Skip to content
OpenAdvisories

Weakness (CWE)

CWE-670: Always-Incorrect Control Flow Implementation

Class Draft

The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

More detail

This weakness captures cases in which a particular code segment is always incorrect with respect to the algorithm that it is implementing. For example, if a C programmer intends to include multiple statements in a single block but does not include the enclosing braces (CWE-483), then the logic is always incorrect. This issue is in contrast to most weaknesses in which the code usually behaves correctly, except when it is externally manipulated in malicious ways.

Source: MITRE CWE-670

All Critical High Medium Low Exploited only Public exploit

46 results · Clear filters · Feed

  • High 7.5
    CVE-2021-43839

    Drainage of FeeCollector's Block Transaction Fees

    Cronos is a commercial implementation of a blockchain. In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx. This problem has bee…

    crypto-org-chain cronos github.com/crypto-org-chain/cronos github.com/tharsis/evmos Go
  • High 8.7
    CVE-2021-41153

    Specification non-compliance in JUMPI

    The evm crate is a pure Rust implementation of Ethereum Virtual Machine. In `evm` crate `< 0.31.0`, `JUMPI` opcode's condition is checked after the destination validity check. However, according to Geth and OpenEthereum, the condition check should happen befo…

    rust-blockchain evm evm crates.io
  • High 7.4
    CVE-2021-34767 Public exploit

    Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers IPv6 Denial of Service Vulnerability

    A vulnerability in IPv6 traffic processing of Cisco IOS XE Wireless Controller Software for Cisco Catalyst 9000 Family Wireless Controllers could allow an unauthenticated, adjacent attacker to cause a Layer 2 (L2) loop in a configured VLAN, resulting in a den…

    Cisco Cisco IOS XE Software iOS Network devices
  • High 8.1
    CVE-2020-28052 Public exploit

    Logic error in Legion of the Bouncy Castle BC Java

    An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed…

    bouncycastle org.bouncycastle:bcprov-jdk14 org.bouncycastle:bcprov-jdk15on org.bouncycastle:bcprov-jdk15 Debian Maven
  • High 7.5
    CVE-2014-2686

    Ansible unsafe evaluation of some strings

    Ansible prior to 1.5.4 mishandles the evaluation of some strings.

    ansible ansible Debian PyPI
  • High 7.5
    CVE-2019-19729

    bson-objectid contains Improper input validation

    An issue was discovered in the BSON ObjectID (aka bson-objectid) package 1.3.0 for Node.js. ObjectID() allows an attacker to generate a malformed objectid by inserting an additional property to the user-input, because bson-objectid will return early if it det…

    bson-objectid npm