Weakness (CWE)
CWE-840: Business Logic Errors
Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.
Source: MITRE CWE-840
110 results · Feed
-
High 8.3
Business Logic Errors in thorsten/phpmyfaq
Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
Medium 6.0
Business Logic Errors in answerdev/answer
Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
-
High 8.1
Business Logic Errors in answerdev/answer
Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
-
Medium 5.5
Business Logic Errors in froxlor/froxlor
Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.
-
Medium 5.7
Business Logic Errors in ikus060/rdiffweb
Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5.
-
Low 2.8
Business Logic Errors in ikus060/rdiffweb
Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7.
-
Medium 5.9
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw make…
-
Critical 9.8CVE-2022-32207 EPSS 12%
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the…
-
High 7.5
libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should h…
-
Critical 9.0
Business Logic Errors in erudika/para
Business Logic Errors in GitHub repository erudika/para prior to 1.45.11.
-
High 8.8
Host Header injection in password Reset in livehelperchat/livehelperchat
Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97.
-
High 7.4
Old sessions are not blocked by the login enable function. in snipe/snipe-it
Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10.
-
Medium 6.5
Business Logic Errors in crater-invoice/crater
Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5.
-
Medium 4.3
Business Logic Errors in dolibarr/dolibarr
Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0.
-
Critical 9.4
Business Logic Errors in microweber/microweber
Business Logic Errors in Packagist microweber/microweber prior to 1.2.11.
-
Medium 5.3
Use multiple time the one-time coupon in microweber/microweber
Use multiple time the one-time coupon in Packagist microweber/microweber prior to 1.2.11.
-
Medium 6.5
Business Logic Errors in publify/publify
Business Logic Errors in GitHub repository publify/publify prior to 9.2.7.
-
Medium 4.3
Business Logic Errors in pimcore/pimcore
Business Logic Errors in GitHub repository pimcore/pimcore prior to 10.2.6.
-
High 7.7
Business Logic Errors in janeczku/calibre-web
calibre-web is vulnerable to Business Logic Errors
-
High 7.7
Business Logic Errors in yetiforcecompany/yetiforcecrm
yetiforcecrm is vulnerable to Business Logic Errors
-
High 7.3
Business Logic Errors in yetiforcecompany/yetiforcecrm
yetiforcecrm is vulnerable to Business Logic Errors
-
Medium 6.5
Magento Commerce Gift Card Business Logic Error
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can leverage this vulnerability to altar the price of an item.
-
Medium 6.5
When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided…
-
High 7.5CVE-2021-22926 EPSS 15%
libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `C…
-
Medium 5.3
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURL…
-
Unscored —
A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amoun…
-
Unscored —
A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars.
-
Medium 5.9
TOCTOU Race Condition in Yarn
The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack.
-
High 8.3
UAA defaults email address to an insecure domain
Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors in…
-
High 8.8
Gorouter allows space developer to hijack route services hosted outside the platform
Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platform. A user with space developer permissions can create a private domain that shadows the external dom…