Weakness (CWE)
CWE-420: Unprotected Alternate Channel
The product protects a primary channel, but it does not use the same level of protection for an alternate channel.
How to prevent it (1 mitigation)
-
Architecture and Design
Identify all alternate channels and use the same protection mechanisms that are used for the primary channels.
Source: MITRE CWE-420
41 results · Feed
-
Critical 9.0
Windows Schannel Spoofing Vulnerability
No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.
-
Medium 5.4
Kiteworks Core Unprotected Alternate Channel
Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on which those controls, in…
-
Low 3.5
An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated …
-
Medium 5.3
Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-str…
-
Medium 5.3
BIG-IP httpd access control vulnerability
When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
-
Medium 6.5
An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. B…
-
High 8.8
LiteLLM has a sandbox escape in custom-code guardrail
LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.
-
Low 2.5
OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.
-
Medium 4.3CVE-2026-25916 Public exploit
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.
-
High 7.8
Beckhoff: Performing privileged operations and gaining administrator access
A local low privileged attacker can bypass the authentication of the Device Manager user interface, allowing them to perform privileged operations and gain administrator access.
-
High 7.5CVE-2025-67303 Public exploit
ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)
An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the application storing its files in an insufficiently protected location that was accessible via the web…
-
High 8.8
BullWall Ransomware Containment hard-coded folder exclusions
BullWall Ransomware Containment supports configurable file and directory exclusions such as '$RECYCLE.BIN' to balance monitoring scope and performance. Certain exclusion patterns could allow an authenticated attacker to rename directories in a way that avoids…
-
Medium 5.0
In Oxide control plane 15 through 17 before 17.1, API tokens can be renewed past their expiration date.
-
Critical 9.3
Unauthenticated log access in Twonky Server
Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password.
-
Low 3.0
The Dyson MQTT server (2022 and possibly later) allows publications and subscriptions by a client that has the correct …
-
Medium 4.9
Slack Nebula may accept arbitrary source IP addresses
Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.
-
High 8.0
Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system…
-
High 8.8
An internal product security audit of Lenovo XClarity Orchestrator (LXCO) discovered the below vulnerability: An attack…
-
High 7.4
The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. Entrie…
-
High 8.9
In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).
-
Critical 9.0
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation an…
KEV Jul 22, 2025 -
Critical 9.9
In Innoshop through 0.4.1, an authenticated attacker could exploit the File Manager functions in the admin panel to ach…
-
Low 2.7
xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (F…
-
High 8.8
IBM Personal Communications command execution
IBM Personal Communications v14 and v15 include a Windows service that is vulnerable to local privilege escalation (LPE). The vulnerability allows any interactively logged in users on the target computer to run commands with full privileges in the context of …
-
Medium 4.7
Unprotected alternative channel of return branch target prediction in some Intel(R) Processors may allow an authorized …
-
Medium 6.4
A connection hijacking vulnerability exists in some Huawei home routers. Successful exploitation of this vulnerability …
-
High 7.5
Some Huawei home routers have a connection hijacking vulnerability. Successful exploitation of this vulnerability may c…
-
Critical 10.0CVE-2024-10081 EPSS 40%
codechecker vulnerable to authentication bypass when using specifically crafted URLs
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than …
-
High 7.9
Vulnerable juju introspection abstract UNIX domain socket
Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network namespace users. This enables denial of service attacks.
-
High 7.3CVE-2024-6242 EPSS 11%
Rockwell Automation Chassis Restrictions Bypass Vulnerability in Select Logix Devices
A vulnerability exists in Rockwell Automation affected products that allows a threat actor to bypass the Trusted® Slot feature in a ControlLogix® controller. If exploited on any affected module in a 1756 chassis, a threat actor could potentially execute CIP c…
-
Medium 5.3
LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Unauthenticated Bypass to User Registration
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthenticated bypass to user registration in versions up to, and including, 4.2.6.8.1. This is due to missing checks in the 'check_validate_fields' function in the checkout. This ma…
-
Medium 5.3
LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Bypass to User Registration
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 4.2.6.5. This is due to missing checks in the 'create_account' function in the checkout. This makes it possible for unaut…
-
Critical 10.0
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IO…
KEV Oct 16, 2023 -
High 8.8
Improper Restriction in NI MeasurementLink Python Services
An improper access restriction in NI MeasurementLink Python services could allow an attacker on an adjacent network to reach services exposed on localhost. These services were previously thought to be unreachable outside of the node. This affects measurement …
-
Low 3.5
Issues notification metadata lacks authorization
A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not see, they could query Foundry's Notification API and receive metadata about the issue including the R…
-
High 8.6
Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and claim devices outright.
-
Medium 4.9
GateManager debug interface is included in non-debug builds
Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information.
-
High 7.5
moby/moby's dockerd daemon encrypted overlay network may be unauthenticated
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby, is commonly …
-
Medium 6.8
moby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticated
Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly …
-
Medium 4.9
GateManager debug interface is included in production builds
Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information. This issue affects: GateManager all versions prior to 9.7.