# CWE-672.

Every Advisory and CVE whose sources give the weakness CWE-672, newest first.

## Records, newest first (an older page)

- [Suspended Directus user can continue to use session token to access API](https://agentprime.io/advisories/GHSA-56p6-qw3c-fq2g.md)
  `GHSA-56p6-qw3c-fq2g`, `CVE-2025-30351` · npm `directus` and 2 more: affected `>=10.10.0, <11.5.0`, fixed in `11.5.0` · CVSS 3.5 Low · Not analysed yet · Published 26 Mar 2025 · Tags: CWE-672
- [Dell Avamar, version 19.4 or later, contains an access token reuse vulnerability in the AUI.](https://agentprime.io/advisories/CVE-2025-21117.md)
  `CVE-2025-21117` · CVE record: Dell Avamar · CVSS 6.6 Medium · Not analysed yet · Published 5 Feb 2025 · Tags: CWE-672
- [Fortinet FortiManager: An operation on a resource after expiration or release in Fortinet FortiManager 6.4.12…](https://agentprime.io/advisories/CVE-2024-47571.md)
  `CVE-2024-47571` · CVE record: Fortinet FortiManager · CVSS 7.9 High · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-672
- [JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh in github.com/MicahParks/jwkset](https://agentprime.io/advisories/GHSA-675f-rq2r-jw82.md)
  `GHSA-675f-rq2r-jw82`, `CVE-2025-22149`, `GO-2025-3376` · Go `github.com/MicahParks/jwkset`: affected `>=0.5.0, <0.6.0`, fixed in `0.6.0` · CVSS 2.1 Low · Not analysed yet · Published 9 Jan 2025 · Tags: CWE-672
- [virtio_net: correct netdev_tx_reset_queue() invocation point](https://agentprime.io/advisories/CVE-2024-56674.md)
  `CVE-2024-56674` · CVE record: Linux Linux · CVSS 5.5 Medium · Not analysed yet · Published 27 Dec 2024 · Tags: CWE-672
- [ZITADEL Allows Unauthorized Access After Organization or Project Deactivation](https://agentprime.io/advisories/GHSA-jj94-6f5c-65r8.md)
  `GHSA-jj94-6f5c-65r8`, `CVE-2024-47060`, `GO-2024-3138` · Go `github.com/zitadel/zitadel/v2`: affected `<2.54.10 || >=2.55.0, <2.55.8 || >=2.56.0, <2.56.6 || >=2.57.0, <2.57.5 || >=2.58.0, <2.58.5 || >=2.59.0, <2.59.3 || >=2.60.0, <2.60.2 || >=2.61.0, <2.61.1 || >=2.62.0, <2.62.1`, fixed in `2.54.10`, `2.55.8`, `2.56.6`, `2.57.5`, `2.58.5`, `2.59.3`, `2.60.2`, `2.61.1`, `2.62.1` · CVSS 4.3 Medium · Not analysed yet · Published 19 Sept 2024 · Tags: Information disclosure, CWE-672
- [ZITADEL's Service Users Deactivation not Working](https://agentprime.io/advisories/GHSA-qr2h-7pwm-h393.md)
  `GHSA-qr2h-7pwm-h393`, `CVE-2024-47000`, `GO-2024-3139` · Go `github.com/zitadel/zitadel/v2`: affected `<2.54.10 || >=2.55.0, <2.55.8 || >=2.56.0, <2.56.6 || >=2.57.0, <2.57.5 || >=2.58.0, <2.58.5 || >=2.59.0, <2.59.3 || >=2.60.0, <2.60.2 || >=2.61.0, <2.61.1 || >=2.62.0, <2.62.1`, fixed in `2.54.10`, `2.55.8`, `2.56.6`, `2.57.5`, `2.58.5`, `2.59.3`, `2.60.2`, `2.61.1`, `2.62.1` · CVSS 8.1 High · Not analysed yet · Published 19 Sept 2024 · Tags: Privilege escalation, CWE-672
- [ZITADEL's User Grant Deactivation not Working](https://agentprime.io/advisories/GHSA-2w5j-qfvw-2hf5.md)
  `GHSA-2w5j-qfvw-2hf5`, `CVE-2024-46999`, `GO-2024-3137` · Go `github.com/zitadel/zitadel/v2`: affected `<2.54.10 || >=2.55.0, <2.55.8 || >=2.56.0, <2.56.6 || >=2.57.0, <2.57.5 || >=2.58.0, <2.58.5 || >=2.59.0, <2.59.3 || >=2.60.0, <2.60.2 || >=2.61.0, <2.61.1 || >=2.62.0, <2.62.1`, fixed in `2.54.10`, `2.55.8`, `2.56.6`, `2.57.5`, `2.58.5`, `2.59.3`, `2.60.2`, `2.61.1`, `2.62.1` · CVSS 7.3 High · Not analysed yet · Published 19 Sept 2024 · Tags: Privilege escalation, CWE-672
- [Qemu-kvm: virtio-pci: improper release of configure vector leads to guest triggerable crash](https://agentprime.io/advisories/CVE-2024-4693.md)
  `CVE-2024-4693` · CVE record: Red Hat Red Hat Enterprise Linux 6 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 10 May 2024 · Tags: CWE-672
- [Tokens for named pipes may be delivered after deregistration](https://agentprime.io/advisories/GHSA-r8w9-5wcg-vfj7.md)
  `GHSA-r8w9-5wcg-vfj7`, `CVE-2024-27308`, `RUSTSEC-2024-0019` · crates.io `mio`: affected `>=0.7.2, <0.8.11`, fixed in `0.8.11` · CVSS 7.5 High · Not analysed yet · Published 4 Mar 2024 · Tags: Memory corruption, CWE-672
- [Possibility to circumvent the invitation token expiry period](https://agentprime.io/advisories/GHSA-w3q8-m492-4pwp.md)
  `GHSA-w3q8-m492-4pwp`, `CVE-2023-48220` · RubyGems `decidim` and 3 more: affected `>=0.0.1.alpha3, <0.26.9 || >=0.27.0, <0.27.5`, fixed in `0.26.9`, `0.27.5` · CVSS 5.7 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: CWE-672
- [Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodon](https://agentprime.io/advisories/CVE-2024-25619.md)
  `CVE-2024-25619` · CVE record: mastodon mastodon · CVSS 3.1 Low · Not analysed yet · Published 14 Feb 2024 · Tags: Authentication bypass, CWE-672
- [Go package github.com/notaryproject/notation configured with permissive trust policies potentially susceptible to rollback attack from compromised registry](https://agentprime.io/advisories/GHSA-57wx-m636-g3g8.md)
  `GHSA-57wx-m636-g3g8`, `CVE-2024-23332`, `GO-2024-2472` · Go `github.com/notaryproject/notation`: affected `<=1.0.0`, no fixed version yet · CVSS 4.0 Medium · Not analysed yet · Published 19 Jan 2024 · Tags: CWE-672
- [x86/AMD: missing IOMMU TLB flushing](https://agentprime.io/advisories/CVE-2023-34326.md)
  `CVE-2023-34326` · CVE record: Xen Xen · CVSS 7.8 High · Not analysed yet · Published 5 Jan 2024 · Tags: CWE-672
- [Pow Mnesia cache doesn't invalidate all expired keys on startup](https://agentprime.io/advisories/GHSA-3cjh-p6pw-jhv9.md)
  `GHSA-3cjh-p6pw-jhv9`, `CVE-2023-42446` · Hex `pow`: affected `>=1.0.14, <1.0.34`, fixed in `1.0.34` · CVSS 6.5 Medium · Not analysed yet · Published 19 Sept 2023 · Tags: CWE-298, CWE-672
- [HCI send_sync Dangling Semaphore Reference Re-use](https://agentprime.io/advisories/CVE-2023-1901.md)
  `CVE-2023-1901` · CVE record: zephyrproject-rtos Zephyr · CVSS 5.9 Medium · Not analysed yet · Published 10 Jul 2023 · Tags: CWE-672
- [HCI Connection Creation Dangling State Reference Re-use](https://agentprime.io/advisories/CVE-2023-1902.md)
  `CVE-2023-1902` · CVE record: zephyrproject-rtos Zephyr · CVSS 5.9 Medium · Not analysed yet · Published 10 Jul 2023 · Tags: CWE-672
- [Mozilla Firefox: By using XSL Transforms, a malicious webserver could have served a user an XSL document…](https://agentprime.io/advisories/CVE-2022-22755.md)
  `CVE-2022-22755` · CVE record: Mozilla Firefox · CVSS 8.8 High · Not analysed yet · Published 22 Dec 2022 · Tags: CWE-672
- [User invites for Funkwhale v1.2.8 do not permanently expire after being used for signup and can be used again after an account has been deleted.](https://agentprime.io/advisories/CVE-2022-45292.md)
  `CVE-2022-45292` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 9 Dec 2022 · Tags: CWE-672
- [An issue was discovered in MaraDNS Deadwood through 3.5.0021 that allows variant V1 of unintended domain name resolution.](https://agentprime.io/advisories/CVE-2022-30256.md)
  `CVE-2022-30256` · CVE record · CVSS 7.5 High · Not analysed yet · Published 18 Nov 2022 · Tags: CWE-672
- [Intel(R) SGX SDK software: Premature release of resource during expected lifetime in the Intel(R) SGX SDK software…](https://agentprime.io/advisories/CVE-2022-27499.md)
  `CVE-2022-27499` · CVE record: Intel(R) SGX SDK software · CVSS 2.5 Low · Not analysed yet · Published 11 Nov 2022 · Tags: CWE-672
- [A heap double free issue was found in Opensc before version 0.22.0 in sc_pkcs15_free_tokeninfo.](https://agentprime.io/advisories/CVE-2021-42778.md)
