Skip to content
OpenAdvisories

Weakness (CWE)

CWE-636: Not Failing Securely

Class Draft

When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Subdivide and allocate resources and components so that a failure in one part does not affect the entire product.

Source: MITRE CWE-636

All Critical High Medium Low Exploited only Public exploit

85 results · Feed

  • Medium 6.8
    CVE-2023-28841

    moby/moby's dockerd daemon encrypted overlay network traffic may be unencrypted

    Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly r…

    moby moby helm-3 ko Debian Ubuntu Alpine Wolfi Go
  • Medium 6.8
    CVE-2023-28842

    moby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticated

    Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly …

    moby moby helm-3 ko Debian Ubuntu Alpine Wolfi Go
  • Medium 4.8
    CVE-2023-22943

    Modular Input REST API Requests Connect via HTTP after Certificate Validation Failure in Splunk Add-on Builder and Splunk CloudConnect SDK

    In Splunk Add-on Builder (AoB) versions below 4.1.2 and the Splunk CloudConnect SDK versions below 3.1.3, requests to third-party APIs through the REST API Modular Input incorrectly revert to using HTTP to connect after a failure to connect over HTTPS occurs.

    Splunk Splunk Add-on Builder Splunk CloudConnect SDK
  • High 8.8
    CVE-2021-1578

    Cisco Application Policy Infrastructure Controller Privilege Escalation Vulnerability

    A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an authenticated, remote attacker to elevate privileges to Administrator on a…

    Cisco Cisco Application Policy Infrastructure Controller (APIC) Network devices
  • Medium 6.4
    CVE-2021-3614

    A vulnerability was reported on some Lenovo Notebook systems that could allow an attacker with physical access to eleva…

    Lenovo Notebook BIOS