CWE-642 External Control of Critical State Data
classThe product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (29)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-0575US | critical9.8 | — | ||
External Control of Critical State Data, Improper Control of Generation of Code ('Code Injection') vulnerability in YugaByte, Inc. Yugabyte DB on Windows, Linux, MacOS, iOS (Devops… | ||||
| CVE-2014-4699US | medium6.9 | Exploit | ||
The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use… | ||||
| CVE-2020-27872US | high8.8 | — | ||
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7450 1.2.0.62_1.0.1 routers. Authentication is not required to e… | ||||
| CVE-2018-15382US | high8.6 | — | ||
A vulnerability in Cisco HyperFlex Software could allow an unauthenticated, remote attacker to generate valid, signed session tokens. The vulnerability is due to a static signing k… | ||||
| CVE-2024-8754US | high8.1 | — | ||
An issue has been discovered in GitLab EE/CE affecting all versions from 16.9.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2. An improper input validation error… | ||||
| CVE-2019-9496US | high7.5 | — | ||
An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP… | ||||
| CVE-2023-29403US | high7.8 | — | ||
On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory… | ||||
| CVE-2018-4180US | high7.8 | — | ||
In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions. | ||||
| CVE-2022-22154US | medium6.8 | — | ||
In a Junos Fusion scenario an External Control of Critical State Data vulnerability in the Satellite Device (SD) control state machine of Juniper Networks Junos OS allows an attack… | ||||
| CVE-2020-26186US | medium6.8 | — | ||
Dell Inspiron 5675 BIOS versions prior to 1.4.1 contain a UEFI BIOS RuntimeServices overwrite vulnerability. A local attacker with access to system memory may exploit this vulnerab… | ||||
| CVE-2026-35659US | medium6.3OT elevated | — | ||
OpenClaw before 2026.3.22 contains a service discovery vulnerability where TXT metadata from Bonjour and DNS-SD could influence CLI routing even when actual service resolution fail… | ||||
| CVE-2017-0928US | medium6.1 | — | ||
html-janitor node module suffers from an External Control of Critical State Data vulnerability via user-control of the '_sanitized' variable causing sanitization to be bypassed. | ||||
| CVE-2025-54566US | medium5.4 | — | ||
hw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration state inconsistency, a related issue to CVE-2024-26327. | ||||
| CVE-2020-1976US | medium5.5 | — | ||
A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect software running on Mac OS allows authenticated local users to cause the Mac OS kernel to hang or crash.… | ||||
| CVE-2022-32859US | medium5.3 | — | ||
A logic issue was addressed with improved state management. This issue is fixed in iOS 16. Deleted contacts may still appear in spotlight search results. | ||||
| CVE-2024-58265US | medium4.3 | — | ||
The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message delivery. | ||||
| CVE-2024-6608US | medium4.3 | — | ||
It was possible to move the cursor using pointerlock from an iframe. This allowed moving the cursor outside of the viewport and the Firefox window. This vulnerability affects Firef… | ||||
| CVE-2019-19092US | low3.5OT elevated | — | ||
ABB eSOMS versions 4.0 to 6.0.3 use ASP.NET Viewstate without Message Authentication Code (MAC). Alterations to Viewstate might thus not be noticed. | ||||
| CVE-2015-3631US | low3.6 | — | ||
Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc. | ||||
| CVE-2026-29146US | — | — | ||
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 thr… | ||||
04
attack patterns (2)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan