CWE-358
Improperly Implemented Security Check for Standard
Description
The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.
Hierarchy (View 1000)
CVEs mapped to this weakness (136)
page 2 of 7| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-10834 | Hig | 0.57 | 8.8 | 0.01 | Aug 1, 2019 | cPanel before 55.9999.141 allows account-suspension bypass via ftp (SEC-105). | ||
| CVE-2019-3894 | Hig | 0.57 | 8.8 | 0.02 | May 3, 2019 | It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 stores a SecurityIdentity to run the thread as. These threads do not necessarily terminate if the keep alive time has not expired. This could allow a shared thread to use the… | ||
| CVE-2023-28601 | Hig | 0.54 | 8.3 | 0.01 | Jun 13, 2023 | Zoom for Windows clients prior to 5.14.0 contain an improper restriction of operations within the bounds of a memory buffer vulnerability. A malicious user may alter protected Zoom Client memory buffer potentially causing integrity issues within the Zoom Client. | ||
| CVE-2021-21387 | Hig | 0.53 | 8.1 | 0.00 | Mar 19, 2021 | Wrongthink peer-to-peer, end-to-end encrypted messenger with PeerJS and Axolotl ratchet. In wrongthink from version 2.0.0 and before 2.3.0 there was a set of vulnerabilities causing inadequate encryption strength. Part of the secret identity key was disclosed by the fingerprint… | ||
| CVE-2016-10825 | Hig | 0.53 | 8.1 | 0.01 | Aug 1, 2019 | cPanel before 55.9999.141 allows attackers to bypass a Security Policy by faking static documents (SEC-92). | ||
| CVE-2019-3806 | Hig | 0.53 | 8.1 | 0.01 | Jan 29, 2019 | An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua. | ||
| CVE-2017-15663 | Hig | 0.53 | 7.5 | 0.13 | Jan 10, 2018 | In Flexense Disk Pulse Enterprise v10.1.18, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9120. | ||
| CVE-2026-29103 | Cri | 0.52 | 9.1 | 0.01 | Mar 19, 2026 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. A Critical Remote Code Execution (RCE) vulnerability exists in SuiteCRM 7.15.0 and 8.9.2, allowing authenticated administrators to execute arbitrary system commands. This… | ||
| CVE-2017-15665 | Hig | 0.52 | 7.5 | 0.09 | Jan 10, 2018 | In Flexense DiskBoss Enterprise 8.5.12, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 8094. | ||
| CVE-2017-15664 | Hig | 0.52 | 7.5 | 0.09 | Jan 10, 2018 | In Flexense Sync Breeze Enterprise v10.1.16, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9121. | ||
| CVE-2017-15662 | Hig | 0.52 | 7.5 | 0.09 | Jan 10, 2018 | In Flexense VX Search Enterprise v10.1.12, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9123. | ||
| CVE-2024-40650 | Hig | 0.51 | 7.8 | 0.00 | Sep 11, 2024 | In wifi_item_edit_content of styles.xml , there is a possible FRP bypass due to Missing check for FRP state. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||
| CVE-2024-27842 | Hig | 0.51 | 7.8 | 0.00 | May 14, 2024 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5. An app may be able to execute arbitrary code with kernel privileges. | ||
| CVE-2024-25545 | Hig | 0.51 | 7.8 | 0.00 | Apr 12, 2024 | An issue in Weave Weave Desktop v.7.78.10 allows a local attacker to execute arbitrary code via a crafted script to the nwjs framework component. | ||
| CVE-2018-7685 | Hig | 0.51 | 7.8 | 0.00 | Aug 31, 2018 | The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not display the corrupted RPM warning and allow installation, a problem caused by malicious warnings only displayed during… | ||
| CVE-2026-44513 | Hig | 0.50 | 8.8 | 0.01 | May 14, 2026 | Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, a trust_remote_code bypass in DiffusionPipeline.from_pretrained allows arbitrary remote code execution despite the user passing trust_remote_code=False (or omitting it, which is the default). The… | ||
| CVE-2026-1486 | — | Hig | 0.50 | 8.8 | 0.00 | Feb 9, 2026 | A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP… | |
| CVE-2025-62585 | Hig | 0.49 | 7.5 | 0.00 | Oct 16, 2025 | Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment. | ||
| CVE-2023-40445 | Hig | 0.49 | 7.5 | 0.01 | Oct 25, 2023 | The issue was addressed with improved UI handling. This issue is fixed in iOS 17.1 and iPadOS 17.1. A device may persistently fail to lock. | ||
| CVE-2023-22393 | Hig | 0.49 | 7.5 | 0.01 | Jan 13, 2023 | An Improper Check for Unusual or Exceptional Conditions vulnerability in BGP route processing of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause Routing Protocol Daemon (RPD) crash by sending a BGP route with invalid next-hop resulting in a Denial of… |
- risk 0.57cvss 8.8epss 0.01
cPanel before 55.9999.141 allows account-suspension bypass via ftp (SEC-105).
- risk 0.57cvss 8.8epss 0.02
It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 stores a SecurityIdentity to run the thread as. These threads do not necessarily terminate if the keep alive time has not expired. This could allow a shared thread to use the…
- risk 0.54cvss 8.3epss 0.01
Zoom for Windows clients prior to 5.14.0 contain an improper restriction of operations within the bounds of a memory buffer vulnerability. A malicious user may alter protected Zoom Client memory buffer potentially causing integrity issues within the Zoom Client.
- risk 0.53cvss 8.1epss 0.00
Wrongthink peer-to-peer, end-to-end encrypted messenger with PeerJS and Axolotl ratchet. In wrongthink from version 2.0.0 and before 2.3.0 there was a set of vulnerabilities causing inadequate encryption strength. Part of the secret identity key was disclosed by the fingerprint…
- risk 0.53cvss 8.1epss 0.01
cPanel before 55.9999.141 allows attackers to bypass a Security Policy by faking static documents (SEC-92).
- risk 0.53cvss 8.1epss 0.01
An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua.
- risk 0.53cvss 7.5epss 0.13
In Flexense Disk Pulse Enterprise v10.1.18, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9120.
- risk 0.52cvss 9.1epss 0.01
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. A Critical Remote Code Execution (RCE) vulnerability exists in SuiteCRM 7.15.0 and 8.9.2, allowing authenticated administrators to execute arbitrary system commands. This…
- risk 0.52cvss 7.5epss 0.09
In Flexense DiskBoss Enterprise 8.5.12, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 8094.
- risk 0.52cvss 7.5epss 0.09
In Flexense Sync Breeze Enterprise v10.1.16, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9121.
- risk 0.52cvss 7.5epss 0.09
In Flexense VX Search Enterprise v10.1.12, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9123.
- risk 0.51cvss 7.8epss 0.00
In wifi_item_edit_content of styles.xml , there is a possible FRP bypass due to Missing check for FRP state. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- risk 0.51cvss 7.8epss 0.00
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5. An app may be able to execute arbitrary code with kernel privileges.
- risk 0.51cvss 7.8epss 0.00
An issue in Weave Weave Desktop v.7.78.10 allows a local attacker to execute arbitrary code via a crafted script to the nwjs framework component.
- risk 0.51cvss 7.8epss 0.00
The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not display the corrupted RPM warning and allow installation, a problem caused by malicious warnings only displayed during…
- risk 0.50cvss 8.8epss 0.01
Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, a trust_remote_code bypass in DiffusionPipeline.from_pretrained allows arbitrary remote code execution despite the user passing trust_remote_code=False (or omitting it, which is the default). The…
- risk 0.50cvss 8.8epss 0.00
A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP…
- risk 0.49cvss 7.5epss 0.00
Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment.
- risk 0.49cvss 7.5epss 0.01
The issue was addressed with improved UI handling. This issue is fixed in iOS 17.1 and iPadOS 17.1. A device may persistently fail to lock.
- risk 0.49cvss 7.5epss 0.01
An Improper Check for Unusual or Exceptional Conditions vulnerability in BGP route processing of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause Routing Protocol Daemon (RPD) crash by sending a BGP route with invalid next-hop resulting in a Denial of…