CWE-440 Expected Behavior Violation
baseA feature, API, or function does not perform according to its specification.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (101)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2006-5276US | high10.0 | Exploit | ||
Stack-based buffer overflow in the DCE/RPC preprocessor in Snort before 2.6.1.3, and 2.7 before beta 2; and Sourcefire Intrusion Sensor; allows remote attackers to execute arbitrar… | ||||
| CVE-2005-0045US | high7.5 | Exploit | ||
The Server Message Block (SMB) implementation for Windows NT 4.0, 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute… | ||||
| CVE-2004-0900US | high10.0 | — | ||
The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition does not properly validate the length of certain messages, which allows remote attackers to… | ||||
| CVE-2017-5651US | critical9.8 | — | ||
In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing… | ||||
| CVE-2007-2419US | high10.0 | — | ||
Multiple buffer overflows in an ActiveX control (boisweb.dll) in Macrovision FLEXnet Connect 6.0 and Update Service 3.x to 5.x allow remote attackers to execute arbitrary code via… | ||||
| CVE-2007-2564US | high10.0 | — | ||
Multiple stack-based buffer overflows in the Sienzo Digital Music Mentor (DMM) 2.6.0.4 ActiveX control (DSKernel2.dll) allow remote attackers to execute arbitrary code via a long a… | ||||
| CVE-2022-32221US | critical9.8 | — | ||
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been s… | ||||
| CVE-2003-0842US | high7.5 | Exploit | ||
Stack-based buffer overflow in mod_gzip_printf for mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode, allows remote attackers to exec… | ||||
| CVE-2021-41035US | critical9.8 | — | ||
In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods. | ||||
| CVE-2005-0263US | high7.2 | Exploit | ||
Buffer overflow in netpmon on AIX 5.1, 5.2, and 5.3 allows local users to execute arbitrary code via a long -O argument. | ||||
| CVE-2003-1050US | high7.2 | Exploit | ||
Multiple buffer overflows in IBM DB2 Universal Database 8.1 may allow local users to execute arbitrary code via long command line arguments to (1) db2start, (2) db2stop, or (3) db2… | ||||
| CVE-2005-2118US | medium5.1 | — | ||
Windows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote user-assisted attackers to execute arbitrary commands via a crafted shortcut (.lnk) file… | ||||
| CVE-2021-37915US | high8.8 | — | ||
An issue was discovered on the Grandstream HT801 Analog Telephone Adaptor before 1.0.29.8. From the limited configuration shell, it is possible to set the malicious gdb_debug_serve… | ||||
| CVE-2019-6569US | critical9.1 | — | ||
The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into the mirrored network. An attacker could use this behavior to… | ||||
| CVE-2026-93675US | critical9.8 | — | ||
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion. | ||||
| CVE-2025-8850US | high8.8 | — | ||
In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA) flow. The system allows users to disable 2FA without requiring a… | ||||
| CVE-2021-42114US | high8.3 | — | ||
Modern DRAM devices (PC-DDR4, LPDDR4X) are affected by a vulnerability in their internal Target Row Refresh (TRR) mitigation against Rowhammer attacks. Novel non-uniform Rowhammer… | ||||
| CVE-2026-97687US | high8.1 | — | ||
urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode,… | ||||
| CVE-2024-8535US | high8.1 | — | ||
Authenticated user can access unintended user capabilities in NetScaler ADC and NetScaler Gateway if the appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Pr… | ||||
| CVE-2023-5332US | high8.1 | — | ||
Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be b… | ||||
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan