Skip to content
OpenAdvisories

Weakness (CWE)

CWE-300: Channel Accessible by Non-Endpoint

Class Draft Mapping discouraged

The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.

How to prevent it (3 mitigations)

  1. Implementation

    In order to establish secure communication between two parties, it is often important to adequately verify the identity of entities at each end of the communication channel. Always fully authenticate both ends of any communications channel.

  2. Architecture and Design

    Adhere to the principle of complete mediation.

  3. Implementation

    A certificate binds an identity to a cryptographic key to authenticate a communicating party. Often, the certificate takes the encrypted form of the hash of the identity of the subject, the public key, and information such as time of issue or expiration using the issuer's private key. The certificate can be validated by deciphering the certificate with the issuer's public key. See also X.509 certificate signature chains and the PGP certification structure.

Source: MITRE CWE-300

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-84197

    In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from…

    Eclipse Foundation Eclipse Ditto
  • Critical 9.8
    CVE-2026-74232 Exploited

    Zbtlink MQWrt yunmgrd Cloud C2 Implant

    Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmwar…

    Zbtlink MoreQuick WE826-T2 MQAC-7620A
  • Critical 9.3
    CVE-2025-54792

    LocalSend is Vulnerable to Man-in-the-Middle Attacks, Leading to File Interception

    LocalSend is an open-source app to securely share files and messages with nearby devices over local networks without needing an internet connection. In versions 1.16.1 and below, a critical Man-in-the-Middle (MitM) vulnerability in the software's discovery pr…

    localsend localsend
  • Critical 9.8
    CVE-2024-39705

    ntlk unsafe deserialization vulnerability

    NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.

    nltk nltk nltk py3.12-nltk Debian Ubuntu Wolfi PyPI
  • Critical 9.8
    CVE-2009-3555 Public exploit EPSS 87%

    Apache Tomcat affected by vulnerability in TLS and SSL protocol

    The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Serv…

    openssl apache2 org.apache.tomcat:tomcat nss Debian Maven