Weakness (CWE)
CWE-1068: Inconsistency Between Implementation and Documented Design
The implementation of the product is not consistent with the
design as described within the relevant documentation.
Source: MITRE CWE-1068
6 results · Feed
-
Unscored —
Apache Commons Codec: Blake3 doFinalize is stateless; the documented KDF example derives identical keys
Apache Commons Codec's Blake3 class documented the output of its doFinalize methods as depending on any previously finalized bytes, so that consecutive calls would return different output. In fact, doFinalize does not change the hash state: calling it again w…
-
Medium 5.1
GCM chunking can lead to bad tag exception on decryption
A vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on X86_64, AVX, AVX-512f, Linux, Legion of the Bouncy Castle Inc. BC-FJA bc-fips on Linux, X86_64, AVX, AVX-512f. This vulnerability is associated with program files gcm128w, gcm512w, gc…
-
High 8.1
Wasm exception capture vulnerability in the arkweb v8 module Impact: Successful exploitation of this vulnerability may …
-
High 8.6
Chisel AUTH environment variable not respected in server entrypoint
Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. The Chisel server doesn't ever read the documented `AUTH` environment variable used to set credentials, which allows any unauthenticated user to connect, even if credentials were set. An…
-
Critical 9.8
Inappropriate implementation in Networks in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass mi…
-
Medium 5.3
Inconsistent documentation in Apache Tomcat
As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to 7.0.82 included an updated description of the search algorithm used by the CGI Servlet to identify which script to execu…