affected",
              "version": "7.0.5"
            },
            {
              "status": "affected",
              "version": "7.3.0"
            },
            {
              "status": "affected",
              "version": "7.2.2"
            },
            {
              "status": "affected",
              "version": "7.2.3"
            },
            {
              "status": "affected",
              "version": "6.6.7.1"
            },
            {
              "status": "affected",
              "version": "7.3.1"
            },
            {
              "status": "affected",
              "version": "7.1.0.3"
            },
            {
              "status": "affected",
              "version": "7.2.4"
            },
            {
              "status": "affected",
              "version": "7.0.6"
            },
            {
              "status": "affected",
              "version": "7.2.5"
            },
            {
              "status": "affected",
              "version": "7.2.4.1"
            },
            {
              "status": "affected",
              "version": "7.3.1.1"
            },
            {
              "status": "affected",
              "version": "7.4.0"
            },
            {
              "status": "affected",
              "version": "7.0.6.1"
            },
            {
              "status": "affected",
              "version": "7.2.5.1"
            },
            {
              "status": "affected",
              "version": "7.4.1"
            },
            {
              "status": "affected",
              "version": "7.4.1.1"
            },
            {
              "status": "affected",
              "version": "6.6.7.2"
            },
            {
              "status": "affected",
              "version": "7.2.5.2"
            },
            {
              "status": "affected",
              "version": "7.3.1.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause an unexpected reload of the device.\r\n\r\nThis vulnerability is due to insufficient input validation of SNMP packets. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device using IPv4 or IPv6. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition. This vulnerability affects all versions of SNMP (versions 1, 2c, and 3) and requires a valid SNMP community string or valid SNMPv3 user credentials."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-231",
              "description": "Improper Handling of Extra Values",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-23T17:06:57.460Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-asaftd-snmp-dos-7TcnzxTU",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-snmp-dos-7TcnzxTU"
        },
        {
          "name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-M446vbEO",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-M446vbEO"
        },
        {
          "name": "Cisco Event Response: October 2024 Semiannual Cisco ASA, FMC, and FTD Software Security Advisory Bundled Publication",
          "url": "https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75300"
        }
      ],
      "source": {
        "advisory": "cisco-sa-asaftd-snmp-dos-7TcnzxTU",
        "defects": [
          "CSCwe90609"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SNMP Denial of Service Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2024-20268",
    "datePublished": "2024-10-23T17:06:57.460Z",
    "dateReserved": "2023-11-08T15:08:07.624Z",
    "dateUpdated": "2024-10-24T17:51:17.009Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-44386 (GCVE-0-2023-44386)

Vulnerability from cvelistv5 – Published: 2023-10-05 17:41 – Updated: 2024-09-19 17:58
VLAI
Title
Incorrect request error handling triggers server crash in Vapor
Summary
Vapor is an HTTP web framework for Swift. There is a denial of service vulnerability impacting all users of affected versions of Vapor. The HTTP1 error handler closed connections when HTTP parse errors occur instead of passing them on. The issue is fixed as of Vapor release 4.84.2.
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-231 - Improper Handling of Extra Values
  • CWE-617 - Reachable Assertion
  • CWE-696 - Incorrect Behavior Order
Assigner
References
Impacted products
Vendor Product Version
vapor vapor Affected: >= 4.83.2, < 4.84.2
Create a notification for this product.
vapor vapor Affected: 4.83.2 , < 4.84.2 (custom)
    cpe:2.3:a:vapor:vapor:*:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:07:32.820Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/vapor/vapor/security/advisories/GHSA-3mwq-h3g6-ffhm",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/vapor/vapor/security/advisories/GHSA-3mwq-h3g6-ffhm"
          },
          {
            "name": "https://github.com/vapor/vapor/commit/090464a654b03148b139a81f8f5ac63b0856f6f3",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/vapor/vapor/commit/090464a654b03148b139a81f8f5ac63b0856f6f3"
          },
          {
            "name": "https://github.com/vapor/vapor/releases/tag/4.84.2",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/vapor/vapor/releases/tag/4.84.2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:vapor:vapor:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "vapor",
            "vendor": "vapor",
            "versions": [
              {
                "lessThan": "4.84.2",
                "status": "affected",
                "version": "4.83.2",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-44386",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-19T17:32:03.746829Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-19T17:58:26.048Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vapor",
          "vendor": "vapor",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.83.2, \u003c 4.84.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vapor is an HTTP web framework for Swift. There is a denial of service vulnerability impacting all users of affected versions of Vapor. The HTTP1 error handler closed connections when HTTP parse errors occur instead of passing them on. The issue is fixed as of Vapor release 4.84.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-231",
              "description": "CWE-231: Improper Handling of Extra Values",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-617",
              "description": "CWE-617: Reachable Assertion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-696",
              "description": "CWE-696: Incorrect Behavior Order",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-05T17:41:38.379Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vapor/vapor/security/advisories/GHSA-3mwq-h3g6-ffhm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vapor/vapor/security/advisories/GHSA-3mwq-h3g6-ffhm"
        },
        {
          "name": "https://github.com/vapor/vapor/commit/090464a654b03148b139a81f8f5ac63b0856f6f3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vapor/vapor/commit/090464a654b03148b139a81f8f5ac63b0856f6f3"
        },
        {
          "name": "https://github.com/vapor/vapor/releases/tag/4.84.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vapor/vapor/releases/tag/4.84.2"
        }
      ],
      "source": {
        "advisory": "GHSA-3mwq-h3g6-ffhm",
        "discovery": "UNKNOWN"
      },
      "title": "Incorrect request error handling triggers server crash in Vapor"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-44386",
    "datePublished": "2023-10-05T17:41:38.379Z",
    "dateReserved": "2023-09-28T17:56:32.613Z",
    "dateUpdated": "2024-09-19T17:58:26.048Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-6841 (GCVE-0-2023-6841)

Vulnerability from cvelistv5 – Published: 2024-09-10 16:15 – Updated: 2025-11-08 07:10
VLAI
Title
Keycloak: amount of attributes per object is not limited and it may lead to dos
Summary
A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-231 - Improper Handling of Extra Values
Assigner
References
URL Tags
https://access.redhat.com/security/cve/CVE-2023-6841 vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2254714 issue-trackingx_refsource_REDHAT
Impacted products
Vendor Product Version
Affected: 0 , < 24.0.0 (semver)
Red Hat Red Hat build of Quarkus     cpe:/a:redhat:openshift_application_runtimes:1.0
 Create a notification for this product.
Red Hat Red Hat Fuse 7     cpe:/a:redhat:jboss_fuse:7
 Create a notification for this product.
Red Hat Red Hat Mobile Application Platform 4     cpe:/a:redhat:mobile_application_platform:4
 Create a notification for this product.
Red Hat Red Hat OpenShift Application Runtimes     cpe:/a:redhat:openshift_application_runtimes:1.0
 Create a notification for this product.
Red Hat Red Hat Process Automation 7     cpe:/a:redhat:jboss_enterprise_bpms_platform:7
 Create a notification for this product.
Red Hat Red Hat Single Sign-On 7     cpe:/a:redhat:red_hat_single_sign_on:7
 Create a notification for this product.
Red Hat Red Hat support for Spring Boot     cpe:/a:redhat:openshift_application_runtimes:1.0
 Create a notification for this product.
Date Public
2024-09-10 15:45
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-6841",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-01T20:20:35.831984Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-01T20:20:45.372Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/keycloak/keycloak",
          "defaultStatus": "unaffected",
          "packageName": "keycloak",
          "versions": [
            {
              "lessThan": "24.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_application_runtimes:1.0"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keycloak",
          "product": "Red Hat build of Quarkus",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_fuse:7"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keycloak",
          "product": "Red Hat Fuse 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:mobile_application_platform:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keycloak",
          "product": "Red Hat Mobile Application Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_application_runtimes:1.0"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keycloak",
          "product": "Red Hat OpenShift Application Runtimes",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keycloak",
          "product": "Red Hat Process Automation 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:red_hat_single_sign_on:7"
          ],
          "defaultStatus": "affected",
          "packageName": "rh-sso7-keycloak",
          "product": "Red Hat Single Sign-On 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_application_runtimes:1.0"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keycloak",
          "product": "Red Hat support for Spring Boot",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2024-09-10T15:45:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-231",
              "description": "Improper Handling of Extra Values",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-08T07:10:39.283Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2023-6841"
        },
        {
          "name": "RHBZ#2254714",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2254714"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-12-15T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2024-09-10T15:45:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Keycloak: amount of attributes per object is not limited and it may lead to dos",
      "workarounds": [
        {
          "lang": "en",
          "value": "This CVE is mitigated by the \u0027User Profile\u0027 functionality, which was introduced in Keycloak 24. This feature introduces additional validation which prevents this vulnerability from being exploited."
        }
      ],
      "x_redhatCweChain": "CWE-231: Improper Handling of Extra Values"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2023-6841",
    "datePublished": "2024-09-10T16:15:32.639Z",
    "dateReserved": "2023-12-15T12:33:39.292Z",
    "dateUpdated": "2025-11-08T07:10:39.283Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-3MWQ-H3G6-FFHM

Vulnerability from github – Published: 2023-10-05 20:55 – Updated: 2024-02-09 00:31
VLAI
Summary
Vapor's incorrect request error handling triggers server crash
Details

Vapor incorrectly handles errors encountered during parsing of HTTP 1.x requests, triggering a precondition failure in swift-nio due to API misuse and causing immediate termination of the server process.

Impact

This is a denial of service vulnerability, impacting all users of affected versions of Vapor. Because the crash is an explicit assertion failure, there is no corruption of process state and no risk of data leakage or unauthorized code execution. Total impact is limited to an immediately recoverable service interruption.

Patches

The issue is fixed as of Vapor release 4.84.2.

Workarounds

None known at this time.

For more information

If you have any questions or comments about this advisory: * Open an issue in the Vapor repo * Ask in Vapor Discord

Acknowledgements

Full credit for reporting this issue goes to @t0rchwo0d, with additional thanks for responsibly disclosing.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "SwiftURL",
        "name": "github.com/vapor/vapor"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.83.2"
            },
            {
              "fixed": "4.84.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-44386"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-231"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-05T20:55:58Z",
    "nvd_published_at": "2023-10-05T18:15:12Z",
    "severity": "MODERATE"
  },
  "details": "Vapor incorrectly handles errors encountered during parsing of HTTP 1.x requests, triggering a precondition failure in swift-nio due to API misuse and causing immediate termination of the server process.\n\n### Impact\nThis is a denial of service vulnerability, impacting all users of affected versions of Vapor. Because the crash is an explicit assertion failure, there is no corruption of process state and no risk of data leakage or unauthorized code execution. Total impact is limited to an immediately recoverable service interruption.\n\n### Patches\nThe issue is fixed as of Vapor release 4.84.2.\n\n### Workarounds\nNone known at this time.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the Vapor repo](https://github.com/vapor/vapor)\n* Ask in [Vapor Discord](http://vapor.team)\n\n### Acknowledgements\n\nFull credit for reporting this issue goes to @t0rchwo0d, with additional thanks for responsibly disclosing.",
  "id": "GHSA-3mwq-h3g6-ffhm",
  "modified": "2024-02-09T00:31:39Z",
  "published": "2023-10-05T20:55:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vapor/vapor/security/advisories/GHSA-3mwq-h3g6-ffhm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44386"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vapor/vapor/commit/090464a654b03148b139a81f8f5ac63b0856f6f3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vapor/vapor"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vapor/vapor/releases/tag/4.84.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Vapor\u0027s incorrect request error handling triggers server crash"
}

GHSA-GVJQ-F8M6-M457

Vulnerability from github – Published: 2024-10-23 18:33 – Updated: 2024-10-23 18:33
VLAI
Details

A vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause an unexpected reload of the device.

