Weakness (CWE)
CWE-420: Unprotected Alternate Channel
The product protects a primary channel, but it does not use the same level of protection for an alternate channel.
How to prevent it (1 mitigation)
-
Architecture and Design
Identify all alternate channels and use the same protection mechanisms that are used for the primary channels.
Source: MITRE CWE-420
6 results · Clear filters · Feed
-
Critical 9.0
Windows Schannel Spoofing Vulnerability
No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.
-
Critical 9.3
Unauthenticated log access in Twonky Server
Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password.
-
Critical 9.0
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation an…
KEV Jul 22, 2025 -
Critical 9.9
In Innoshop through 0.4.1, an authenticated attacker could exploit the File Manager functions in the admin panel to ach…
-
Critical 10.0
codechecker vulnerable to authentication bypass when using specifically crafted URLs
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than …
-
Critical 10.0
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IO…
KEV Oct 16, 2023