CWE-424 Improper Protection of Alternate Path
classThe product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (47)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-58136US | critical9.8OT kritisch | KEV | ||
Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 202… | ||||
| CVE-2025-48827US | critical9.8 | Exploit | ||
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by… | ||||
| CVE-2025-48828US | high8.1 | Exploit | ||
Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative… | ||||
| CVE-2026-66756US | critical9.8 | — | ||
Improper Protection of Alternate Path vulnerability in Apache Tika.
This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1.
Users are recommended to upgrade to ve… | ||||
| CVE-2023-20272US | high8.8 | — | ||
A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to upload malicious files to the web root of t… | ||||
| CVE-2023-5165US | high8.8OT erhöht | — | ||
Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions via the debug shell which remains accessible for a short time win… | ||||
| CVE-2026-0237US | high7.8 | — | ||
An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automation bridge. This allow… | ||||
| CVE-2024-3459US | high7.8 | — | ||
KioWare for Windows (versions all through 8.34) allows to escape the environment by downloading PDF files, which then by default are opened in an external PDF viewer. By using buil… | ||||
| CVE-2023-46176US | high7.8 | — | ||
IBM MQ Appliance 9.3 CD could allow a local attacker to gain elevated privileges on the system, caused by improper validation of security keys. IBM X-Force ID: 269535. | ||||
| CVE-2019-18997US | high7.5 | — | ||
The HMISimulator component of ABB PB610 Panel Builder 600 uses the readFile/writeFile interface to manipulate the work file. Path configuration in PB610 HMISimulator versions 2.8.0… | ||||
| CVE-2019-18996US | high7.8 | — | ||
Path settings in HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier accept DLLs outside of the program directory, potentially allowing an attacker wi… | ||||
| CVE-2026-110865US | high7.1 | — | ||
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared p… | ||||
| CVE-2024-3460US | high7.0 | — | ||
In KioWare for Windows (versions all through 8.34) it is possible to exit this software and use other already opened applications utilizing a short time window before the forced au… | ||||
| CVE-2023-0629US | high7.1 | — | ||
Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions by setting the Docker host to docker.raw.sock, or npipe:////.pipe… | ||||
| CVE-2025-6250US | medium6.7 | — | ||
Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections. Once the service is disabled, t… | ||||
| CVE-2022-1742US | medium6.8 | — | ||
The tested version of Dominion Voting Systems ImageCast X allows for rebooting into Android Safe Mode, which allows an attacker to directly access the operating system. An attacker… | ||||
| CVE-2026-114659US | medium6.5 | — | ||
Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permi… | ||||
| CVE-2024-8311US | medium6.5 | — | ||
An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 which allows authenticated users to byp… | ||||
| CVE-2026-69979US | medium5.5 | — | ||
Improper protection of alternate path in Windows AppX Deployment Service allows an authorized attacker to bypass a security feature locally. | ||||
| CVE-2025-68939US | medium5.3 | — | ||
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API. | ||||
04
Angriffsmuster (2)
CAPEC-Angriffsmuster, die dies ausnutzen.
05
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan