Weakness (CWE)
CWE-358: Improperly Implemented Security Check for Standard
The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.
Source: MITRE CWE-358
129 results · Feed
-
Critical 9.1
Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.
-
Medium 4.3
BullWall Ransomware Containment file count detection bypass
BullWall Ransomware Containment considers the number of files modified to trigger detection. An authenticated attacker could encrypt a single (possibly large) file without triggering detection if thresholds are configured to require multiple file changes. The…
-
Medium 5.3
Vulnerability of improper criterion security check in the card module. Impact: Successful exploitation of this vulnerab…
-
High 7.3
Vulnerability of improper criterion security check in the call module. Impact: Successful exploitation of this vulnerab…
-
High 7.5
Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a du…
-
Critical 9.8
Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.
-
Medium 4.8
An Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 t…
-
Medium 4.0
HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP)
HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP). These can result in malicious resources getting loaded and browsers may come across certain types of attacks, such as cross-site scripting and clickjacking.
-
High 7.5
Suricata is Vulnerable to Detection Bypass via Crafted Multiple SYN Packets
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 7.0.11 and below, as well as 8.0.0, are vulnerable to detection bypass when crafted traffic sends multiple SYN pack…
-
Medium 4.3
Bluetooth: Out-Of-Context le_conn_rsp Handling
The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a connection request. Instead, it relies solely on identifier matching.
-
Medium 5.1
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. USB Restricted M…
-
High 7.2
Improperly implemented security check for standard in the DDRIO configuration for some Intel(R) Xeon(R) 6 Processors wh…
-
Low 3.1
Comodo Dragon HSTS security check
A vulnerability classified as problematic was found in Comodo Dragon up to 134.0.6998.179. Affected by this vulnerability is an unknown functionality of the component HSTS Handler. The manipulation leads to security check for standard. The attack can be launc…
-
Medium 4.9
An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 a…
-
Low 3.7
SpiceDB checks involving relations with caveats can result in no permission when permission is expected
SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation…
-
High 8.8
Inappropriate implementation in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform…
-
Medium 6.4
A stack-based buffer overflow vulnerability (CWE-121) in the profile parser of FortiSandbox version 3.2.2 and below, ve…
-
Medium 4.7
FortiOS 6.2 running AV engine version 6.00142 and below, FortiOS 6.4 running AV engine version 6.00144 and below and Fo…
-
Medium 4.4
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Microsoft Edge (Chromium-based) Spoofing Vulnerability
-
Low 2.3
Client Secret not checked with OAuth Password grant type
The Client secret is not checked when using the OAuth Password grant type. By exploiting this vulnerability, an attacker could connect to a web server using a client application not explicitly authorized as part of the OAuth deployment. Exploitation requires …
-
Low 3.6
An improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability [CW…
-
High 7.8
In wifi_item_edit_content of styles.xml , there is a possible FRP bypass due to Missing check for FRP state. This could…
-
Low 3.4
An improperly implemented security check for standard vulnerability [CWE-358] in FortiADC Web Application Firewall (WAF…
-
High 8.8
Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exp…
KEV Aug 28, 2024 -
Medium 4.2
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected …
-
Medium 4.3
Inappropriate implementation in FedCM in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a…
-
High 8.8
Inappropriate implementation in Fullscreen in Google Chrome on Android prior to 127.0.6533.72 allowed a remote attacker…
-
Medium 6.5
Inappropriate implementation in Sign-In in Google Chrome prior to 1.3.36.351 allowed a remote attacker to bypass naviga…
-
High 8.8
Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to perform out of…
-
High 8.8
Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to perform out of…
-
High 8.1
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5. An app may be able to execute a…
-
High 7.2
A vulnerability exists in the RTU500 that allows for authenticated and authorized users to bypass secure update, if sec…
-
Critical 9.8
Inappropriate implementation in Networks in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass mi…
-
Medium 4.3
Inappropriate implementation in Extensions in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform…
-
Medium 4.3
Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed an attacker who convinced a us…
-
High 7.8
An issue in Weave Weave Desktop v.7.78.10 allows a local attacker to execute arbitrary code via a crafted script to the…
-
Medium 6.3
An authentication bypass vulnerability was reported in Lenovo devices with Synaptics fingerprint readers that could all…
-
High 8.4
RPyC's missing security check results in code execution when using numpy.array on the server-side.
In RPyC before 6.0.0, when a server exposes a method that calls the attribute named __array__ for a client-provided netref (e.g., np.array(client_netref)), a remote attacker can craft a class that results in remote code execution.
-
High 8.8CVE-2024-2174 EPSS 13%
Inappropriate implementation in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially ex…
-
Low 3.5
Keycloak: client access via device auth request spoof
Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAut…