Weakness (CWE)
CWE-672: Operation on a Resource after Expiration or Release
The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
Source: MITRE CWE-672
94 results · Feed
-
Medium 5.3
User invites for Funkwhale v1.2.8 do not permanently expire after being used for signup and can be used again after an …
-
High 7.5
An issue was discovered in MaraDNS Deadwood through 3.5.0021 that allows variant V1 of unintended domain name resolutio…
-
Low 2.5CVE-2022-27499 Public exploit
Premature release of resource during expected lifetime in the Intel(R) SGX SDK software may allow a privileged user to …
-
Unscored —
A heap double free issue was found in Opensc before version 0.22.0 in sc_pkcs15_free_tokeninfo.
-
High 7.5
Junos OS and Junos OS Evolved: An rpd core will be observed with proxy BGP route-target filtering enabled and certain route add and delete event happening
An Operation on a Resource after Expiration or Release vulnerability in the Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker with an established BGP session to cause a Denial of S…
-
High 7.5
A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC Drive Controlle…
-
High 7.5
A vulnerability has been identified in SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9.4), SIMATIC ET 20…
-
High 7.5
Update unsound DrainFilter and RString::retain
An issue was discovered in the abi_stable crate before 0.9.1 for Rust. DrainFilter lacks soundness because of a double drop.
-
Medium 4.3
Improper session expiration in Parse Server
Parse Server (npm package parse-server) broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with in…
-
Critical 9.4
Operation on a Resource after Expiration or Release in Jetty Server
In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the Byte…
-
Unscored —
The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when configured for wireless networking the FTP servi…
-
Medium 6.1
Password reset links invalidation issue in WordPress
In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version…
-
High 7.1CVE-2019-15794 Public exploit
Reference counting error in overlayfs/shiftfs error path when used in conjuction with aufs
Overlayfs in the Linux kernel and shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, both replace vma->vm_file in their mmap handlers. On error the original value is not restored, and the reference is put for t…
-
High 7.1CVE-2019-15791 Public exploit
Reference count underflow in shiftfs
In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() installs an fd referencing a file from the lower filesystem without taking an additional reference to that file. After the …