# CWE-345.

Every Advisory and CVE whose sources give the weakness CWE-345, newest first.

## Records, newest first (an older page)

- [OpenStack Neutron can use an incorrect ID during policy enforcement](https://agentprime.io/advisories/GHSA-f27h-g923-68hw.md)
  `GHSA-f27h-g923-68hw`, `CVE-2024-53916`, `PYSEC-2026-1693` · PyPI `neutron`: affected `>=23.0.0, <23.2.1 || >=24.0.0, <24.0.2 || >=25.0.0, <25.0.1`, fixed in `23.2.1`, `24.0.2`, `25.0.1` · CVSS 7.5 High · Not analysed yet · Published 25 Nov 2024 · Tags: CWE-345, CWE-754
- [Unauthenticated Remote Command Injection in eCharge Salia PLCC](https://agentprime.io/advisories/CVE-2024-11666.md)
  `CVE-2024-11666` · CVE record: hardy-barth cph2_echarge_firmware · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Nov 2024 · Tags: CWE-345
- [Visteon Infotainment VIP MCU Code Insufficient Validation of Data Authenticity Local Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2024-8356.md)
  `CVE-2024-8356` · CVE record: Visteon Infotainment · CVSS 8.8 High · Not analysed yet · Published 22 Nov 2024 · Tags: CWE-345
- [Moodle vulnerable to cache poisoning via injection into storage](https://agentprime.io/advisories/GHSA-2r9m-wg35-rfvc.md)
  `GHSA-2r9m-wg35-rfvc`, `BIT-moodle-2024-43428`, `CVE-2024-43428`, `PKSA-wg88-91px-2xxt` · Packagist `moodle/moodle`: affected `<4.1.12 || >=4.2.0-beta, <4.2.9 || >=4.3.0-beta, <4.3.6 || >=4.4.0-beta, <4.4.2`, fixed in `4.1.12`, `4.2.9`, `4.3.6`, `4.4.2` · CVSS 7.7 High · Not analysed yet · Published 7 Nov 2024 · Tags: Other injection, CWE-345
- [Laravel Reverb Missing API Signature Verification](https://agentprime.io/advisories/GHSA-pfrr-xvrf-pxjx.md)
  `GHSA-pfrr-xvrf-pxjx`, `CVE-2024-50347`, `PKSA-h3yd-snth-x1dh` · Packagist `laravel/reverb`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 6.3 Medium · Not analysed yet · Published 31 Oct 2024 · Tags: Weak cryptography or TLS, CWE-345
- [RSLogix™ 5 and RSLogix 500® Remote Code Execution Via VBA Embedded Script](https://agentprime.io/advisories/CVE-2024-7847.md)
  `CVE-2024-7847` · CVE record: Rockwell Automation RSLogix 500® and 2 more · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2024 · Tags: CWE-345
- [Gradio lacks integrity checking on the downloaded FRP client](https://agentprime.io/advisories/GHSA-8c87-gvhj-xm8m.md)
  `GHSA-8c87-gvhj-xm8m`, `CVE-2024-47867`, `PYSEC-2024-216` · PyPI `gradio`: affected `<5.0.0`, fixed in `5.0.0` · CVSS 2.1 Low · Not analysed yet · Published 10 Oct 2024 · Tags: CWE-345, CWE-494
- [Unauthorized usage of remote hardware module because of missing channel verification](https://agentprime.io/advisories/CVE-2024-47079.md)
  `CVE-2024-47079` · CVE record: meshtastic firmware · CVSS 6.4 Medium · Not analysed yet · Published 7 Oct 2024 · Tags: CWE-345
- [HTTP client can manipulate custom HTTP headers that are added by Traefik in github.com/traefik/traefik](https://agentprime.io/advisories/GHSA-62c8-mh53-4cqv.md)
  `GHSA-62c8-mh53-4cqv`, `CVE-2024-45410`, `GO-2024-3135` · Go `github.com/traefik/traefik` and 2 more: affected `*`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2024 · Tags: CWE-345, CWE-348
- [Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2024-23922.md)
  `CVE-2024-23922` · CVE record: Sony XAV-AX5500 · CVSS 6.8 Medium · Not analysed yet · Published 23 Sept 2024 · Tags: CWE-345
- [An issue was discovered in Technitium through 11.0.3.](https://agentprime.io/advisories/CVE-2023-28457.md)
  `CVE-2023-28457` · CVE record · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2024 · Tags: CWE-345
- [Insufficient verification of data authenticity in Open-Xchange GmbH OX Dovecot Pro](https://agentprime.io/advisories/CVE-2024-25584.md)
  `CVE-2024-25584` · CVE record: Open-Xchange GmbH OX Dovecot Pro · CVSS 5.3 Medium · Not analysed yet · Published 6 Sept 2024 · Tags: CWE-345
- [Insufficient verification of data authenticity in Google Chrome](https://agentprime.io/advisories/CVE-2024-7979.md)
  `CVE-2024-7979` · CVE record: Google Chrome · CVSS 7.0 High · Not analysed yet · Published 21 Aug 2024 · Tags: CWE-345
- [Denial of service from malicious signature in kyverno in github.com/kyverno/kyverno](https://agentprime.io/advisories/GHSA-4mp4-46gq-hv3r.md)
  `GHSA-4mp4-46gq-hv3r`, `CVE-2023-42816`, `GO-2023-2338` · Go `github.com/kyverno/kyverno`: affected `>=1.5.0-rc1.0.20230601080528-80d139bb5d1d, <1.5.0-rc1.0.20230918070231-fec2992e3f9f`, fixed in `1.5.0-rc1.0.20230918070231-fec2992e3f9f` · CVSS 6.1 Medium · Not analysed yet · Published 21 Aug 2024 · Tags: CWE-345
- [Windows DNS Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2024-37968.md)
  `CVE-2024-37968` · CVE record: Microsoft Windows Server 2019 and 4 more · CVSS 7.5 High · Not analysed yet · Published 13 Aug 2024 · Tags: CWE-345
- [Windows Print Spooler Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2024-38198.md)
  `CVE-2024-38198` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.5 High · Not analysed yet · Published 13 Aug 2024 · Tags: CWE-345
- [In regclient, pinned manifest digests may be ignored](https://agentprime.io/advisories/GHSA-qv35-3gw6-8q4j.md)
  `GHSA-qv35-3gw6-8q4j`, `CVE-2025-24882`, `GO-2024-3038` · Go `github.com/regclient/regclient`: affected `<0.7.1`, fixed in `0.7.1` · CVSS 5.2 Medium · Not analysed yet · Published 5 Aug 2024 · Tags: CWE-20, CWE-345
- [Insufficient verification of data authenticity in Google Chrome](https://agentprime.io/advisories/CVE-2024-7256.md)
  `CVE-2024-7256` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 1 Aug 2024 · Tags: CWE-345
- [DNSJava DNSSEC Bypass](https://agentprime.io/advisories/GHSA-cfxw-4h78-h7fw.md)
  `GHSA-cfxw-4h78-h7fw`, `CVE-2024-25638` · Maven `dnsjava:dnsjava`: affected `<3.6.0`, fixed in `3.6.0` · CVSS 8.9 High · Not analysed yet · Published 22 Jul 2024 · Tags: CWE-345, CWE-349
- [gix-path can use a fake program files location](https://agentprime.io/advisories/GHSA-mgvv-9p9g-3jv4.md)
  `GHSA-mgvv-9p9g-3jv4`, `CVE-2024-40644`, `RUSTSEC-2024-0355` · crates.io `gix-path`: affected `>=0.10.8, <0.10.9`, fixed in `0.10.9` · CVSS 6.8 Medium · Not analysed yet · Published 18 Jul 2024 · Tags: CWE-345
- [Certifi removes GLOBALTRUST root certificate](https://agentprime.io/advisories/GHSA-248v-346w-9cwc.md)
  `GHSA-248v-346w-9cwc`, `CVE-2024-39689`, `PYSEC-2024-230` · PyPI `certifi`: affected `>=2021.5.30, <2024.7.4`, fixed in `2024.7.4` · CVSS 7.5 High · Not analysed yet · Published 5 Jul 2024 · Tags: CWE-345
- [In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the applic…](https://agentprime.io/advisories/CVE-2024-37370.md)
  `CVE-2024-37370` · CVE record · CVSS 7.5 High · Not analysed yet · Published 28 Jun 2024 · Tags: CWE-345
- [Insufficient verification of data authenticity in OMRON Corporation NJ Series CPU Unit and others](https://agentprime.io/advisories/CVE-2024-33687.md)
  `CVE-2024-33687` · CVE record: OMRON Corporation NJ Series CPU Unit and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Jun 2024 · Tags: CWE-345
- [Filter bypass in filter_var (FILTER_VALIDATE_URL)](https://agentprime.io/advisories/CVE-2024-5458.md)
  `CVE-2024-5458` · CVE record: PHP Group PHP · CVSS 5.3 Medium · EPSS 0.12 · Not analysed yet · Published 9 Jun 2024 · Tags: CWE-345
- [Invision Community through 4.7.16 allows remote code execution via the applications/core/modules/admin/editor/toolbar.php IPS\core\modules\admin\editor\\\_toolbar::addPlugin() method.](https://agentprime.io/advisories/CVE-2024-30162.md)
  `CVE-2024-30162` · CVE record · CVSS 7.2 High · Not analysed yet · Published 7 Jun 2024 · Tags: CWE-345
- [ID Charger Connect & Pro - JWT-Null-Algorithm](https://agentprime.io/advisories/CVE-2024-5684.md)
  `CVE-2024-5684` · CVE record: Volkswagen Group Charging GmbH - Elli, EVBox ID Charger Connect & Pro · CVSS 6.3 Medium · Not analysed yet · Published 6 Jun 2024 · Tags: CWE-345
- [Booth: specially crafted hash can lead to invalid hmac being accepted by booth server](https://agentprime.io/advisories/CVE-2024-3049.md)
  `CVE-2024-3049` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 6 Jun 2024 · Tags: CWE-345
- [Authorize.net Payment Gateway For WooCommerce <= 8.0 - Insufficient Verification of Data Authenticity to Unauthenticated Payment Bypass](https://agentprime.io/advisories/CVE-2024-2382.md)
  `CVE-2024-2382` · CVE record: ishanverma Authorize.net Payment Gateway For WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 4 Jun 2024 · Tags: CWE-345
- [Claudio Sanches – Checkout Cielo for WooCommerce <= 1.1.0 - Insufficient Verification of Data Authenticity to Order Payment Status Update](https://agentprime.io/advisories/CVE-2024-1718.md)
  `CVE-2024-1718` · CVE record: claudiosanches Claudio Sanches – Checkout Cielo for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 4 Jun 2024 · Tags: CWE-345
- [Insufficient verification of data authenticity in AutomationDirect P3-550E](https://agentprime.io/advisories/CVE-2024-23601.md)
  `CVE-2024-23601` · CVE record: AutomationDirect P3-550E · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 May 2024 · Tags: CWE-345
- [WordPress User Profile Builder plugin <= 3.11.2 - Bypass Vulnerability vulnerability](https://agentprime.io/advisories/CVE-2024-31341.md)
  `CVE-2024-31341` · CVE record: Cozmoslabs Profile Builder · CVSS 5.3 Medium · Not analysed yet · Published 17 May 2024 · Tags: CWE-345
- [ThroughTek Kalay SDK insufficient verification of message authenticity](https://agentprime.io/advisories/CVE-2023-6323.md)
  `CVE-2023-6323` · CVE record: ThroughTek Kalay SDK · CVSS 4.3 Medium · Not analysed yet · Published 15 May 2024 · Tags: CWE-345
- [sshpiper's enabling of proxy protocol without proper feature flagging allows faking source address](https://agentprime.io/advisories/GHSA-4w53-6jvp-gg52.md)
  `GHSA-4w53-6jvp-gg52`, `CVE-2024-35175`, `GO-2024-2853` · Go `github.com/tg123/sshpiper`: affected `>=1.0.50, <1.3.0`, fixed in `1.3.0` · CVSS 5.3 Medium · Not analysed yet · Published 14 May 2024 · Tags: CWE-345
- [Insufficient verification of data authenticity in Fortinet FortiProxy and others](https://agentprime.io/advisories/CVE-2023-45586.md)
  `CVE-2023-45586` · CVE record: Fortinet FortiProxy and 1 more · CVSS 4.7 Medium · Not analysed yet · Published 14 May 2024 · Tags: CWE-345
- [Insufficient verification of data authenticity in Siemens SIMATIC RTLS Locating Manager](https://agentprime.io/advisories/CVE-2024-33494.md)
  `CVE-2024-33494` · CVE record: Siemens SIMATIC RTLS Locating Manager · CVSS 6.9 Medium · Not analysed yet · Published 14 May 2024 · Tags: CWE-345
- [CMSaasStarter: JWT Token Not Verified on Server Session](https://agentprime.io/advisories/CVE-2024-34354.md)
  `CVE-2024-34354` · CVE record: CriticalMoments CMSaasStarter · CVSS 6.5 Medium · Not analysed yet · Published 9 May 2024 · Tags: CWE-345
- [NETGEAR RAX30 lighttpd Misconfiguration Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2023-27360.md)
  `CVE-2023-27360` · CVE record: NETGEAR RAX30 · CVSS 7.5 High · Not analysed yet · Published 3 May 2024 · Tags: CWE-345
- [WildFly Elytron: OIDC app attempting to access the second tenant, the user should be prompted to log](https://agentprime.io/advisories/GHSA-jpmx-996v-48fm.md)
  `GHSA-jpmx-996v-48fm`, `CVE-2023-6236` · Maven `org.wildfly.security:wildfly-elytron-http-oidc`: affected `<2.2.5.Final`, fixed in `2.2.5.Final` · CVSS 7.3 High · Not analysed yet · Published 10 Apr 2024 · Tags: CWE-345
- [Insufficient verification of data authenticity in Huawei HarmonyOS and others](https://agentprime.io/advisories/CVE-2023-52546.md)
  `CVE-2023-52546` · CVE record: Huawei HarmonyOS and 1 more · CVSS 7.5 High · Not analysed yet · Published 8 Apr 2024 · Tags: CWE-345
- [Insufficient verification of data authenticity in AYS Pro Plugins Survey Maker](https://agentprime.io/advisories/CVE-2023-35764.md)
  `CVE-2023-35764` · CVE record: AYS Pro Plugins Survey Maker · CVSS 5.3 Medium · Not analysed yet · Published 3 Apr 2024 · Tags: CWE-345
- [In Astro-Shield, setting a correct \`integrity\` attribute to injected code allows to bypass the allow-lists](https://agentprime.io/advisories/GHSA-c4gr-q97g-ppwc.md)
  `GHSA-c4gr-q97g-ppwc`, `CVE-2024-30250` · npm `@kindspells/astro-shield`: affected `>=1.2.0, <1.3.2`, fixed in `1.3.2` · CVSS 7.5 High · Not analysed yet · Published 1 Apr 2024 · Tags: CWE-345
- [WooCommerce POS <= 1.4.11 - Insufficient Verification of Data Authenticity to Authenticated (Customer+) Information Disclosure](https://agentprime.io/advisories/CVE-2024-2384.md)
  `CVE-2024-2384` · CVE record: kilbot WCPOS – Point of Sale (POS) plugin for WooCommerce · CVSS 4.3 Medium · Not analysed yet · Published 20 Mar 2024 · Tags: CWE-345
- [Cross-site websocket hijacking in Querybook](https://agentprime.io/advisories/CVE-2024-28251.md)
  `CVE-2024-28251` · CVE record: pinterest querybook · CVSS 5.6 Medium · Not analysed yet · Published 13 Mar 2024 · Tags: CWE-345
- [aiosmtpd vulnerable to SMTP smuggling](https://agentprime.io/advisories/GHSA-pr2m-px7j-xg65.md)
  `GHSA-pr2m-px7j-xg65`, `CVE-2024-27305`, `PYSEC-2024-221` · PyPI `aiosmtpd`: affected `<1.4.5`, fixed in `1.4.5` · CVSS 5.3 Medium · Not analysed yet · Published 13 Mar 2024 · Tags: CWE-345
- [EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Unauthenticated Booking Payment Bypass](https://agentprime.io/advisories/CVE-2024-1321.md)
  `CVE-2024-1321` · CVE record: metagauss EventPrime – Events Calendar, Bookings and Tickets · CVSS 5.3 Medium · Not analysed yet · Published 13 Mar 2024 · Tags: CWE-345
- [Insufficient verification of data authenticity in Mozilla Firefox](https://agentprime.io/advisories/CVE-2024-1554.md)
  `CVE-2024-1554` · CVE record: Mozilla Firefox · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Feb 2024 · Tags: CWE-345
- [Insufficient verification of data authenticity in AMD Alveo™ Card (UltraScale™and UltraScale+™ based) and others](https://agentprime.io/advisories/CVE-2023-20570.md)
  `CVE-2023-20570` · CVE record: AMD Alveo™ Card (UltraScale™and UltraScale+™ based) and 4 more · CVSS 3.3 Low · Not analysed yet · Published 13 Feb 2024 · Tags: CWE-345
- [IBM Security Access Manager Container improper file validation](https://agentprime.io/advisories/CVE-2023-32329.md)
  `CVE-2023-32329` · CVE record: IBM Security Verify Access Appliance and 1 more · CVSS 6.2 Medium · Not analysed yet · Published 3 Feb 2024 · Tags: CWE-345
- [Classic builder cache poisoning](https://agentprime.io/advisories/GHSA-xw73-rw38-6vjc.md)
  `GHSA-xw73-rw38-6vjc`, `CVE-2024-24557`, `GO-2024-2512` · Go `github.com/docker/docker` and 1 more: affected `<24.0.9 || >=25.0.0, <25.0.2`, fixed in `24.0.9`, `25.0.2` · CVSS 6.9 Medium · Not analysed yet · Published 1 Feb 2024 · Tags: CWE-345, CWE-346
- [Insufficient verification of data authenticity in Huawei HarmonyOS and others](https://agentprime.io/advisories/CVE-2023-52109.md)
  `CVE-2023-52109` · CVE record: Huawei HarmonyOS and 1 more · CVSS 7.5 High · Not analysed yet · Published 16 Jan 2024 · Tags: CWE-345
- [Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin](https://agentprime.io/advisories/GHSA-45x7-px36-x8w8.md)
  `GHSA-45x7-px36-x8w8`, `CVE-2023-48795`, `GO-2023-2402`, `PYSEC-2026-1758` · crates.io `russh` and 2 more: affected `<0.40.2`, fixed in `0.40.2` · CVSS 5.9 Medium · EPSS 0.94 · Not analysed yet · Published 18 Dec 2023 · Tags: CWE-345, CWE-354
- [AsyncSSH vulnerable to Prefix Truncation Attack (a.k.a. Terrapin Attack) against ChaCha20-Poly1305 and Encrypt-then-MAC](https://agentprime.io/advisories/GHSA-hfmc-7525-mj55.md)
  `GHSA-hfmc-7525-mj55` · PyPI `asyncssh`: affected `<2.14.2`, fixed in `2.14.2` · CVSS 5.9 Medium · Not analysed yet · Published 18 Dec 2023 · Tags: CWE-345
- [ASAR Integrity bypass via filetype confusion in electron](https://agentprime.io/advisories/GHSA-7m48-wc93-9g85.md)
  `GHSA-7m48-wc93-9g85`, `CVE-2023-44402` · npm `electron`: affected `<22.3.24 || >=23.0.0-alpha.1, <=23.3.13 || >=24.0.0-alpha.1, <24.8.3 || >=25.0.0-alpha.1, <25.8.1 || >=26.0.0-alpha.1, <26.2.1 || >=27.0.0-alpha.1, <27.0.0-alpha.7`, fixed in `22.3.24`, `24.8.3`, `25.8.1`, `26.2.1`, `27.0.0-alpha.7` · CVSS 6.1 Medium · Not analysed yet · Published 1 Dec 2023 · Tags: CWE-345
- [Validation of SignedInfo](https://agentprime.io/advisories/GHSA-ww7x-3gxh-qm6r.md)
  `GHSA-ww7x-3gxh-qm6r`, `CVE-2023-49087`, `PKSA-57qx-v755-bhs3`, `PKSA-c17n-yzdt-bpbs` · Packagist `simplesamlphp/saml2` and 1 more: affected `>=5.0.0-alpha.12, <5.0.0-alpha.13`, fixed in `5.0.0-alpha.13` · CVSS 6.8 Medium · Not analysed yet · Published 28 Nov 2023 · Tags: CWE-345
- [json-web-token library is vulnerable to a JWT algorithm confusion attack](https://agentprime.io/advisories/GHSA-4xw9-cx39-r355.md)
  `GHSA-4xw9-cx39-r355`, `CVE-2023-48238` · npm `json-web-token`: affected `<4.0.0`, fixed in `4.0.0` · CVSS 7.5 High · Not analysed yet · Published 17 Nov 2023 · Tags: CWE-20, CWE-345
- [vantage6-server node accepts non-whitelisted algorithms from malicious server](https://agentprime.io/advisories/GHSA-vc3v-ppc7-v486.md)
  `GHSA-vc3v-ppc7-v486`, `CVE-2023-47631`, `PYSEC-2023-303`, `PYSEC-2023-304` · PyPI `vantage6-node` and 1 more: affected `<4.1.2`, fixed in `4.1.2` · CVSS 7.2 High · Not analysed yet · Published 14 Nov 2023 · Tags: CWE-345, CWE-358
- [Attacker can cause Kyverno user to unintentionally consume insecure image](https://agentprime.io/advisories/GHSA-3hfq-cx9j-923w.md)
  `GHSA-3hfq-cx9j-923w`, `BIT-kyverno-2023-47630`, `CVE-2023-47630`, `GO-2023-2340` · Go `github.com/kyverno/kyverno`: affected `<1.10.5`, fixed in `1.10.5` · CVSS 7.1 High · Not analysed yet · Published 14 Nov 2023 · Tags: Information disclosure, CWE-345
- [Command injection via wave install file](https://agentprime.io/advisories/CVE-2023-5747.md)
  `CVE-2023-5747` · CVE record: Hanwha Vision Co., Ltd. PNV-A6081R · CVSS 7.2 High · Not analysed yet · Published 13 Nov 2023 · Tags: Weak cryptography or TLS, CWE-345
- [Moodle Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability](https://agentprime.io/advisories/GHSA-cwh2-q44x-5w3c.md)
  `GHSA-cwh2-q44x-5w3c`, `BIT-moodle-2023-5548`, `CVE-2023-5548`, `PKSA-7z8c-xy4p-1ctc` · Packagist `moodle/moodle`: affected `<4.3.0-rc2`, fixed in `4.3.0-rc2` · CVSS 3.3 Low · Not analysed yet · Published 9 Nov 2023 · Tags: CWE-345, CWE-349
- [AsyncSSH Rogue Session Attack](https://agentprime.io/advisories/GHSA-c35q-ffpf-5qpm.md)
  `GHSA-c35q-ffpf-5qpm`, `CVE-2023-46446`, `PYSEC-2023-239` · PyPI `asyncssh`: affected `<2.14.1`, fixed in `2.14.1` · CVSS 8.1 High · Not analysed yet · Published 9 Nov 2023 · Tags: Information disclosure, Broken access control, CWE-345, CWE-349

Newest: <https://agentprime.io/advisories/tag/cwe-345.md>
Older: <https://agentprime.io/advisories/tag/cwe-345.md?cursor=WyIyMDIzLTExLTA5VDE4OjM1OjE0LjAwMDAwMFoiLCJHSFNBLWMzNXEtZmZwZi01cXBtIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-345&cursor=WyIyMDI0LTExLTI1VDA4OjUwOjA0LjE3MDAwMFoiLCJDVkUtMjAyMi0zMzg2MSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-345/?cursor=WyIyMDI0LTExLTI1VDA4OjUwOjA0LjE3MDAwMFoiLCJDVkUtMjAyMi0zMzg2MSJd>. Everything for agents: <https://agentprime.io/llms.txt>.