CWE-420 Unprotected Alternate Channel
baseThe product protects a primary channel, but it does not use the same level of protection for an alternate channel.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (46)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-54309US | critical9.8OT critical | KEV | ||
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access… | ||||
| CVE-2023-20198US | critical10.0OT critical | KEV | ||
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and… | ||||
| CVE-2025-13315US | critical9.8 | Exploit | ||
Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file… | ||||
| CVE-2024-10081US | critical10.0OT high | — | ||
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.
Authentication bypass occurs when the API URL ends with Auth… | ||||
| CVE-2020-8558US | high8.8 | Exploit | ||
The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP an… | ||||
| CVE-2025-54351US | critical10.0 | — | ||
In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv). | ||||
| CVE-2023-31241US | critical10.0 | — | ||
Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and claim devices outright. | ||||
| CVE-2026-105008US | critical9.0 | — | ||
No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2023-28840US | high8.7 | — | ||
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The M… | ||||
| CVE-2023-4570US | high8.8 | — | ||
An improper access restriction in NI MeasurementLink Python services could allow an attacker on an adjacent network to reach services exposed on localhost. These services were pre… | ||||
| CVE-2023-52718US | high8.1 | — | ||
A connection hijacking vulnerability exists in some Huawei home routers. Successful exploitation of this vulnerability may cause DoS or information leakage.(Vulnerability ID:HWPSIR… | ||||
| CVE-2023-7266US | high8.1 | — | ||
Some Huawei home routers have a connection hijacking vulnerability. Successful exploitation of this vulnerability may cause DoS or information leakage.(Vulnerability ID:HWPSIRT-202… | ||||
| CVE-2025-1095US | high7.8 | — | ||
IBM Personal Communications v14 and v15 include a Windows service that is vulnerable to local privilege escalation (LPE). The vulnerability allows any interactively logged in users… | ||||
| CVE-2023-28842US | medium6.8 | — | ||
Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The… | ||||
| CVE-2024-4444US | medium6.5OT elevated | — | ||
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 4.2.6.5. This is due to missing checks in… | ||||
| CVE-2026-23311US | medium5.5 | — | ||
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Fix invalid wait context in ctx_sched_in()
Lockdep found a bug in the event scheduling when a pinne… | ||||
| CVE-2024-8038US | medium5.5 | — | ||
Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network names… | ||||
| CVE-2024-6099US | medium5.3 | — | ||
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthenticated bypass to user registration in versions up to, and including, 4.2.6.8.1. This is due to… | ||||
| CVE-2023-0317US | medium4.9 | — | ||
Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information. | ||||
| CVE-2022-25786US | medium4.9 | — | ||
Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information. This issue affects: GateManager all version… | ||||
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan