CWE-394 Unexpected Status Code or Return Value
baseThe product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (19)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-25085US | critical9.8 | — | ||
A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in
which an unexpected return value from the authentication routine is
later on processed as a legitimate va… | ||||
| CVE-2025-12516US | critical9.8 | — | ||
Lack of Graceful Error Handling - HTTP 5xx ErrorThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . | ||||
| CVE-2025-12515US | critical9.8 | — | ||
Systemic Internal Server Errors - HTTP 500 ResponseThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . | ||||
| CVE-2026-76956US | high7.5 | — | ||
In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, c… | ||||
| CVE-2023-25948US | high7.5 | — | ||
Server information leak of configuration data when an error is generated in response to a specially crafted message. See Honeywell Security Notification for recommendations on upgr… | ||||
| CVE-2019-0066US | high7.5 | — | ||
An unexpected status return value weakness in the Next-Generation Multicast VPN (NG-mVPN) service of Juniper Networks Junos OS allows attacker to cause a Denial of Service (DoS) co… | ||||
| CVE-2024-1713US | high7.2 | — | ||
A user who can create objects in a database with plv8 3.2.1 installed is able to cause deferred triggers to execute as the Superuser during autovacuum.
| ||||
| CVE-2018-20802US | medium6.5 | — | ||
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affecting QueryPlanner. This issue affects Mo… | ||||
| CVE-2019-20924US | medium6.5 | — | ||
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries which trigger an invariant in the IndexBoundsBuilder. This issue af… | ||||
| CVE-2025-39676US | medium5.5 | — | ||
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla4xxx: Prevent a potential error pointer dereference
The qla4xxx_get_ep_fwdb() function is supposed to… | ||||
| CVE-2024-26584US | medium5.5 | — | ||
In the Linux kernel, the following vulnerability has been resolved:
net: tls: handle backlogging of crypto requests
Since we're setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our… | ||||
| CVE-2022-24880US | medium5.3 | — | ||
flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.vali… | ||||
| CVE-2026-107785US | — | — | ||
Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key. When a peering session negotiates use of SHA-512, the key produced is 64 bytes i… | ||||
| CVE-2026-73064US | — | — | ||
In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only a… | ||||
| CVE-2025-48510US | — | — | ||
Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availability. | ||||
| CVE-2025-22854US | — | — | ||
Improper handling of non-200 http responses in the PingFederate Google Adapter leads to thread exhaustion under normal usage conditions. | ||||
| CVE-2025-23013US | — | — | ||
In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be deployed to support auth… | ||||
| CVE-2023-48429US | — | — | ||
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The Web UI of affected devices does not check the length of parameters in certain conditions. T… | ||||
| CVE-2023-28975US | — | — | ||
An Unexpected Status Code or Return Value vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated attacker with physical access to the device to cause a… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan