# CWE-657.

Every Advisory and CVE whose sources give the weakness CWE-657, newest first.

## Records, newest first

- [Adobe Campaign Classic (ACC) | Violation of Secure Design Principles (CWE-657)](https://agentprime.io/advisories/CVE-2026-48399.md)
  `CVE-2026-48399` · CVE record: Adobe Adobe Campaign Classic · CVSS 7.5 High · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-657
- [PraisonAI has sandbox escape via exception frame traversal in \`execute_code\` (subprocess mode)](https://agentprime.io/advisories/GHSA-qf73-2hrx-xprp.md)
  `GHSA-qf73-2hrx-xprp`, `CVE-2026-39888`, `PYSEC-2026-486` · PyPI `praisonaiagents`: affected `<1.5.115`, fixed in `1.5.115` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: CWE-657, CWE-693
- [Acrobat Reader | Violation of Secure Design Principles (CWE-657)](https://agentprime.io/advisories/CVE-2025-54255.md)
  `CVE-2025-54255` · CVE record: Adobe Acrobat Reader · CVSS 4.0 Medium · Not analysed yet · Published 9 Sept 2025 · Tags: CWE-657
- [OpenCTI is an open-source cyber threat intelligence platform. In versions starting from 6.4.8 to before 6.4.10, the allow/deny lists can be bypassed, allowing a user to change attributes that are i...](https://agentprime.io/advisories/GHSA-8262-pw2q-5qc3.md)
  `GHSA-8262-pw2q-5qc3`, `CVE-2025-24887`, `PYSEC-2025-178` · PyPI `pycti`: affected `>=6.4.9, <6.4.11`, fixed in `6.4.11` · CVSS 6.3 Medium · Not analysed yet · Published 30 Apr 2025 · Tags: Broken access control, CWE-657
- [Vulnerability of improper log information control in the UI framework module Impact: Successful exploitation of this vulnerability may affect service confidentiality.](https://agentprime.io/advisories/CVE-2024-57957.md)
  `CVE-2024-57957` · CVE record: Huawei HarmonyOS · CVSS 6.6 Medium · Not analysed yet · Published 6 Feb 2025 · Tags: CWE-657
- [ci solution CI-Out-of-Office Manager through 6.0.0.77 uses a Hard-coded Cryptographic Key.](https://agentprime.io/advisories/CVE-2024-33849.md)
  `CVE-2024-33849` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 28 May 2024 · Tags: Hard-coded credentials, CWE-657
- [OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Due to lack of certain security controls on the profile edit functiona...](https://agentprime.io/advisories/GHSA-qx4j-f4f2-vjw9.md)
  `GHSA-qx4j-f4f2-vjw9`, `CVE-2024-26139`, `PYSEC-2024-296` · PyPI `pycti`: affected `<5.12.32`, fixed in `5.12.32` · CVSS 8.3 High · Not analysed yet · Published 23 May 2024 · Tags: Broken access control, CWE-657
- [Passbolt Api Tabnabbing when opening URI with menu "Open URI in a new tab"](https://agentprime.io/advisories/GHSA-qm5v-pj64-852j.md)
  `GHSA-qm5v-pj64-852j`, `PKSA-kr8c-3bqr-5ndv` · Packagist `passbolt/passbolt_api`: affected `<2.11.0`, fixed in `2.11.0` · CVSS 5.5 Medium · Not analysed yet · Published 20 May 2024 · Tags: CWE-657
- [Vulnerability of defects introduced in the design process in the hwnff module.](https://agentprime.io/advisories/CVE-2023-52714.md)
  `CVE-2023-52714` · CVE record: Huawei HarmonyOS and 1 more · CVSS 7.5 High · Not analysed yet · Published 7 Apr 2024 · Tags: CWE-657
- [ZDI-CAN-20712: Adobe Acrobat Blacklist Bypass Design flaw](https://agentprime.io/advisories/CVE-2023-29320.md)
  `CVE-2023-29320` · CVE record: Adobe Acrobat Reader · CVSS 7.8 High · Not analysed yet · Published 10 Aug 2023 · Tags: CWE-657
- [AEM Violation of Secure Design Principles Security feature bypass](https://agentprime.io/advisories/CVE-2022-30683.md)
  `CVE-2022-30683` · CVE record: Adobe Experience Manager · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2022 · Tags: CWE-657
