Weakness (CWE)
CWE-840: Business Logic Errors
Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.
Source: MITRE CWE-840
71 results · Clear filters · Feed
-
Medium 6.3
274056675 springboot-openai-chatgpt addData logic error
A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5 and classified as critical. Affected by this issue is some unknown functionality of the file /api/mjkj-chat/cgform-api/addData/. The manipulation of the argument chatUserID leads to busi…
-
Medium 6.2
Permission management vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may…
-
Medium 5.3
Zoom Workplace Apps - Business Logic Error
Business logic error in some Zoom Workplace Apps may allow an unauthenticated user to conduct a disclosure of information via network access.
-
Medium 5.3
Adobe Commerce | Business Logic Errors (CWE-840)
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Business Logic Error vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to circumvent intended …
-
Medium 6.6
Privilege escalation vulnerability in the Account module Impact: Successful exploitation of this vulnerability may affe…
-
Medium 4.3
Unclaimed S3 Bucket Reference in psf/requests Documentation
An unclaimed Amazon S3 bucket, 'codeconf', is referenced in an audio file link within the .rst documentation file. This bucket has been claimed by an external party. The use of this unclaimed S3 bucket could lead to data integrity issues, data leakage, availa…
-
Medium 4.3
CoinGate Plugin Payment callback.php postProcess logic error
A vulnerability was found in CoinGate Plugin up to 1.2.7 on PrestaShop. It has been rated as problematic. Affected by this issue is the function postProcess of the file modules/coingate/controllers/front/callback.php of the component Payment Handler. The mani…
-
Medium 6.6
LaunchAnywhere vulnerability in the account module. Impact: Successful exploitation of this vulnerability may affect se…
-
Medium 5.5
Privilege escalation vulnerability in the NMS module Impact: Successful exploitation of this vulnerability will affect …
-
Medium 6.4
Cracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect avai…
-
Medium 6.8
Cracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect avai…
-
Medium 4.3
keerti1924 Online-Book-Store-Website shop.php logic error
A vulnerability was found in keerti1924 Online-Book-Store-Website 1.0 and classified as problematic. This issue affects some unknown processing of the file /shop.php. The manipulation of the argument product_price leads to business logic errors. The attack ma…
-
Medium 4.3
SourceCodester Online Mobile Management Store Product Price logic error
A vulnerability classified as problematic was found in SourceCodester Online Mobile Management Store 1.0. Affected by this vulnerability is an unknown functionality of the component Product Price Handler. The manipulation of the argument quantity with the inp…
-
Medium 6.0
Business Logic Errors in microweber/microweber
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.
-
Medium 5.9
Business Logic Errors in microweber/microweber
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.
-
Medium 4.3
Bypass Purchase Order Approval using Company User in Adobe Commerce B2B
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Business Logic Errors vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to…
-
Medium 5.4
Business Logic Errors in fossbilling/fossbilling
Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0.
-
Medium 5.4
Business Logic Errors in fossbilling/fossbilling
Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0.
-
Medium 6.0
Business Logic Errors in answerdev/answer
Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
-
Medium 5.5
Business Logic Errors in froxlor/froxlor
Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.
-
Medium 5.7
Business Logic Errors in ikus060/rdiffweb
Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5.
-
Medium 5.9
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw make…
-
Medium 6.5
Business Logic Errors in crater-invoice/crater
Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5.
-
Medium 4.3
Business Logic Errors in dolibarr/dolibarr
Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0.
-
Medium 5.3
Use multiple time the one-time coupon in microweber/microweber
Use multiple time the one-time coupon in Packagist microweber/microweber prior to 1.2.11.
-
Medium 6.5
Business Logic Errors in publify/publify
Business Logic Errors in GitHub repository publify/publify prior to 9.2.7.
-
Medium 4.3
Business Logic Errors in pimcore/pimcore
Business Logic Errors in GitHub repository pimcore/pimcore prior to 10.2.6.
-
Medium 6.5
Magento Commerce Gift Card Business Logic Error
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can leverage this vulnerability to altar the price of an item.
-
Medium 6.5
When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided…
-
Medium 5.3
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURL…
-
Medium 5.9
TOCTOU Race Condition in Yarn
The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack.