CWE-691 Insufficient Control Flow Management
pillarThe code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.
01
child weaknesses
More specific entries beneath this one.
02
vulnerabilities (157)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-20559US | high8.8 | — | ||
Insufficient control flow management in AmdCpmGpioInitSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to escalation of privileges.
| ||||
| CVE-2026-20276US | high8.6 | — | ||
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review.… | ||||
| CVE-2022-20697US | high8.6 | — | ||
A vulnerability in the web services interface of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condi… | ||||
| CVE-2024-37158US | high8.1 | — | ||
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. Preliminary checks on actions computed by the clawback vesting accounts are performed in the ante handler. Ev… | ||||
| CVE-2016-2200US | high7.5 | — | ||
Siemens SIMATIC S7-1500 CPU devices before 1.8.3 allow remote attackers to cause a denial of service (STOP mode transition) via crafted packets on TCP port 102. | ||||
| CVE-2024-29079US | high7.8 | — | ||
Insufficient control flow management in some Intel(R) VROC software before version 8.6.0.3001 may allow an authenticated user to potentially enable escalation of privilege via loca… | ||||
| CVE-2022-48481US | high7.8 | — | ||
In JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possible | ||||
| CVE-2022-46828US | high7.8 | — | ||
In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible. | ||||
| CVE-2021-33122US | high7.8 | — | ||
Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via local access. | ||||
| CVE-2021-4106US | high7.8 | — | ||
A vulnerability in Snow Inventory Java Scanner allows an attacker to run malicious code at a higher level of privileges. This issue affects: SNOW Snow Inventory Java Scanner 1.0 | ||||
| CVE-2026-76469US | high7.4 | — | ||
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This… | ||||
| CVE-2021-0157US | medium6.7 | — | ||
Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. | ||||
| CVE-2016-8354US | high7.0 | — | ||
An issue was discovered in Schneider Electric Unity PRO prior to V11.1. Unity projects can be compiled as x86 instructions and loaded onto the PLC Simulator delivered with Unity PR… | ||||
| CVE-2020-12359US | medium6.8 | — | ||
Insufficient control flow management in the firmware for some Intel(R) Processors may allow an unauthenticated user to potentially enable escalation of privilege via physical acces… | ||||
| CVE-2024-37159US | medium6.5 | — | ||
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. This vulnerability allowed a user to create a validator using vested tokens to deposit the self-bond. This vu… | ||||
| CVE-2023-43588US | medium6.5 | — | ||
Insufficient control flow management in some Zoom clients may allow an authenticated user to conduct an information disclosure via network access. | ||||
| CVE-2024-3847US | medium6.1 | — | ||
Insufficient policy enforcement in WebUI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium secu… | ||||
| CVE-2022-2841US | low2.7OT elevated | Exploit | ||
A vulnerability was found in CrowdStrike Falcon 6.31.14505.0/6.42.15610/6.44.15806. It has been classified as problematic. Affected is an unknown function of the component Uninstal… | ||||
| CVE-2026-23104US | medium5.5 | — | ||
In the Linux kernel, the following vulnerability has been resolved:
ice: fix devlink reload call trace
Commit 4da71a77fc3b ("ice: read internal temperature sensor") introduced
in… | ||||
| CVE-2023-53618US | medium5.5 | — | ||
In the Linux kernel, the following vulnerability has been resolved:
btrfs: reject invalid reloc tree root keys with stack dump
[BUG]
Syzbot reported a crash that an ASSERT() got… | ||||
03
attack patterns (1)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan