Weakness (CWE)
CWE-424: Improper Protection of Alternate Path
The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.
How to prevent it (1 mitigation)
-
Architecture and Design
Deploy different layers of protection to implement security in depth.
Source: MITRE CWE-424
5 results · Clear filters · Feed
-
Critical 9.2
Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall
In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The …
-
Critical 9.8
Improper Protection of Alternate Path in Splunk SOAR
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. …
-
Critical 9.0
Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the …
-
Critical 10.0
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers'…
-
Critical 9.0
yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key
Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.
KEV May 2, 2025