CWE-670 Always-Incorrect Control Flow Implementation
classThe code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (562)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-32896US | high7.8OT kritisch | KEV | ||
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interacti… | ||||
| CVE-2020-28052US | high8.1 | Exploit | ||
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, all… | ||||
| CVE-2023-0400US | high8.2 | Exploit | ||
The protection bypass vulnerability in DLP for Windows 11.9.x is addressed in version 11.10.0. This allowed a local user to bypass DLP controls when uploading sensitive data from… | ||||
| CVE-2026-35414US | high8.1 | Exploit | ||
OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certai… | ||||
| CVE-2026-38361US | high7.5 | Exploit | ||
Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. The chunked-upload handler (dash_uploader/httprequesthandler.py, dash_upl… | ||||
| CVE-2021-34767US | high7.4 | Exploit | ||
A vulnerability in IPv6 traffic processing of Cisco IOS XE Wireless Controller Software for Cisco Catalyst 9000 Family Wireless Controllers could allow an unauthenticated, adjacent… | ||||
| CVE-2020-12338US | critical9.8 | — | ||
Insufficient control flow management in the Open WebRTC Toolkit before version 4.3.1 may allow an unauthenticated user to potentially enable escalation of privilege via network acc… | ||||
| CVE-2020-1914US | critical9.8 | — | ||
A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fdddfc allows attackers to potentially re… | ||||
| CVE-2020-17466US | critical9.8 | — | ||
Turcom TRCwifiZone through 2020-08-10 allows authentication bypass by visiting manage/control.php and ignoring 302 Redirect responses. | ||||
| CVE-2019-17192US | critical9.8 | — | ||
The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packets before a callee chooses to answer a call, which… | ||||
| CVE-2015-8857US | critical9.8 | — | ||
The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security… | ||||
| CVE-2024-3376US | critical9.8 | — | ||
A vulnerability classified as critical has been found in SourceCodester Computer Laboratory Management System 1.0. This affects an unknown part of the file config.php. The manipula… | ||||
| CVE-2023-23623US | critical9.8 | — | ||
Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. A Content-Security-Policy that disables eval, specifically setting… | ||||
| CVE-2022-25745US | critical9.8 | — | ||
Memory corruption in modem due to improper input validation while handling the incoming CoAP message | ||||
| CVE-2023-20921US | high7.3 | Exploit | ||
In onPackageRemoved of AccessibilityManagerService.java, there is a possibility to automatically grant accessibility services due to a logic error in the code. This could lead to l… | ||||
| CVE-2022-2993US | critical9.8 | — | ||
There is an error in the condition of the last if-statement in the function smp_check_keys. It was rejecting current keys if all requirements were unmet. | ||||
| CVE-2022-21679US | critical9.8 | — | ||
Istio is an open platform to connect, manage, and secure microservices. In Istio 1.12.0 and 1.12.1 The authorization policy with hosts and notHosts might be accidentally bypassed f… | ||||
| CVE-2021-41153US | critical9.8 | — | ||
The evm crate is a pure Rust implementation of Ethereum Virtual Machine. In `evm` crate `< 0.31.0`, `JUMPI` opcode's condition is checked after the destination validity check. Howe… | ||||
| CVE-2020-9425US | high7.5 | — | ||
An issue was discovered in includes/head.inc.php in rConfig before 3.9.4. An unauthenticated attacker can retrieve saved cleartext credentials via a GET request to settings.php. Be… | ||||
| CVE-2021-41612US | high8.8 | — | ||
An issue was discovered in the ALU unit of the OpenRISC mor1kx processor. The carry flag is not being updated correctly for the subtract instruction, which results in an incorrect… | ||||
04
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan