# CWE-642.

Every Advisory and CVE whose sources give the weakness CWE-642, newest first.

## Records, newest first

- [Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters](https://agentprime.io/advisories/CVE-2026-50053.md)
  `CVE-2026-50053` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 8.7 High · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-642
- [This issue was addressed through improved state management.](https://agentprime.io/advisories/CVE-2026-84518.md)
  `CVE-2026-84518` · CVE record: Apple Safari and 2 more · CVSS 4.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-642
- [An information disclosure issue was addressed with improved state management.](https://agentprime.io/advisories/CVE-2026-65355.md)
  `CVE-2026-65355` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 4.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-642
- [An information disclosure issue was addressed with improved state management.](https://agentprime.io/advisories/CVE-2026-65352.md)
  `CVE-2026-65352` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 4.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-642
- [Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session](https://agentprime.io/advisories/CVE-2026-78655.md)
  `CVE-2026-78655` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass, CWE-642
- [Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor](https://agentprime.io/advisories/GHSA-h468-7pvh-8vr8.md)
  `GHSA-h468-7pvh-8vr8`, `BIT-tomcat-2026-29146`, `CVE-2026-29146` · Maven `org.apache.tomcat:tomcat` and 1 more: affected `>=9.0.13, <9.0.116 || >=10.1.50, <10.1.53 || >=11.0.0-M1, <11.0.20 || >=8.5.38, <=8.5.100 || >=7.0.100, <=7.0.109`, fixed in `9.0.116`, `10.1.53`, `11.0.20` · CVSS 7.5 High · Not analysed yet · Published 9 Apr 2026 · Tags: Information disclosure, CWE-642, CWE-1240
- [OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution](https://agentprime.io/advisories/GHSA-rvqr-hrcc-j9vv.md)
  `GHSA-rvqr-hrcc-j9vv`, `CVE-2026-35659` · npm `openclaw`: affected `<2026.3.22`, fixed in `2026.3.22` · CVSS 5.1 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-345, CWE-642
- [An error in the SignServer container startup logic was found in Keyfactor SignServer versions prior to 7.2.](https://agentprime.io/advisories/CVE-2025-26787.md)
  `CVE-2025-26787` · CVE record · CVSS 4.7 Medium · Not analysed yet · Published 22 Dec 2025 · Tags: CWE-642
- [Matrix specification: The Matrix specification before 1.16 (i.e…](https://agentprime.io/advisories/CVE-2025-49090.md)
  `CVE-2025-49090` · CVE record: Matrix Matrix specification · CVSS 7.1 High · Not analysed yet · Published 2 Oct 2025 · Tags: CWE-642
- [Duplicate Advisory: Unauthenticated Nonce Increment in snow](https://agentprime.io/advisories/GHSA-97f8-h76h-f297.md)
  `GHSA-97f8-h76h-f297` · crates.io `snow`: affected `<0.9.5`, fixed in `0.9.5` · CVSS 3.1 Low · Withdrawn · Not analysed yet · Published 28 Jul 2025 · Tags: CWE-642
- [QEMU: hw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration state inconsistency…](https://agentprime.io/advisories/CVE-2025-54566.md)
  `CVE-2025-54566` · CVE record: QEMU QEMU · CVSS 4.2 Medium · Not analysed yet · Published 25 Jul 2025 · Tags: CWE-642
- [External Control of Critical State Data in GitLab](https://agentprime.io/advisories/CVE-2024-8754.md)
  `CVE-2024-8754` · CVE record: GitLab GitLab · CVSS 6.4 Medium · Not analysed yet · Published 12 Sept 2024 · Tags: CWE-642
- [Gallagher Controller 6000 and Controller 7000: External Control of Critical State Data (CWE-642) in the Controller 6000 and Controller…](https://agentprime.io/advisories/CVE-2024-22387.md)
  `CVE-2024-22387` · CVE record: Gallagher Controller 6000 and Controller 7000 · CVSS 6.8 Medium · Not analysed yet · Published 11 Jul 2024 · Tags: CWE-642
- [Unauthenticated Nonce Increment in snow](https://agentprime.io/advisories/GHSA-7g9j-g5jg-3vv3.md)
  `GHSA-7g9j-g5jg-3vv3`, `CVE-2024-58265`, `RUSTSEC-2024-0011` · crates.io `snow`: affected `>=0.0.0-0, <0.9.5`, fixed in `0.9.5` · CVSS 3.1 Low · Not analysed yet · Published 23 Jan 2024 · Tags: CWE-642
- [Remote Code Execution](https://agentprime.io/advisories/CVE-2023-0575.md)
  `CVE-2023-0575` · CVE record: YugabyteDB YugabyteDB · CVSS 7.2 High · Not analysed yet · Published 9 Feb 2023 · Tags: Code injection, CWE-642
- [A logic issue was addressed with improved state management.](https://agentprime.io/advisories/CVE-2022-32859.md)
  `CVE-2022-32859` · CVE record: Apple iOS · CVSS 5.3 Medium · Not analysed yet · Published 1 Nov 2022 · Tags: CWE-642
- [Junos Fusion: A Satellite Device can be controlled by rewiring it to a foreign AD causing a DoS](https://agentprime.io/advisories/CVE-2022-22154.md)
  `CVE-2022-22154` · CVE record: Juniper Networks Junos OS · CVSS 6.8 Medium · Not analysed yet · Published 19 Jan 2022 · Tags: CWE-642
- [NETGEAR R7450: This vulnerability allows network-adjacent attackers to bypass authentication on affected…](https://agentprime.io/advisories/CVE-2020-27872.md)
  `CVE-2020-27872` · CVE record: NETGEAR R7450 · CVSS 8.8 High · Not analysed yet · Published 4 Feb 2021 · Tags: CWE-642
- [Dell Inspiron 5675 BIOS versions prior to 1.4.1 contain a UEFI BIOS RuntimeServices overwrite vulnerability.](https://agentprime.io/advisories/CVE-2020-26186.md)
  `CVE-2020-26186` · CVE record: Dell CPG BIOS · CVSS 6.8 Medium · Not analysed yet · Published 8 Jan 2021 · Tags: CWE-642
- [GlobalProtect on MacOS: Local denial-of-service (DoS) vulnerability.](https://agentprime.io/advisories/CVE-2020-1976.md)
  `CVE-2020-1976` · CVE record: Palo Alto Networks GlobalProtect · CVSS 4.7 Medium · Not analysed yet · Published 12 Feb 2020 · Tags: CWE-642
- [An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps](https://agentprime.io/advisories/CVE-2019-9496.md)
  `CVE-2019-9496` · CVE record: Wi-Fi Alliance hostapd with SAE support and 1 more · No CVSS score · Not analysed yet · Published 17 Apr 2019 · Tags: CWE-642
- [Cisco HyperFlex Software Static Signing Key Vulnerability](https://agentprime.io/advisories/CVE-2018-15382.md)
  `CVE-2018-15382` · CVE record: Cisco Cisco HyperFlex HX-Series · No CVSS score · Not analysed yet · Published 5 Oct 2018 · Tags: CWE-642
- [Bypassing Sanitization using DOM clobbering in html-janitor](https://agentprime.io/advisories/GHSA-fx46-whrj-73v5.md)
  `GHSA-fx46-whrj-73v5`, `CVE-2017-0928` · npm `html-janitor`: affected `*`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 24 Jul 2018 · Tags: CWE-547, CWE-642

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-642>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-642/>. Everything for agents: <https://agentprime.io/llms.txt>.