Weakness (CWE)
CWE-636: Not Failing Securely
When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
How to prevent it (1 mitigation)
-
Architecture and Design
Subdivide and allocate resources and components so that a failure in one part does not affect the entire product.
Source: MITRE CWE-636
33 results · Clear filters · Feed
-
Medium 6.8
.NET Security Feature Bypass Vulnerability
Not failing securely ('failing open') in .NET allows an unauthorized attacker to bypass a security feature over a network.
-
Medium 6.9
Sandboxie-Plus: Sandbox containment bypass
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.18.6, a process inside a sandbox could send MSGID_FILE_SET_ATTRIBUTES or MSGID_FILE_SET_SHORT_NAME to SbieSvc and cause the SYSTEM service to open and modify an existing…
-
Medium 5.8
Not Failing Securely ('Failing Open') in hMailServer
Not failing securely in the anti-virus attachment-stripping action of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have a message that the server's virus scanner found infected delivered to the recipient's mail…
-
Medium 6.5
Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up
Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. T…
-
Medium 5.9
hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25
Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any other repository or API server to programs that use hex_core's default HTTP adapter on Erlang/OTP …
-
Medium 6.8
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Not Failing Securely ('Faili…
-
Medium 5.4
SumatraPDF: `sumatrapdfrestrict.ini` never revokes any permission (fail-open policy initialization)
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, InitializePolicies() starts the sumatrapdfrestrict.ini path with gPolicyRestrictions set to Perm::All and only ORs permission bits, so the INI file never revokes permissions. Deploying Sum…
-
Medium 5.9
Fail-open response masking in Docker Sandboxes can expose proxy-managed credentials
Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-body read returned data together with an error, affected handlers could forward unmasked bytes. Code inside an authorized sandbox could use this to recove…
-
Medium 5.9
pgjdbc does not enforce requireAuth when the value excludes every authentication method
pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!no…
-
Medium 5.5
heym before 0.0.105 Authentication Bypass via Redis Node
heym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node (backend/app/services/node_execution/nodes/redis_node.py). When _get_accessible_credential returns None — because the credential ID does not exist…
-
Medium 5.3
TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check
TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing authenticated users to access deleted form submissions. Attackers can read orphaned submission data incl…
-
Medium 5.3
Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.
-
Medium 5.9
Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer
Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed production site whenever PHP remains available b…
-
Medium 4.3
APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guard
APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when permission lookups throw exceptions. Attackers with valid Fusion API tokens can write attachments to p…
-
Medium 6.1
IGEL OS 12 / 11 Secure Boot Bypass via Unsigned igel.conf File
IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the GRUB boot stage that allows physically present attackers to gain unauthorized root access by placing an unsigned empty file named igel.conf …
-
Medium —
AIIR verification and policy gates could report success without enforcing the control (fail-open)
### Summary Several of AIIR's verification and policy paths could return a success/"verified" result without actually enforcing the control they represent — they could **fail open** rather than fail closed. For a tool whose purpose is trustworthy verification…
-
Medium 5.3
MyBB: Security Question insufficient validation
### Impact The registration component does not validate the text-based _Security Question_ CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value. [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N](https://www.first.org/cvss/c…
-
Medium 6.6
nono-cli'scregistry pack verification can fail open when provenance metadata is absent
## Summary Registry-installed nono packs are expected to be verified from local provenance metadata before they are used. Two files are relevant: - `~/.config/nono/packages/lockfile.json` - `~/.config/nono/packages/<namespace>/<pack>/.nono-trust.bundle` Testi…
-
Medium 6.3
Grav Flex-Objects < 1.4.3 Authorization Bypass via API
Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers …
-
Medium 5.9
Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails
Traefik is an HTTP reverse proxy and load balancer. From 3.7.0-ea.1 until 3.7.5, there is a medium severity vulnerability in Traefik's Kubernetes Ingress NGINX provider that causes affected routes to fail open. When an Ingress explicitly enables BasicAuth or …
-
Medium 5.9
Guzzle: Silent HTTPS-Proxy Downgrade to Cleartext
Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, in certain configurations, traffic expected to be protected by TLS on the hop to the proxy is transmitted in cleartext. Proxy authentication credentials (the Proxy-Authorization header, proxy userinfo …
-
Medium 5.4
OpenClaw < 2026.4.25 - Scope Bypass via Empty-Scope Device Re-pairing
OpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing that allows authenticated operators to restore broader scopes than intended by submitting empty-scope re-pairing requests. Attackers can exploit this by sending r…
-
Medium 4.6
OpenClaw < 2026.3.31 - Fail-Open Security Scan Bypass in Plugin Installation
OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation. Attackers can exploit scan failures to install untrusted plugins when operators proceed despite visible scan w…
-
Medium 6.5
OpenClaw < 2026.3.31 - Decompression Bomb Denial of Service via Image Pixel-Limit Guard Bypass
OpenClaw before 2026.3.31 contains a decompression bomb vulnerability in image processing that fails to properly enforce pixel-limit guards on sips. Attackers can exploit this by uploading oversized images to cause denial of service through excessive memory c…
-
Medium 6.9
free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors
free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the PUT handler for updating Policy Data notification subscriptions at /nudr-dr/v2/policy-data/subs-to-notify/{subsId} does not return after reque…
-
Medium 4.9
Pass filter with Empty Table
An administrator may attempt to block all traffic by configuring a pass filter with an empty table. However, in UBR, an empty list does not enforce any restrictions and allows all network traffic to pass unfiltered.
-
Medium 4.9
Use of wildcard (“*” or “all”) in Block list
An administrator may attempt to block all networks by specifying "\*" or "all" as the network identifier. However, these values are not supported and do not trigger any validation error. Instead, they are silently interpreted as network 0 which results in no …
-
Medium 4.2
Windows BitLocker Information Disclosure Vulnerability
Windows BitLocker Information Disclosure Vulnerability
-
Medium 6.4
Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses
Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16…
-
Medium 6.8
moby/moby's dockerd daemon encrypted overlay network traffic may be unencrypted
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly r…
-
Medium 6.8
moby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticated
Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly …
-
Medium 4.8
Modular Input REST API Requests Connect via HTTP after Certificate Validation Failure in Splunk Add-on Builder and Splunk CloudConnect SDK
In Splunk Add-on Builder (AoB) versions below 4.1.2 and the Splunk CloudConnect SDK versions below 3.1.3, requests to third-party APIs through the REST API Modular Input incorrectly revert to using HTTP to connect after a failure to connect over HTTPS occurs.
-
Medium 6.4
A vulnerability was reported on some Lenovo Notebook systems that could allow an attacker with physical access to eleva…