Weakness (CWE)
CWE-424: Improper Protection of Alternate Path
The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.
How to prevent it (1 mitigation)
-
Architecture and Design
Deploy different layers of protection to implement security in depth.
Source: MITRE CWE-424
52 results · Feed
-
High 7.4
In KioWare for Windows (versions all through 8.34) it is possible to exit this software and use other already opened ap…
-
High 8.4
KioWare for Windows (versions all through 8.34) allows to escape the environment by downloading PDF files, which then b…
-
Medium 6.7
A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, r…
-
Medium 6.7
IBM MQ privilege escalation
IBM MQ Appliance 9.3 CD could allow a local attacker to gain elevated privileges on the system, caused by improper validation of security keys. IBM X-Force ID: 269535.
-
High 7.1
Docker Desktop before 4.23.0 allows Enhanced Container Isolation bypass via debug shell
Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions via the debug shell which remains accessible for a short time window after launching Docker Desktop. The affected functionality is available for…
-
High 7.1
Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation restrictions via the raw Docker socket and launch privileged containers
Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions by setting the Docker host to docker.raw.sock, or npipe:////.pipe/docker_engine_linux on Windows, via the -H (--host) CLI flag or the DOCKER_HOS…
-
Medium 6.8
2.2.4 IMPROPER PROTECTION OF ALTERNATE PATH CWE-424
The tested version of Dominion Voting Systems ImageCast X allows for rebooting into Android Safe Mode, which allows an attacker to directly access the operating system. An attacker could leverage this vulnerability to escalate privileges on a device and/or in…
-
Medium 4.6
Improper access control vulnerability in Contents To Window prior to SMR May-2022 Release 1 allows physical attacker to…
-
Medium 4.2
Improper Protection of Alternate Path vulnerability in Setup wizard process prior to SMR Mar-2022 Release 1 allows phys…
-
Medium 6.5
An improper access control vulnerability was reported in some Motorola-branded Binatone Hubble Cameras which could allo…
-
High 7.1
ABB PB610 HMIStudio accepts malicious DLL file in an application
Path settings in HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier accept DLLs outside of the program directory, potentially allowing an attacker with access to the local file system the execution of code in the application’s c…
-
Medium 4.3
PB610 HMISimulator provides interface with access to arbitrary files
The HMISimulator component of ABB PB610 Panel Builder 600 uses the readFile/writeFile interface to manipulate the work file. Path configuration in PB610 HMISimulator versions 2.8.0.424 and earlier potentially allows access to files outside of the working dire…