Weakness (CWE)
CWE-391: DEPRECATED: Unchecked Error Condition
This entry has been deprecated because it used
ambiguous terminology and incorporated and confused multiple
weaknesses. See Mapping Notes for other recommendations, and
see Maintenance Notes for more detailed
explanations.
Source: MITRE CWE-391
28 results · Feed
-
Unscored —
AvastSvc denial of service via unhandled JsonCpp exceptions in native message handlers
Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged attacker to crash the service by sending specially crafted JSON messages. The vulnerability spans multiple handler pathways in the RPC-based …
-
Medium 6.5
HCL BigFix AEX is affected by multiple security vulnerabilities.
HCL BigFix AEX is affected by an Information Disclosure vulnerability due to improper handling of errors or exceptional conditions. This could allow an attacker to obtain sensitive technical information, including stack traces, system details, or internal pat…
-
High 7.1
Zammad: PGP signature spoofing via unvalidated verification return
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or…
-
Critical 9.8
openssl_encrypt before 1.4.0 Weak Shared Secret via PQC Simulation Mode
openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available enca…
-
Critical 9.8
picklescan - Detection Bypass via STACK_GLOBAL Opcode Parsing Logic Flaw
picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling STACK_GLOBAL opcodes, failing to track arguments in the correct range and allowing malicious pickle files to bypass detection. Attackers can craft pickle files…
-
Critical 9.8CVE-2024-52316 Public exploit
Apache Tomcat: Authentication bypass when using Jakarta Authentication API
Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an…
-
Medium 6.1
Cisco IOS XR Software Broadband Network Gateway PPPoE Denial of Service Vulnerability
A vulnerability in the Broadband Network Gateway PPP over Ethernet (PPPoE) feature of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause the PPPoE process to continually crash. This vulnerability exists because the PPPoE fea…
-
Medium 5.9
Envoy incorrectly accepts HTTP 200 response for entering upgrade mode
Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rfc/rfc7230#section-6.…
-
Medium 5.3
In DA, there is a possible permission bypass due to an incorrect status check. This could lead to local escalation of p…
-
Medium 5.3
Unchecked Error Condition in froxlor/froxlor
Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10.
-
Medium 6.5
Junos OS: MX Series: The bbe-smgd process crashes if an unsupported configuration exists and a PPPoE client sends a specific message
An Unchecked Error Condition vulnerability in the subscriber management daemon (smgd) of Juniper Networks Junos OS allows an unauthenticated adjacent attacker to cause a crash of and thereby a Denial of Service (DoS). In a subscriber management / broadband ed…
-
Unscored —
A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC …
-
Low 3.7
ecdsa Denial of Service vulnerability in signature verification and signature malleability
An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions (or no exceptions at all), which could lead to a denial of service.
-
Medium —
grunt-gh-pages before 0.10.0 may allow unencrypted GitHub credentials to be written to a log file
A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions < 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging …
-
Unscored —
In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kerne…
-
Unscored —
xorg-x11-server before 1.19.5 was missing extra length validation in ProcEstablishConnection function allowing maliciou…
-
Unscored —
xorg-x11-server before 1.19.5 was missing length validation in XFree86 VidModeExtension allowing malicious X client to …
-
Unscored —
xorg-x11-server before 1.19.5 was missing length validation in X-Resource extension allowing malicious X client to caus…
-
Unscored —
xorg-x11-server before 1.19.5 had wrong extra length check in ProcXIChangeHierarchy function allowing malicious X clien…
-
Unscored —
xorg-x11-server before 1.19.5 was missing length validation in XFree86 DRI extension allowing malicious X client to cau…
-
Unscored —
xorg-x11-server before 1.19.5 was vulnerable to integer overflow in (S)ProcXIBarrierReleasePointer functions allowing m…
-
Unscored —
xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X …
-
Unscored —
xorg-x11-server before 1.19.5 was missing length validation in XFree86 DGA extension allowing malicious X client to cau…
-
Unscored —
xorg-x11-server before 1.19.5 was missing length validation in XINERAMA extension allowing malicious X client to cause …
-
Unscored —
xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X …
-
Unscored —
xorg-x11-server before 1.19.5 was vulnerable to integer overflow in ProcDbeGetVisualInfo function allowing malicious X …
-
Unscored —
xorg-x11-server before 1.19.5 was missing length validation in MIT-SCREEN-SAVER extension allowing malicious X client t…
-
Unscored —
fedora-arm-installer up to and including 1.99.16 is vulnerable to local privilege escalation due to lack of checking th…