Weakness (CWE)
CWE-672: Operation on a Resource after Expiration or Release
The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
Source: MITRE CWE-672
14 results · Clear filters · Feed
-
Low 3.1
Use of released resource in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised …
-
Low 3.8
better-auth Stale Sessions Persist After User Deletion
better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain …
-
Low 3.7
Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records
In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A…
-
Low 3.5
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. …
-
Low 3.1
post edit time limit is not enforced on some post update operations
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired via the post…
-
Low 2.1
Juju has broken CMR authorization
Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to update database records can mint an invalid macaroon that is incorrectly validated by the juju controller, enabling a cha…
-
Low —
Rust XCB `xcb::Connection::connect_to_fd*` functions violate I/O safety
The API of `xcb::Connection` has constructors which allow an arbitrary `RawFd` to be used as a socket connection. On either failure of these constructors or on the drop of `Connection`, it closes the associated file descriptor. Thus, a program which uses an `…
-
Low 3.5
Wasmtime has host panic with `fd_renumber` WASIp1 function
Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host (embedder). The specific bug is triggere…
-
Low 2.3
Reference to Expired Domain Vulnerability in OpenText™ ArcSight Enterprise Security Manager
Reference to Expired Domain Vulnerability in OpenText™ ArcSight Enterprise Security Manager.
-
Low —
array-init-cursor is unsound when used with types that implement `Drop`
The `Drop` implementation will get run twice when using the cursor. This issue does not affect you, if you are using only using the crate with types that are `Copy` such as `u8`. This issue also does not affect you, if you are only depending on it through the…
-
Low 3.5
Suspended Directus user can continue to use session token to access API
Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.10.0 and prior to version 11.5.0, a suspended user can use the token generated in session auth mode to access the API despite their status. This happens be…
-
Low 2.1
JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh
JWK Set (JSON Web Key Set) is a JWK and JWK Set Go implementation. Prior to 0.6.0, the project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. The current behavior is to overwrite or a…
-
Low 3.1
Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodon
Mastodon is a free, open-source social network server based on ActivityPub. When an OAuth Application is destroyed, the streaming server wasn't being informed that the Access Tokens had also been destroyed, this could have posed security risks to users by all…
-
Low 2.5CVE-2022-27499 Public exploit
Premature release of resource during expected lifetime in the Intel(R) SGX SDK software may allow a privileged user to …