Weakness (CWE)
CWE-696: Incorrect Behavior Order
The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.
Source: MITRE CWE-696
9 results · Clear filters · Feed
-
Low 2.3
rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosure
rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before the handshake completes to the client-facing server when Encrypted Client Hello is rejected. Because start_traffic() queues plaintext from C…
-
Low 2.1
Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs in
Incorrect order of security checks in Apache Wicket. org.apache.wicket.protocol.http.ResourceIsolationRequestCycleListener obtains the page a request targets before it consults its resource isolation policies, because those policies are passed that page. Obta…
-
Low 2.0
Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its …
-
Low 3.1
Partition interceptor may be improperly added while sending message
Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6
-
Low 3.7
GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization.
-
Low 2.4
Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot
Incorrect behavior order in the Infotainment / Digital Round display of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass the PIN entry screen. The Infotainment uses presence of Wireless Control Module (WC…
-
Low 2.4
Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot
Incorrect behavior order in the Infotainment / Digital Round display of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass the PIN entry screen. The Infotainment uses presence of Wireless Control Module (WC…
-
Low 3.7
Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-20…
-
Low 3.6
In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This …