- [Magento Violation of Secure Design Principles vulnerability in RMA PDF filename formats](https://agentprime.io/advisories/GHSA-7gh6-f4jh-3crq.md)
  `GHSA-7gh6-f4jh-3crq`, `BIT-magento-2021-28583`, `CVE-2021-28583`, `PKSA-1s1d-4jtm-mgtx`, `PKSA-n22f-w4n6-g3fx` · Packagist `magento/community-edition` and 1 more: affected `<2.3.7 || >=2.4.0, <2.4.2-p1`, fixed in `2.3.7`, `2.4.2-p1` · CVSS 7.5 High · Not analysed yet · Published 24 May 2022 · Tags: CWE-657
- [Adobe Acrobat Reader DC CSP Bypass Leads To Privilege Escalation](https://agentprime.io/advisories/CVE-2022-28244.md)
  `CVE-2022-28244` · CVE record: Adobe Acrobat Reader · CVSS 6.3 Medium · Not analysed yet · Published 11 May 2022 · Tags: CWE-657
- [Adobe Acrobat Reader Missing Custom Protocols in Warning Message Prompts](https://agentprime.io/advisories/CVE-2021-44714.md)
  `CVE-2021-44714` · CVE record: Adobe Acrobat Reader · CVSS 2.5 Low · Not analysed yet · Published 14 Jan 2022 · Tags: CWE-657
- [Adobe Connect Violation of Secure Design Principles Vulnerability Can Lead To Editing Or Deleting Recordings](https://agentprime.io/advisories/CVE-2021-36061.md)
  `CVE-2021-36061` · CVE record: Adobe Connect · CVSS 5.4 Medium · Not analysed yet · Published 1 Sept 2021 · Tags: CWE-657
- [Multiple soundness issues in cgc](https://agentprime.io/advisories/GHSA-f3mq-99jr-ww4r.md)
  `GHSA-f3mq-99jr-ww4r`, `CVE-2020-36466`, `CVE-2020-36467`, `CVE-2020-36468`, `GHSA-f9xr-3m55-5q2v`, `GHSA-pwhf-7427-9vv2`, `RUSTSEC-2020-0148` · crates.io `cgc`: affected `<=0.4.0`, no fixed version yet · CVSS 5.9 Medium · Not analysed yet · Published 25 Aug 2021 · Tags: CWE-657
- [fake-static allows converting any reference into a \`'static\` reference](https://agentprime.io/advisories/GHSA-8xw8-mmqv-frqq.md)
  `GHSA-8xw8-mmqv-frqq`, `RUSTSEC-2020-0013` · crates.io `fake-static`: affected `<=0.1.0`, no fixed version yet · No CVSS score · Not analysed yet · Published 25 Aug 2021 · Tags: CWE-657
- [Nextcloud Server: A wrong generation of the passphrase for the encrypted block in Nextcloud Server 19.0.1…](https://agentprime.io/advisories/CVE-2020-8133.md)
  `CVE-2020-8133` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 9 Nov 2020 · Tags: CWE-657
- [Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextcloud services when search e.g. for federated users or registering for push notific…](https://agentprime.io/advisories/CVE-2019-15611.md)
  `CVE-2019-15611` · CVE record: Nextcloud iOS · No CVSS score · Not analysed yet · Published 4 Feb 2020 · Tags: CWE-657
- [Junos OS: Insecure management daemon (MGD) configuration may allow local privilege escalation](https://agentprime.io/advisories/CVE-2019-0061.md)
  `CVE-2019-0061` · CVE record: Juniper Networks Junos OS · CVSS 7.8 High · Not analysed yet · Published 9 Oct 2019 · Tags: CWE-657
- [A weakness was found in Encrypt Only boot mode in Zynq UltraScale+ devices.](https://agentprime.io/advisories/CVE-2019-5478.md)
  `CVE-2019-5478` · CVE record: Zynq UltraScale+ SoC · No CVSS score · Not analysed yet · Published 3 Sept 2019 · Tags: CWE-657
- [Schneider Electric Modicon Modbus Protocol: A Violation of Secure Design Principles issue was discovered in Schneider Electric…](https://agentprime.io/advisories/CVE-2017-6032.md)
  `CVE-2017-6032` · CVE record: Schneider Electric Modicon Modbus Protocol · No CVSS score · Not analysed yet · Published 30 Jun 2017 · Tags: CWE-657

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-657>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-657/>. Everything for agents: <https://agentprime.io/llms.txt>.