Advisories · Weakness

CWE-358.

Every Advisory and CVE whose sources give the weakness CWE-358, newest first.

CVE-2024-41907 CVE record

CVSS 2.1 Low

Siemens SINEC Traffic Analyzer: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All…
- Siemens SINEC Traffic Analyzer
- CWE-358
Not analysed yet 13 Aug 2024
CVE-2024-7003 CVE record

CVSS 4.3 Medium

Google Chrome: Inappropriate implementation in FedCM in Google Chrome prior to 127.0.6533.72 allowed a…
- Google Chrome
- CWE-358
Not analysed yet 6 Aug 2024
CVE-2024-6995 CVE record

CVSS 8.8 High

Google Chrome: Inappropriate implementation in Fullscreen in Google Chrome on Android prior to…
- Google Chrome
- CWE-358
Not analysed yet 6 Aug 2024
CVE-2024-5500 CVE record

CVSS 6.5 Medium

Google Chrome: Inappropriate implementation in Sign-In in Google Chrome prior to 1.3.36.351 allowed a…
- Google Chrome
- CWE-358
Not analysed yet 16 Jul 2024
CVE-2024-6772 CVE record

CVSS 8.8 High

Google Chrome: Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.182 allowed a…
- Google Chrome
- CWE-358
Not analysed yet 16 Jul 2024
CVE-2024-6101 CVE record

CVSS 8.8 High

Google Chrome: Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.114 allowed a…
- Google Chrome
- CWE-358
Not analysed yet 19 Jun 2024
CVE-2024-27842 CVE record

CVSS 8.1 High

The issue was addressed with improved checks.
- Apple macOS
- CWE-358
Not analysed yet 13 May 2024
CVE-2024-2617 CVE record

CVSS 7.2 High

A vulnerability exists in the RTU500 that allows for authenticated and authorized users to bypass secure update, if secure update feature was not enabled on all CMUs of a RTU500.
- Hitachi Energy RTU500 series CMU firmware
- CWE-358
Not analysed yet 30 Apr 2024
CVE-2024-3845 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Google Chrome: Inappropriate implementation in Networks in Google Chrome prior to 124.0.6367.60 allowed…
- Google Chrome
- CWE-358
- CWE-1068
Not analysed yet 17 Apr 2024
CVE-2024-3844 CVE record

CVSS 4.3 Medium

Google Chrome: Inappropriate implementation in Extensions in Google Chrome prior to 124.0.6367.60…
- Google Chrome
- CWE-358
Not analysed yet 17 Apr 2024
CVE-2024-3838 CVE record

CVSS 4.3 Medium

Google Chrome: Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed…
- Google Chrome
- CWE-358
Not analysed yet 17 Apr 2024
CVE-2024-25545 CVE record

CVSS 7.8 High

An issue in Weave Weave Desktop v.7.78.10 allows a local attacker to execute arbitrary code via a crafted script to the nwjs framework component.
- CWE-358
Not analysed yet 12 Apr 2024
CVE-2024-23592 CVE record

CVSS 6.3 Medium

Lenovo Synaptics Fingerprint Readers: An authentication bypass vulnerability was reported in Lenovo devices with Synaptics…
- Lenovo Synaptics Fingerprint Readers
- CWE-358
Not analysed yet 5 Apr 2024
CVE-2024-2174 CVE record

CVSS 8.8 HighCritical · CVSS 7+ and EPSS

Google Chrome: Inappropriate implementation in V8 in Google Chrome prior to 122.0.6261.111 allowed a…
- Google Chrome
- CWE-358
Not analysed yet 6 Mar 2024
rpyc PyPI

CVSS 8.5 High

RPyC's missing security check results in code execution when using numpy.array on the server-side.
- Authentication bypass
- CWE-358
>=4.0.0, <6.0.0 · fixed in 6.0.0

GHSA-h5cg-53g7-gqjw · CVE-2024-27758 Not analysed yet 6 Mar 2024
org.json:json Maven

