Weakness (CWE)
CWE-420: Unprotected Alternate Channel
Base Draft
The product protects a primary channel, but it does not use the same level of protection for an alternate channel.
How to prevent it (1 mitigation)
-
Architecture and Design
Identify all alternate channels and use the same protection mechanisms that are used for the primary channels.
Source: MITRE CWE-420
5 results · Clear filters · Feed
-
Low 3.5
An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated …
-
Low 2.5
OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.
-
Low 3.0
The Dyson MQTT server (2022 and possibly later) allows publications and subscriptions by a client that has the correct …
-
Low 2.7
xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (F…
-
Low 3.5
Issues notification metadata lacks authorization
A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not see, they could query Foundry's Notification API and receive metadata about the issue including the R…