Advisories · Weakness
CWE-298.
Every Advisory and CVE whose sources give the weakness CWE-298, newest first.
- CVSS 6.3 Medium
mwiede jsch KnownHosts.java getRevokedKeys improper check for certificate revocation
- mwiede jsch
- CWE-298
- CWE-299
- CVSS 4.8 Medium
Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation
- WSO2 API Manager
- WSO2 Identity Server
- CWE-298
- CVSS 9.8 CriticalCritical · CVSS 9+
Casdoor doesn't verify that a JWT used for token exchange is still active
- CWE-298
<=1.1000.1-0.20260321120606-239e8bd69487 · no fixed version yet
GHSA-339w-3hqm-9pjc · CVE-2026-9097 - CVSS 10.0 CriticalCritical · CVSS 9+
Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows attackers to bypass certificate checks and execute commands with System privileges.
- CWE-298
- CVSS 10.0 CriticalCritical · CVSS 9+
eProsima Fast-DDS v3.3 was discovered to contain improper validation for ticket revocation, resulting in insecure communications and connections.
- CWE-298
- CWE-370
- CVSS 7.1 High
iSTAR- Improper Validation of Certificate Expiration
- Johnson Controls iSTAReX, iSTAR Edge, iSTAR Ultra LT, iSTAR Ultra , iSTAR Ultra SE
- CWE-298
- CVSS 5.5 Medium
Infrahub: Deleted and expired API tokens can still authenticate
- CWE-298
<1.3.9 || >=1.4.0, <1.4.5 · fixed in 1.3.9, 1.4.5
GHSA-v2p7-4pv4-3wwh · CVE-2025-59036 - CVSS 6.0 Medium
Certificate validity not properly verified
- arcinfo PcVue
- CWE-298
- CVSS 6.5 Medium
Pow Mnesia cache doesn't invalidate all expired keys on startup
- CWE-298
- CWE-672
>=1.0.14, <1.0.34 · fixed in 1.0.34
GHSA-3cjh-p6pw-jhv9 · CVE-2023-42446