CWE-672.

Suspended Directus user can continue to use session token to access API

• CWE-672

>=10.10.0, <11.5.0 · fixed in 11.5.0

Dell Avamar, version 19.4 or later, contains an access token reuse vulnerability in the AUI.

• Dell Avamar
• CWE-672

Fortinet FortiManager: An operation on a resource after expiration or release in Fortinet FortiManager 6.4.12…

• Fortinet FortiManager
• CWE-672

JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh in github.com/MicahParks/jwkset

• CWE-672

>=0.5.0, <0.6.0 · fixed in 0.6.0

virtio_net: correct netdev_tx_reset_queue() invocation point

• Linux kernel
• CWE-672

ZITADEL Allows Unauthorized Access After Organization or Project Deactivation

• Information disclosure
• CWE-672

<2.54.10 || >=2.55.0, <2.55.8 || >=2.56.0, <2.56.6 || >=2.57.0, <2.57.5 || >=2.58.0, <2.58.5 || >=2.59.0, <2.59.3 || >=2.60.0, <2.60.2 || >=2.61.0, <2.61.1 || >=2.62.0, <2.62.1 · fixed in 2.54.10, 2.55.8, 2.56.6, 2.57.5, 2.58.5, 2.59.3, 2.60.2, 2.61.1, 2.62.1

ZITADEL's Service Users Deactivation not Working

• Privilege escalation
• CWE-672

<2.54.10 || >=2.55.0, <2.55.8 || >=2.56.0, <2.56.6 || >=2.57.0, <2.57.5 || >=2.58.0, <2.58.5 || >=2.59.0, <2.59.3 || >=2.60.0, <2.60.2 || >=2.61.0, <2.61.1 || >=2.62.0, <2.62.1 · fixed in 2.54.10, 2.55.8, 2.56.6, 2.57.5, 2.58.5, 2.59.3, 2.60.2, 2.61.1, 2.62.1

ZITADEL's User Grant Deactivation not Working

• Privilege escalation
• CWE-672

<2.54.10 || >=2.55.0, <2.55.8 || >=2.56.0, <2.56.6 || >=2.57.0, <2.57.5 || >=2.58.0, <2.58.5 || >=2.59.0, <2.59.3 || >=2.60.0, <2.60.2 || >=2.61.0, <2.61.1 || >=2.62.0, <2.62.1 · fixed in 2.54.10, 2.55.8, 2.56.6, 2.57.5, 2.58.5, 2.59.3, 2.60.2, 2.61.1, 2.62.1

Qemu-kvm: virtio-pci: improper release of configure vector leads to guest triggerable crash

• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• CWE-672

Tokens for named pipes may be delivered after deregistration

• Memory corruption
• CWE-672

>=0.7.2, <0.8.11 · fixed in 0.8.11

Possibility to circumvent the invitation token expiry period

• CWE-672

>=0.0.1.alpha3, <0.26.9 || >=0.27.0, <0.27.5 · fixed in 0.26.9, 0.27.5

Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodon

• mastodon
• Authentication bypass
• CWE-672

Go package github.com/notaryproject/notation configured with permissive trust policies potentially susceptible to rollback attack from compromised registry

• CWE-672

<=1.0.0 · no fixed version yet

x86/AMD: missing IOMMU TLB flushing

• Xen
• CWE-672

Pow Mnesia cache doesn't invalidate all expired keys on startup

• CWE-298
• CWE-672

>=1.0.14, <1.0.34 · fixed in 1.0.34

HCI send_sync Dangling Semaphore Reference Re-use

• Zephyr
• CWE-672

HCI Connection Creation Dangling State Reference Re-use

• Zephyr
• CWE-672

Mozilla Firefox: By using XSL Transforms, a malicious webserver could have served a user an XSL document…

• Mozilla Firefox
• CWE-672

User invites for Funkwhale v1.2.8 do not permanently expire after being used for signup and can be used again after an account has been deleted.

• CWE-672

An issue was discovered in MaraDNS Deadwood through 3.5.0021 that allows variant V1 of unintended domain name resolution.

• CWE-672

Intel(R) SGX SDK software: Premature release of resource during expected lifetime in the Intel(R) SGX SDK software…

• Intel(R) SGX SDK software
• CWE-672

A heap double free issue was found in Opensc before version 0.22.0 in sc_pkcs15_free_tokeninfo.

• opensc
• CWE-672

Junos OS and Junos OS Evolved: An rpd core will be observed with proxy BGP route-target filtering enabled and certain route add and delete event happening

• Juniper Networks Junos OS
• Juniper Networks Junos OS Evolved
• CWE-672

Siemens SIMATIC Drive Controller family: A vulnerability has been identified in SIMATIC Drive Controller family (All versions <…

• Siemens SIMATIC Drive Controller family
• Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)
• CWE-672

Siemens SIMATIC Drive Controller family: A vulnerability has been identified in SIMATIC Drive Controller family (All versions >=…

• Siemens SIMATIC Drive Controller family
• Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)
• CWE-672

Update unsound DrainFilter and RString::retain

• CWE-672

<0.9.1 · fixed in 0.9.1

receiving subscription objects with deleted session

• CWE-672

<4.4.0 · fixed in 4.4.0

Operation on a Resource after Expiration or Release in Jetty Server

• CWE-672
• CWE-675

>=9.4.27, <9.4.30.v20200611 · fixed in 9.4.30.v20200611

The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when configured for wireless networking the FTP service operating on the WBM remains operational until the WBM is rebooted.

• Baxter Sigma Spectrum Infusion Pumps
• CWE-672

Password reset links invalidation issue in WordPress

• WordPress
• CWE-672

Reference counting error in overlayfs/shiftfs error path when used in conjuction with aufs

• Ubuntu Linux kernel
• CWE-672

Reference count underflow in shiftfs

• Ubuntu Shiftfs in the Linux kernel
• CWE-672