  `CVE-2021-42778` · CVE record: opensc · No CVSS score · Not analysed yet · Published 18 Apr 2022 · Tags: CWE-672
- [Junos OS and Junos OS Evolved: An rpd core will be observed with proxy BGP route-target filtering enabled and certain route add and delete event happening](https://agentprime.io/advisories/CVE-2022-22197.md)
  `CVE-2022-22197` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 7.5 High · Not analysed yet · Published 14 Apr 2022 · Tags: CWE-672
- [Siemens SIMATIC Drive Controller family: A vulnerability has been identified in SIMATIC Drive Controller family (All versions <…](https://agentprime.io/advisories/CVE-2021-37204.md)
  `CVE-2021-37204` · CVE record: Siemens SIMATIC Drive Controller family and 4 more · CVSS 7.5 High · Not analysed yet · Published 9 Feb 2022 · Tags: CWE-672
- [Siemens SIMATIC Drive Controller family: A vulnerability has been identified in SIMATIC Drive Controller family (All versions >=…](https://agentprime.io/advisories/CVE-2021-37185.md)
  `CVE-2021-37185` · CVE record: Siemens SIMATIC Drive Controller family and 4 more · CVSS 7.5 High · Not analysed yet · Published 9 Feb 2022 · Tags: CWE-672
- [Update unsound DrainFilter and RString::retain](https://agentprime.io/advisories/GHSA-vq23-5h4f-vwpv.md)
  `GHSA-vq23-5h4f-vwpv`, `CVE-2020-36212`, `CVE-2020-36213`, `GHSA-wqxc-qrq4-w5v4`, `RUSTSEC-2020-0105` · crates.io `abi_stable`: affected `<0.9.1`, fixed in `0.9.1` · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2021 · Tags: CWE-672
- [receiving subscription objects with deleted session](https://agentprime.io/advisories/GHSA-2xm2-xj2q-qgpj.md)
  `GHSA-2xm2-xj2q-qgpj`, `BIT-parse-2020-15270`, `CVE-2020-15270` · npm `parse-server`: affected `<4.4.0`, fixed in `4.4.0` · CVSS 4.3 Medium · Not analysed yet · Published 27 Oct 2020 · Tags: CWE-672
- [Operation on a Resource after Expiration or Release in Jetty Server](https://agentprime.io/advisories/GHSA-x3rh-m7vp-35f2.md)
  `GHSA-x3rh-m7vp-35f2`, `CVE-2019-17638` · Maven `org.eclipse.jetty:jetty-server`: affected `>=9.4.27, <9.4.30.v20200611`, fixed in `9.4.30.v20200611` · CVSS 9.4 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.11 · Not analysed yet · Published 5 Aug 2020 · Tags: CWE-672, CWE-675
- [The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when configured for wireless networking the FTP service operating on the WBM remains operational until the WBM is rebooted.](https://agentprime.io/advisories/CVE-2020-12043.md)
  `CVE-2020-12043` · CVE record: Baxter Sigma Spectrum Infusion Pumps · No CVSS score · Not analysed yet · Published 29 Jun 2020 · Tags: CWE-672
- [Password reset links invalidation issue in WordPress](https://agentprime.io/advisories/CVE-2020-11027.md)
  `CVE-2020-11027` · CVE record: WordPress WordPress · CVSS 6.1 Medium · EPSS 0.14 · Not analysed yet · Published 30 Apr 2020 · Tags: CWE-672
- [Reference counting error in overlayfs/shiftfs error path when used in conjuction with aufs](https://agentprime.io/advisories/CVE-2019-15794.md)
  `CVE-2019-15794` · CVE record: Ubuntu Linux kernel · CVSS 7.1 High · Not analysed yet · Published 23 Apr 2020 · Tags: CWE-672
- [Reference count underflow in shiftfs](https://agentprime.io/advisories/CVE-2019-15791.md)
  `CVE-2019-15791` · CVE record: Ubuntu Shiftfs in the Linux kernel · CVSS 7.1 High · Not analysed yet · Published 23 Apr 2020 · Tags: CWE-672

Newest: <https://agentprime.io/advisories/tag/cwe-672.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-672&cursor=WyIyMDI1LTAzLTMxVDE2OjEzOjM0LjAwMDAwMFoiLCJHSFNBLTY3cjUtcnF3di05cDlxIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-672/?cursor=WyIyMDI1LTAzLTMxVDE2OjEzOjM0LjAwMDAwMFoiLCJHSFNBLTY3cjUtcnF3di05cDlxIl0>. Everything for agents: <https://agentprime.io/llms.txt>.