CWE-696 Incorrect Behavior Order
classThe product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (70)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-45033US | high7.8 | Exploit | ||
GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a security vulnerability has been identified in GitHub Copilot CLI where a m… | ||||
| CVE-2026-35652US | critical9.1OT erhöht | — | ||
OpenClaw before 2026.3.22 contains an authorization bypass vulnerability in interactive callback dispatch that allows non-allowlisted senders to execute action handlers. Attackers… | ||||
| CVE-2023-6394US | critical9.1OT erhöht | — | ||
A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the reque… | ||||
| CVE-2026-40583US | high8.2 | — | ||
UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council attacker can submit a signed SmartOp::Vote transaction that passes signature, nonce, and balance pre… | ||||
| CVE-2026-35627US | high8.2OT erhöht | — | ||
OpenClaw before 2026.3.22 performs cryptographic and dispatch operations on inbound Nostr direct messages before enforcing sender and pairing policy validation. Attackers can trigg… | ||||
| CVE-2021-22569US | medium5.5 | Exploit | ||
An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can o… | ||||
| CVE-2026-35386US | high8.1 | — | ||
In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is… | ||||
| CVE-2026-105745US | high7.8 | — | ||
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factories i… | ||||
| CVE-2026-41254US | high7.5 | — | ||
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication. | ||||
| CVE-2026-35640US | high7.5 | — | ||
OpenClaw before 2026.3.25 parses JSON request bodies before validating webhook signatures, allowing unauthenticated attackers to force resource-intensive parsing operations. Remote… | ||||
| CVE-2025-48965US | high7.5 | — | ||
Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero. | ||||
| CVE-2023-33224US | high7.2 | — | ||
The SolarWinds Platform was susceptible to the Incorrect Behavior Order Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execu… | ||||
| CVE-2024-24699US | medium6.5 | — | ||
Business logic error in some Zoom clients may allow an authenticated user to conduct information disclosure via network access.
| ||||
| CVE-2026-44919US | medium6.5 | — | ||
In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL. | ||||
| CVE-2025-0150US | medium6.5 | — | ||
Incorrect behavior order in some Zoom Workplace Apps for iOS before version 6.3.0 may allow an authenticated user to conduct a denial of service via network access. | ||||
| CVE-2026-114104US | medium5.9 | — | ||
adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names… | ||||
| CVE-2021-29446US | medium5.9 | — | ||
jose-node-cjs-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS38… | ||||
| CVE-2021-29445US | medium5.9 | — | ||
jose-node-esm-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS38… | ||||
| CVE-2021-29443US | medium5.9 | — | ||
jose is an npm library providing a number of cryptographic operations. In vulnerable versions AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption w… | ||||
| CVE-2026-40223US | medium5.5 | — | ||
In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running. | ||||
04
Angriffsmuster (1)
CAPEC-Angriffsmuster, die dies ausnutzen.
05
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan