Weakness (CWE)
CWE-672: Operation on a Resource after Expiration or Release
The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
Source: MITRE CWE-672
38 results · Clear filters · Feed
-
Medium 5.9
Hickory DNS Recursor Ghost Domain Attack via Child-Side NS RRset Caching
The Hickory DNS recursor in all versions of hickory-recursor and in hickory-resolver 0.26.0-beta.1 before 0.26.2 (recursor feature) is vulnerable to ghost domain names attacks because it reuses child-side apex NS RRsets cached from zone NS queries for iterati…
-
Medium —
Netfoil doesn't decrement TTL
### Summary TTL was not decremented, so stale records would continue to be served.
-
Medium 5.3
Outline before 1.12.0 Improper Access Control via Public Document Shares
Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, docume…
-
Medium 6.8
Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content
A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive…
-
Medium 5.7
OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) v…
-
Medium 5.3
libIEC61850: Server-side double free in MMS ObtainFile task reuse due to stale FILE* handle
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. From 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes MmsObtainFileTask::fileHandle but leaves the stale …
-
Medium 4.3
Gitea private repository access retained after rejected transfer
When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can review the repository. Rejecting or cancelling the transfer did not revoke this collaboration, so the named re…
-
Medium 6.5
Use of released resource in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compro…
-
Medium 4.2
Use of released resource in Session in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromis…
-
Medium 4.2
Use of released resource in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised th…
-
Medium 6.5
Use of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised …
-
Medium 5.9
Tornado before 6.5.7 Credential Leak via Handle Reuse
Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance…
-
Medium 6.5
Sylius: Cart FormComponent allows modification or deletion of an already-completed order
Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart `FormComponent`. When an order is completed while its cart…
-
Medium 6.5
Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leve…
-
Medium 4.3
Operation on a resource after expiration or release in Network in Google Chrome prior to 152.0.7977.65 allowed a remote…
-
Medium 6.6
EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution
EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow…
-
Medium 6.5
ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a natural or attacker-influenced chain fork can leave stale Sapling and Orchard note-commitment subtree roots in Zebra state. In zebra-state/src/service/non_finalized_state/chain.rs, Chain::pop_t…
-
Medium 6.1
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Operation on a resource after expiration or release in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
-
Medium 5.9
Arista EOS IPsec Tunnel Sequence Number Mismatch via Interface Flaps when Anti-Replay is Disabled
On affected platforms with hardware IPSec support running Arista EOS with certain IPsec features enabled, EOS may exhibit unexpected behavior in specific cases. Physical interface flaps and certain agent restarts can cause IPsec tunnel re-establishment with e…
-
Medium 5.3
Operation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized File Access
Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time-bounded access token to remain usable beyond its intended val…
-
Medium 6.3
OCSP responder certificate validity period not checked in public_key
Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired responder certificate to be accepted as valid. OCSP response verification in pubkey_ocsp:verify_response/5 and pubk…
-
Medium 5.3
Discourse: Cached outdated summaries can leak removed content
Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, outdated cached AI summaries can leak removed content to anonymous and unprivileged users who cannot regenerate summaries. This issue has…
-
Medium 6.0
OpenClaw < 2026.4.23 - Webhook Route Secret Cache Not Invalidated After Rotation
OpenClaw before 2026.4.23 caches resolved webhook route secrets backed by SecretRef values, allowing stale secrets to remain valid after rotation and reload. Attackers with previously valid webhook route secrets can continue authenticating requests and invoki…
-
Medium 4.3
Permalink Preview Information Disclosure After Permission Revocation
Mattermost versions 10.11.x <= 10.11.10 Fail to invalidate cached permalink preview data when a user loses channel access which allows the user to continue viewing private channel content via previously cached permalink previews until cache reset or relogin..…
-
Medium 6.5
MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation
MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may be triggered by improper WriteUnitOfWork state management. Thi…
-
Medium 6.6
Dell Avamar, version 19.4 or later, contains an access token reuse vulnerability in the AUI. A low privileged local att…
-
Medium 5.5
virtio_net: correct netdev_tx_reset_queue() invocation point
In the Linux kernel, the following vulnerability has been resolved: virtio_net: correct netdev_tx_reset_queue() invocation point When virtnet_close is followed by virtnet_open, some TX completions can possibly remain unconsumed, until they are finally process…
-
Medium 4.3
Unauthorized Access After Organization or Project Deactivation in Zitadel
Zitadel is an open source identity management platform. In Zitadel, even after an organization is deactivated, associated projects, respectively their applications remain active. Users across other organizations can still log in and access through these appli…
-
Medium 5.3CVE-2024-45244 Public exploit
Hyperledger Fabric does not verify request has a timestamp within the expected time window
Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.
-
Medium 5.5
Qemu-kvm: virtio-pci: improper release of configure vector leads to guest triggerable crash
A flaw was found in the QEMU Virtio PCI Bindings (hw/virtio/virtio-pci.c). An improper release and use of the irqfd for vector 0 during the boot process leads to a guest triggerable crash via vhost_net_stop(). This flaw allows a malicious guest to crash the Q…
-
Medium 5.7
Decidim's devise_invitable gem vulnerable to circumvention of invitation token expiry period
Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the `devise_invitable` gem, the invites feature allows users to accept the invitation for an unlimited amount of time through the password reset function…
-
Medium 4.0
Client configured with permissive trust policies susceptible to rollback attack in Notary Project
The Notary Project is a set of specifications and tools intended to provide a cross-industry standard for securing software supply chains by using authentic container images and other OCI artifacts. An external actor with control of a compromised container re…
-
Medium 6.5
Pow Mnesia cache doesn't invalidate all expired keys on startup
Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of `Pow.Store.Backend.MnesiaCache` is susceptible to session hijacking as expired keys are not being invalidated …
-
Medium 5.9
HCI send_sync Dangling Semaphore Reference Re-use
The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential R…
-
Medium 5.9
HCI Connection Creation Dangling State Reference Re-use
The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RCE o…
-
Medium 5.3
User invites for Funkwhale v1.2.8 do not permanently expire after being used for signup and can be used again after an …
-
Medium 4.3
Improper session expiration in Parse Server
Parse Server (npm package parse-server) broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with in…
-
Medium 6.1
Password reset links invalidation issue in WordPress
In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version…