This vulnerability is due to insufficient input validation of SNMP packets. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device using IPv4 or IPv6. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition. This vulnerability affects all versions of SNMP (versions 1, 2c, and 3) and requires a valid SNMP community string or valid SNMPv3 user credentials.

Severity
7.7 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-20268"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-231"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-23T17:15:14Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause an unexpected reload of the device.\n\nThis vulnerability is due to insufficient input validation of SNMP packets. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device using IPv4 or IPv6. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition. This vulnerability affects all versions of SNMP (versions 1, 2c, and 3) and requires a valid SNMP community string or valid SNMPv3 user credentials.",
  "id": "GHSA-gvjq-f8m6-m457",
  "modified": "2024-10-23T18:33:08Z",
  "published": "2024-10-23T18:33:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20268"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-snmp-dos-7TcnzxTU"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-M446vbEO"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75300"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RMHG-9566-PVGQ

Vulnerability from github – Published: 2026-02-02 09:30 – Updated: 2026-02-02 09:30
VLAI
Details

Improper input verification issue exists in Cybozu Garoon 5.0.0 to 6.0.3, which may lead to unauthorized alteration of portal settings, potentially blocking access to the product.

Severity
4.9 (Medium)
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-22888"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-231"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-02T07:16:45Z",
    "severity": "MODERATE"
  },
  "details": "Improper input verification issue exists in Cybozu Garoon 5.0.0 to 6.0.3, which may lead to unauthorized alteration of portal settings, potentially blocking access to the product.",
  "id": "GHSA-rmhg-9566-pvgq",
  "modified": "2026-02-02T09:30:30Z",
  "published": "2026-02-02T09:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22888"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN35265756"
    },
    {
      "type": "WEB",
      "url": "https://kb.cybozu.support/article/39083"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-RP47-R8R5-FMGM

Vulnerability from github – Published: 2024-06-11 06:31 – Updated: 2024-07-03 18:44
VLAI
Details

Improper handling of extra values issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, a user who can log in to the product with the administrative privilege may be able to cause a denial-of-service (DoS) condition.

Severity
4.9 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-31397"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-231"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-11T06:15:10Z",
    "severity": "MODERATE"
  },
  "details": "Improper handling of extra values issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, a user who can log in to the product with the administrative privilege may be able to cause a denial-of-service (DoS) condition.",
  "id": "GHSA-rp47-r8r5-fmgm",
  "modified": "2024-07-03T18:44:46Z",
  "published": "2024-06-11T06:31:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31397"
    },
    {
      "type": "WEB",
      "url": "https://cs.cybozu.co.jp/2024/007901.html"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN28869536"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-W97F-W3HQ-36G2

Vulnerability from github – Published: 2024-09-10 18:30 – Updated: 2024-11-18 16:27
VLAI
Summary
Keycloak Denial of Service vulnerability
Details

A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited, an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values. The issue is fixed in Keycloak 24 with the introduction of the User Profile feature.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.keycloak:keycloak-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "24.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-6841"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-231"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-10T19:41:54Z",
    "nvd_published_at": "2024-09-10T17:15:15Z",
    "severity": "HIGH"
  },
  "details": "A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited, an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values. The issue is fixed in Keycloak 24 with the introduction of the User Profile feature.",
  "id": "GHSA-w97f-w3hq-36g2",
  "modified": "2024-11-18T16:27:11Z",
  "published": "2024-09-10T18:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6841"
    },
    {
      "type": "WEB",
      "url": "https://github.com/keycloak/keycloak/issues/32837"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2023-6841"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2254714"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/keycloak/keycloak"
    },
    {
      "type": "WEB",
      "url": "https://github.com/keycloak/keycloak/releases/tag/24.0.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Keycloak Denial of Service vulnerability"
}

No mitigation information available for this CWE.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list