CVSS 7.5 High

Java: DoS Vulnerability in JSON-JAVA
- Denial of service
- CWE-358
<20231013 · fixed in 20231013

GHSA-4jq9-2xhw-jpx7 · CVE-2023-5072 Not analysed yet 14 Nov 2023
vantage6-node +1 PyPI

CVSS 7.2 High

vantage6-server node accepts non-whitelisted algorithms from malicious server
- CWE-345
- CWE-358
<4.1.2 · fixed in 4.1.2

GHSA-vc3v-ppc7-v486 · CVE-2023-47631 Not analysed yet 14 Nov 2023
CVE-2023-40445 CVE record

CVSS 7.5 High

The issue was addressed with improved UI handling.
- Apple iOS and iPadOS
- CWE-358
Not analysed yet 25 Oct 2023
CVE-2023-4501 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Authentication bypass in OpenText (Micro Focus) Enterprise Server
- OpenText Visual COBOL, COBOL Server, Enterprise Developer, Enterprise Server
- Authentication bypass
- CWE-253
Not analysed yet 12 Sept 2023
CVE-2023-3266 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

CyberPower PowerPanel Enterprise: A non-feature complete authentication mechanism exists in the production application…
- CyberPower PowerPanel Enterprise
- CWE-358
Not analysed yet 14 Aug 2023
CVE-2023-39403 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Improper authorization in Huawei HarmonyOS and others
- Huawei HarmonyOS
- Huawei EMUI
- Broken access control
- CWE-358
Not analysed yet 13 Aug 2023
org.keycloak:keycloak-server-spi-private +1 Maven

CVSS 3.5 Low

Client Spoofing within the Keycloak Device Authorisation Grant
- CWE-358
<21.1.2 · fixed in 21.1.2

GHSA-f5h4-wmp5-xhg6 · CVE-2023-2585 Not analysed yet 30 Jun 2023
CVE-2023-28601 CVE record

CVSS 8.3 High

Zoom Video Communications, Inc. Zoom for Windows Client: Zoom for Windows clients prior to 5.14.0 contain an improper restriction of operations…
- Zoom Video Communications, Inc. Zoom for Windows Client
- CWE-358
Not analysed yet 13 Jun 2023
russh crates.io

CVSS 5.9 Medium

russh may use insecure Diffie-Hellman keys
- Weak cryptography or TLS
- CWE-20
<0.36.2 || >=0.37.0, <0.37.1 · fixed in 0.36.2, 0.37.1

GHSA-cqvm-j2r2-hwpg · CVE-2023-28113 Not analysed yet 17 Mar 2023
CVE-2023-22393 CVE record

CVSS 7.5 High

Junos OS and Junos OS Evolved: RPD crash upon receipt of BGP route with invalid next-hop
- Juniper Networks Junos OS
- Juniper Networks Junos OS Evolved
- CWE-358
- CWE-754
Not analysed yet 12 Jan 2023
CVE-2021-26328 CVE record

CVSS 4.4 Medium

Failure to verify the mode of CPU execution at the time of SNP_INIT may lead to a potential loss of memory integrity for SNP guests.
- AMD 3rd Gen EPYC
- CWE-358
Not analysed yet 10 Jan 2023
CVE-2022-38732 CVE record

CVSS 7.5 High

SnapCenter: SnapCenter versions prior to 4.7 shipped without Content Security Policy (CSP)…
- SnapCenter
- CWE-358
Not analysed yet 29 Sept 2022
CVE-2022-2324 CVE record

Improperly Implemented Security Check vulnerability in the SonicWall Hosted Email Security leads to bypass of Capture ATP security service in the appliance.
- SonicWall Email Security
- CWE-358
Not analysed yet 29 Jul 2022
CVE-2022-27220 CVE record

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2).
- Siemens SINEMA Remote Connect Server
- CWE-358
Not analysed yet 14 Jun 2022
CVE-2022-27219 CVE record

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2).
- Siemens SINEMA Remote Connect Server
- CWE-358
Not analysed yet 14 Jun 2022
CVE-2022-25152 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

ITarian - Any user with a valid session token can create and execute agent procedures and bypass mandatory approvals
- ITarian platform (SAAS / on-premise)
- CWE-358
Not analysed yet 8 Jun 2022
org.apache.tomcat:tomcat Maven

CVSS 5.3 Medium

Inconsistent documentation in Apache Tomcat
- CWE-358
- CWE-1068
>=9.0.0.M22, <9.0.2 || >=8.5.16, <8.5.24 || >=8.0.45, <8.0.48 || >=7.0.79, <7.0.84 · fixed in 9.0.2, 8.5.24, 8.0.48, 7.0.84

GHSA-372q-33vh-8mpc · CVE-2017-15706 Not analysed yet 14 May 2022
org.jenkins-ci.main:jenkins-core Maven

CVSS 5.4 Medium

Incorrect Permission Assignment for Critical Resource in Jenkins
- Broken access control
- CWE-358
<2.32.2 || >=2.34, <2.44 · fixed in 2.32.2, 2.44

GHSA-wf9g-rh76-6jvr · CVE-2017-2612 Not analysed yet 13 May 2022
org.jenkins-ci.main:jenkins-core Maven

CVSS 4.3 Medium

Improper Authentication in Jenkins
- Authentication bypass
- CWE-358
<2.32.2 || >=2.34, <2.44 · fixed in 2.32.2, 2.44

GHSA-m93h-5qmx-pphg · CVE-2017-2604 Not analysed yet 13 May 2022
org.jenkins-ci.main:jenkins-core Maven

CVSS 4.3 Medium

Incorrect Authorization in Jenkins Core
- Broken access control
- CWE-358
<2.44 · fixed in 2.44

GHSA-3297-944x-j7x7 · CVE-2017-2611 Not analysed yet 13 May 2022
CVE-2021-42017 CVE record

CVSS 5.9 Medium

Siemens RUGGEDCOM i800: A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802…
- Siemens RUGGEDCOM i800
- Siemens RUGGEDCOM i801
- CWE-358
Not analysed yet 8 Mar 2022
CVE-2022-22156 CVE record

CVSS 6.5 Medium

Junos OS: Certificate validation is skipped when fetching system scripts from a HTTPS URL
- Juniper Networks Junos OS
- Weak cryptography or TLS
- CWE-300
Not analysed yet 19 Jan 2022
CVE-2021-34791 CVE record

CVSS 4.7 Medium

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Application Level Gateway Bypass Vulnerabilities
- Cisco Adaptive Security Appliance (ASA) Software
- CWE-358
Not analysed yet 27 Oct 2021
CVE-2021-34790 CVE record

CVSS 4.7 Medium

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Application Level Gateway Bypass Vulnerabilities
- Cisco Adaptive Security Appliance (ASA) Software
- CWE-358
Not analysed yet 27 Oct 2021
CVE-2021-31375 CVE record

CVSS 7.2 High

Junos OS: Receipt of a specific BGP update may cause RPKI policy-checks to be bypassed
- Juniper Networks Junos OS
- CWE-20
- CWE-358
Not analysed yet 19 Oct 2021
CVE-2020-10743 CVE record

Kibana: It was discovered that OpenShift Container Platform's (OCP) distribution of Kibana could…
- Kibana
- CWE-358
Not analysed yet 2 Jun 2021
CVE-2020-1761 CVE record

openshift/console: A flaw was found in the OpenShift web console…
- openshift/console
- CWE-358
Not analysed yet 27 May 2021
CVE-2021-3448 CVE record

CVSS 4.0 Medium

A flaw was found in dnsmasq in versions before 2.85.
- dnsmasq
- CWE-358
Not analysed yet 8 Apr 2021
CVE-2021-21387 CVE record

CVSS 8.1 High

Partial secret key disclosure, improper safety number calculation, & inadequate encryption strength
- parabirb wrongthink
- Weak cryptography or TLS
- CWE-358
Not analysed yet 19 Mar 2021
CVE-2020-25686 CVE record

A flaw was found in dnsmasq before version 2.83.
- dnsmasq
- CWE-358
Not analysed yet 20 Jan 2021
CVE-2020-25684 CVE record

A flaw was found in dnsmasq before version 2.83.
- dnsmasq
- CWE-358
Not analysed yet 20 Jan 2021
CVE-2020-8352 CVE record

CVSS 2.4 Low

Lenovo BIOS: In some Lenovo Desktop models, the Configuration Change Detection BIOS setting failed to…
- Lenovo BIOS
- CWE-358
Not analysed yet 11 Nov 2020
org.keycloak:keycloak-core Maven

CVSS 4.8 Medium

Improper Restriction of Rendered UI Layers or Frames in Keycloak
- CWE-358
- CWE-1021
<=9.0.3 · no fixed version yet

GHSA-3gg7-9q2x-79fc · CVE-2020-1728 Not analysed yet 15 Apr 2020
CVE-2020-7251 CVE record

CVSS 5.0 Medium

ESConfig Tool able to edit configuration for newer version
- McAfee, LLC Mcafee Endpoint Security (ENS)
- CWE-358
Not analysed yet 14 Feb 2020
CVE-2019-14823 CVE record

CVSS 6.8 Medium

Dogtag JSS: A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager…
- Dogtag JSS
- CWE-358
Not analysed yet 14 Oct 2019
CVE-2018-16860 CVE record

CVSS 7.5 High

samba: A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to…
- samba
- CWE-358
Not analysed yet 31 Jul 2019
CVE-2019-6742 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Samsung Galaxy S9: This vulnerability allows remote attackers to execute arbitrary code on vulnerable…
- Samsung Galaxy S9
- CWE-358
Not analysed yet 3 Jun 2019
CVE-2019-3894 CVE record

CVSS 5.4 Medium

Red Hat wildfly: It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in…
- Red Hat wildfly
- CWE-358
Not analysed yet 3 May 2019
CVE-2019-3806 CVE record

CVSS 5.4 Medium

An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly…
- Power DNS pdns-recursor
- CWE-358
Not analysed yet 29 Jan 2019
CVE-2018-16857 CVE record

CVSS 7.4 High

[UNKNOWN] samba: Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations watching…
- [UNKNOWN] samba
- CWE-358
Not analysed yet 28 Nov 2018
org.springframework:spring-messaging Maven

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Spring Framework has Improperly Implemented Security Check for Standard
- Code injection
- CWE-358
<4.3.16.RELEASE || >=5.0.0.RELEASE, <5.0.5.RELEASE · fixed in 4.3.16.RELEASE, 5.0.5.RELEASE

GHSA-3rmv-2pg5-xvqj · CVE-2018-1275 Not analysed yet 17 Oct 2018
org.springframework:spring-messaging Maven

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Spring Framework allows applications to expose STOMP over WebSocket endpoints
- Code injection
- CWE-358
>=5.0.0.RELEASE, <5.0.5.RELEASE || <4.3.16.RELEASE · fixed in 5.0.5.RELEASE, 4.3.16.RELEASE

GHSA-p5hg-3xm3-gcjg · CVE-2018-1270 Not analysed yet 17 Oct 2018
ansible PyPI

CVSS 6.3 Medium

Ansible apt_key module does not properly verify key fingerprint
- CWE-358
<2.2.0.0 · fixed in 2.2.0.0

GHSA-cmwx-9m2h-x7v4 · CVE-2016-8614 Not analysed yet 10 Oct 2018
marshmallow PyPI

CVSS 5.3 Medium

In marshmallow library the schema "only" option treats an empty list as implying no "only" option
- CWE-358
<2.15.1 || >=3.0a0, <3.0.0b9 · fixed in 2.15.1, 3.0.0b9

GHSA-9q2p-fj49-vpxj · CVE-2018-17175 Not analysed yet 10 Oct 2018
CVE-2018-7685 CVE record

CVSS 7.8 High

libzypp does not reevaluate malicious rpms once downloaded
- SUSE libzypp
- CWE-358
Not analysed yet 31 Aug 2018