CWE-670.

ismp-grandpa crate accepted incorrect signatures

• Weak cryptography or TLS
• CWE-670

<0.1.2 · fixed in 0.1.2

Vyper Does Not Check the Success of Certain Precompile Calls

• CWE-670
• CWE-703

* · no fixed version yet

HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset in envoy

• envoy
• CWE-670

HTTP/1: sending overload crashes when the request is reset beforehand in envoy

• envoy
• CWE-670

Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting in envoy

• envoy
• CWE-670

pmdomain: imx93-blk-ctrl: correct remove path

• Linux kernel
• CWE-670

Acks not validated before logged to qlog leads to buffer overflow in ngtcp2

• ngtcp2
• CWE-670

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a control flow vulnerability

• HCL Software HCL Traveler for Microsoft Outlook (HTMO)
• CWE-670

H2O ignores headers configuration directives

• h2o
• CWE-670

In Gradio, the `enable_monitoring` flag set to `False` does not disable monitoring

• CWE-670

<4.44.0 · fixed in 4.44.0

btcd did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality

• CWE-670

<0.24.2-beta.rc1 · fixed in 0.24.2-beta.rc1

Runtime crash when combining tail calls with stack traces

• CWE-670

>=21.0.0, <21.0.2 || >=22.0.0, <22.0.1 || >=23.0.0, <23.0.3 || >=24.0.0, <24.0.1 || >=25.0.0, <25.0.2 · fixed in 21.0.2, 22.0.1, 23.0.3, 24.0.1, 25.0.2

oghttp2 crash on OnBeginHeadersForStream in envoy

• envoy
• CWE-670

Disabled user can bypass lockout by requesting password reset in wiki.js

• requarks wiki
• CWE-670

Denial of service in quinn-proto when using `Endpoint::retry()`

• CWE-670

>=0.11.0, <0.11.7 · fixed in 0.11.7

OwnableTwoStep allows a pending owner to accept ownership after the original owner has renounced ownership in cairo-contracts

• OpenZeppelin cairo-contracts
• CWE-670

Rockwell Automation Multicast Request Causes major nonrecoverable fault on Select Controllers

• Rockwell Automation ControlLogix® 5580
• Rockwell Automation GuardLogix 5580
• CWE-670

Keycloak's improper input validation allows using email as username

• CWE-20
• CWE-670

<24.0.1 · fixed in 24.0.1

Contract balance not updating correctly after interchain transaction

• CWE-670

<18.1.0 · fixed in 18.1.0

Requests `Session` object does not verify requests after making first request with verify=False

• CWE-670

<2.32.0 · fixed in 2.32.0

Asterisk' res_pjsip_endpoint_identifier_ip: wrongly matches ALL unauthorized SIP requests

• asterisk
• Authentication bypass
• CWE-480

eZ Platform Rules to disable executable access are ignored on Platform.sh (eZ Cloud)

• CWE-670

>=1.7.0, <1.7.9.1 || >=1.13.0, <1.13.5.1 || >=2.5.0, <2.5.4 · fixed in 1.7.9.1, 1.13.5.1, 2.5.4

Tor path lengths too short when "Vanguards lite" configured

• CWE-130
• CWE-670

>=0.18.0, <0.18.1 · fixed in 0.18.1

Apollo Router vulnerable to Critical Regression In Query Plan Cache

• CWE-440
• CWE-670

>=1.44.0, <1.45.1 · fixed in 1.45.1

An issue in phiola/src/afilter/conv.c:115 of phiola v2.0-rc22 allows a remote attacker to cause a denial of service via a crafted .wav file.

• CWE-670

Tuleap deleting or moving an artifact can delete values from unrelated artifacts

• Enalean tuleap
• CWE-440
• CWE-670

A malicious insider exploiting this vulnerability can circumvent existing security controls put in place by the organization.

• Skyhigh Client Proxy
• CWE-670

OpenZeppelin Contracts and Contracts Upgradeable duplicated execution of subcalls in v4.9.4

• CWE-670

>=4.9.4, <4.9.5 · fixed in 4.9.5

Fiber unauthorized access vulnerability in `ctx.IsFromLocal()`

• CWE-670

<=1.14.6 · no fixed version yet

Electron's Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled

• CWE-670

>=22.0.0-beta.1, <22.0.1 || >=23.0.0-alpha.1, <23.0.0-alpha.2 · fixed in 22.0.1, 23.0.0-alpha.2

Trigger `beforeFind` not invoked in internal query pipeline when fetching pointer

• CWE-670

>=1.0.0, <5.5.5 || >=6.0.0, <6.2.2 · fixed in 5.5.5, 6.2.2

incorrect order of evaluation of side effects for some builtins

• CWE-670

<0.3.10 · fixed in 0.3.10

Vyper: reversed order of side effects for some operations

• CWE-670

<=0.4.2 · no fixed version yet

Nokia Service Router Operating System (SR OS) 22.10 and SR Linux, when error-handling update-fault-tolerance is not enabled, mishandle BGP path attributes.

• CWE-670

Incorrect control flow in Jenkins Gradle Plugin breaks credentials masking in the build log

• CWE-670

<2.8.1 · fixed in 2.8.1

Vyper's nonpayable default functions are sometimes payable

• CWE-670

<0.3.8 · fixed in 0.3.8

Incorrect success value returned in vyper

• CWE-670

>=0.3.1, <0.3.8 · fixed in 0.3.8

An issue was discovered in ONOS 2.5.1.

• CWE-670

An issue was discovered in ONOS 2.5.1.

• CWE-670

An issue was discovered in ONOS 2.5.1.

• CWE-670

Stargate-Bukkit improperly handles vehicles causing data duplication.

• Stargate-Bukkit
• CWE-670

A flaw was found in openvswitch (OVS).

• openvswitch
• CWE-670

Always Incorrect Control Flow Implementation in MODEM

• Qualcomm, Inc. Snapdragon
• CWE-670

Insufficient control flow management in AmdCpmOemSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to an escalation of privileges.

• AMD Ryzen™ 2000 Series
• AMD Ryzen™ 3000 Series
• CWE-670

The protection bypass vulnerability in DLP for Windows 11.9.x is addressed in version 11.10.0.

• Trellix Data Loss Prevention (DLP)
• CWE-670

Android: In onPackageRemoved of AccessibilityManagerService.java…

• Android
• CWE-670

Android: In addOrReplacePhoneAccount of PhoneAccountRegistrar.java…

• Android
• CWE-670

bt: host: Wrong key validation check

• zephyr
• CWE-670

Seg fault in `ndarray_tensor_bridge` due to zero and large inputs

• CWE-670

<2.8.4 || >=2.9.0, <2.9.3 || >=2.10.0, <2.10.1 · fixed in 2.8.4, 2.9.3, 2.10.1

Hyperledger Fabric 2.3 allows attackers to cause a denial of service (orderer crash) by repeatedly sending a crafted channel tx with the same Channel name.

• CWE-670

Incorrect is_static parameter for custom stateful precompiles in SputnikVM (evm)

• CWE-670

<0.36.0 · fixed in 0.36.0

In vow, there is a possible undefined behavior due to an API misuse.

• MediaTek, Inc. MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6889, MT6893, MT6895, MT6983, MT8791, MT8797
• CWE-670

Solana Pay Vulnerable to Weakness in Transfer Validation Logic

• CWE-670

<0.2.1 · fixed in 0.2.1

Discrepency in transfer value and actual value due to incorrect truncation in Frontier

• paritytech frontier
• CWE-670

Incorrect handling of invalid surrogate pair characters

• CWE-670

<5.4.0 · fixed in 5.4.0

Expression Always True vulnerability in Zulip Server

• zulip
• CWE-571
• CWE-670

Multiple evaluation of contract address in call in vyper

• CWE-670

<0.3.4 · fixed in 0.3.4

bson-objectid contains Improper input validation

• CWE-20
• CWE-670

<=1.3.0 · no fixed version yet

Always-Incorrect Control Flow Implementation in Facebook Hermes

• CWE-670
• CWE-1119

<0.7.2 · fixed in 0.7.2

F5 BIG-IP Advanced WAF, ASM, and APM: On F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1…

• F5 BIG-IP Advanced WAF, ASM, and APM
• CWE-670