Advisories · Weakness
CWE-642.
Every Advisory and CVE whose sources give the weakness CWE-642, newest first.
- CVSS 8.7 High
Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters
- Zimbra Collaboration Suite
- CWE-642
- CVSS 4.3 Medium
This issue was addressed through improved state management.
- Apple Safari
- Apple iOS and iPadOS
- CWE-642
- CVSS 4.3 Medium
An information disclosure issue was addressed with improved state management.
- Apple iOS and iPadOS
- Apple macOS
- CWE-642
- CVSS 4.3 Medium
An information disclosure issue was addressed with improved state management.
- Apple iOS and iPadOS
- Apple macOS
- CWE-642
- CVSS 9.1 CriticalCritical · CVSS 9+
Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session
- Authentication bypass
- CWE-642
- CVSS 7.5 High
Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor
- Information disclosure
- CWE-642
>=9.0.13, <9.0.116 || >=10.1.50, <10.1.53 || >=11.0.0-M1, <11.0.20 || >=8.5.38, <=8.5.100 || >=7.0.100, <=7.0.109 · fixed in 9.0.116, 10.1.53, 11.0.20
GHSA-h468-7pvh-8vr8 · CVE-2026-29146 - CVSS 5.1 Medium
OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution
- CWE-345
- CWE-642
<2026.3.22 · fixed in 2026.3.22
GHSA-rvqr-hrcc-j9vv · CVE-2026-35659 - CVSS 4.7 Medium
An error in the SignServer container startup logic was found in Keyfactor SignServer versions prior to 7.2.
- CWE-642
- CVSS 7.1 High
Matrix specification: The Matrix specification before 1.16 (i.e…
- Matrix specification
- CWE-642
- CVSS 3.1 Low
Duplicate Advisory: Unauthenticated Nonce Increment in snow
- CWE-642
<0.9.5 · fixed in 0.9.5
GHSA-97f8-h76h-f297 - CVSS 4.2 Medium
QEMU: hw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration state inconsistency…
- QEMU
- CWE-642
- CVSS 6.4 Medium
External Control of Critical State Data in GitLab
- GitLab
- CWE-642
- CVSS 6.8 Medium
Gallagher Controller 6000 and Controller 7000: External Control of Critical State Data (CWE-642) in the Controller 6000 and Controller…
- Gallagher Controller 6000 and Controller 7000
- CWE-642
- CVSS 3.1 Low
Unauthenticated Nonce Increment in snow
- CWE-642
>=0.0.0-0, <0.9.5 · fixed in 0.9.5
GHSA-7g9j-g5jg-3vv3 · CVE-2024-58265 - CVSS 7.2 High
Remote Code Execution
- YugabyteDB
- Code injection
- CWE-642
- CVSS 5.3 Medium
A logic issue was addressed with improved state management.
- Apple iOS
- CWE-642
- CVSS 6.8 Medium
Junos Fusion: A Satellite Device can be controlled by rewiring it to a foreign AD causing a DoS
- Juniper Networks Junos OS
- CWE-642
- CVSS 8.8 High
NETGEAR R7450: This vulnerability allows network-adjacent attackers to bypass authentication on affected…
- NETGEAR R7450
- CWE-642
- CVSS 6.8 Medium
Dell Inspiron 5675 BIOS versions prior to 1.4.1 contain a UEFI BIOS RuntimeServices overwrite vulnerability.
- Dell CPG BIOS
- CWE-642
- CVSS 4.7 Medium
GlobalProtect on MacOS: Local denial-of-service (DoS) vulnerability.
- Palo Alto Networks GlobalProtect
- CWE-642
-
An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps
- Wi-Fi Alliance hostapd with SAE support
- Wi-Fi Alliance wpa_supplicant with SAE support
- CWE-642
-
Cisco HyperFlex Software Static Signing Key Vulnerability
- Cisco HyperFlex HX-Series
- CWE-642
- CVSS 6.1 Medium
Bypassing Sanitization using DOM clobbering in html-janitor
- CWE-547
- CWE-642
* · no fixed version yet
GHSA-fx46-whrj-73v5 · CVE-2017-0928