Skip to content
OpenAdvisories

Weakness (CWE)

CWE-941: Incorrectly Specified Destination in a Communication Channel

Base Incomplete

The product creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor.

Source: MITRE CWE-941

All Critical High Medium Low Exploited only Public exploit

13 results · Feed

  • High 7.5
    CVE-2026-101303

    IPv6 UDP sendto(2) bypasses jail loopback restriction

    The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. A process in a classic (non-VNET) jail can send UDP datagrams to services listening on the host's IPv6…

    FreeBSD FreeBSD
  • Medium 5.4
    CVE-2026-72506

    VoiceTra provided by National Institute of Information and Communications Technology (NICT) contains an incorrectly spe…

    National Institute of Information and Communications Technology "VoiceTra(Voice Translator)" for iOS "VoiceTra(Voice Translator)" for Android Android iOS
  • High 7.2
    CVE-2026-69246

    Guzzle: Noncanonical host can bypass host-based checks

    Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPT_URL to the URI exactly as written and push that Host into CURLOPT_HTTPH…

    guzzle guzzle guzzle guzzlehttp/guzzle Debian Ubuntu Packagist
  • Medium 5.9
    CVE-2026-67355

    guzzlehttp/guzzle before 7.15.1 Host-only Cookie Scope

    guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent ho…

    guzzle guzzle guzzlehttp/guzzle guzzle Debian Ubuntu Packagist
  • Medium 6.3
    CVE-2026-40118

    UDP Console provided by Arcserve contains an incorrectly specified destination in a communication channel vulnerability…

    Arcserve UDP Console
  • Critical 9.1
    CVE-2025-69515 Public exploit

    An issue in JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to force the infotainment system in…

  • High 7.2
    CVE-2025-53899

    Kiteworks MFT is vulnerable to an Incorrectly Specified Destination in a Communication Channel

    Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incorrectly specified destination in a communication channel which allows an attacker with administrative privileges on th…

    Kiteworks security-advisories
  • Low 3.2
    CVE-2025-0036

    In AMD Versal Adaptive SoC devices, the incorrect configuration of the SSS during runtime (post-boot) cryptographic ope…

    AMD Versal™ RF Series Versal™ Prime Series Versal™ AI Core Series Browsers
  • High 8.1
    CVE-2024-29415 Public exploit

    ip SSRF improper categorization in isPublic

    The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of …

    node-ip node-ip ip Debian Ubuntu npm
  • Critical 9.4
    CVE-2024-34947

    Quanxun Huiju Network Technology (Beijing) Co.,Ltd IK-Q3000 3.7.10 x64 Build202401261655 was discovered to be vulnerabl…

  • Medium 6.1
    CVE-2023-33198

    Incorrectly Specified Chat Message Destinations in tgstation-server and DreamMaker API

    tgstation-server is a production scale tool for BYOND server management. The DreamMaker API (DMAPI) chat channel cache can possibly be poisoned by a tgstation-server (TGS) restart and reattach. This can result in sending chat messages to one of any of the con…

    tgstation tgstation-server
  • High 8.3
    CVE-2022-4847

    Incorrectly Specified Destination in a Communication Channel in usememos/memos

    Incorrectly Specified Destination in a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.

    usememos usememos/memos github.com/usememos/memos Go
  • Unscored —
    CVE-2019-18242

    In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower,…