# CWE-807.

Every Advisory and CVE whose sources give the weakness CWE-807, newest first.

## Records, newest first (an older page)

- [Sophos Firewall: A business logic vulnerability in the Up2Date component of Sophos Firewall older than…](https://agentprime.io/advisories/CVE-2024-13974.md)
  `CVE-2024-13974` · CVE record: Sophos Sophos Firewall · CVSS 8.1 High · Not analysed yet · Published 21 Jul 2025 · Tags: CWE-807
- [Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) Vulnerable to Bypass of IAM Authenticator](https://agentprime.io/advisories/CVE-2025-49827.md)
  `CVE-2025-49827` · CVE record: cyberark conjur · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jul 2025 · Tags: CWE-807
- [Lucee before 5.4.7.3 LTS and 6 before 6.1.1.118, when an attacker can place files on the server, is vulnerable to a protection mechanism failure that can let an attacker run code that would be expect…](https://agentprime.io/advisories/CVE-2024-55354.md)
  `CVE-2024-55354` · CVE record: Lucee Lucee Server · CVSS 8.8 High · Not analysed yet · Published 8 Apr 2025 · Tags: CWE-807
- [GlobalProtect App: Local Privilege Escalation (PE) Vulnerability](https://agentprime.io/advisories/CVE-2025-0117.md)
  `CVE-2025-0117` · CVE record: Palo Alto Networks GlobalProtect App and 1 more · CVSS 7.1 High · Not analysed yet · Published 12 Mar 2025 · Tags: CWE-807
- [Request approval spoofing in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center](https://agentprime.io/advisories/CVE-2025-1969.md)
  `CVE-2025-1969` · CVE record: AWS Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center · CVSS 5.3 Medium · Not analysed yet · Published 4 Mar 2025 · Tags: CWE-807
- [Duplicate Advisory: Picklescan Allows Remote Code Execution via Malicious Pickle File Bypassing Static Analysis](https://agentprime.io/advisories/GHSA-hw34-rqc5-h2gm.md)
  `GHSA-hw34-rqc5-h2gm` · PyPI `picklescan`: affected `<=0.0.21`, no fixed version yet · CVSS 4.0, no score published · Withdrawn · Not analysed yet · Published 3 Mar 2025 · Tags: CWE-646, CWE-807
- [Lexmark has identified a vulnerability in our Lexmark Print Management Client (LPMC).](https://agentprime.io/advisories/CVE-2025-1126.md)
  `CVE-2025-1126` · CVE record: Lexmark Lexmark Print Management Client · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Feb 2025 · Tags: CWE-807
- [Anubis has a bot protection bypass when a sophisticated attacker asks to pass a challenge of difficulty 0 in github.com/Xe/x](https://agentprime.io/advisories/GHSA-56w8-8ppj-2p4f.md)
  `GHSA-56w8-8ppj-2p4f`, `CVE-2025-24369`, `GO-2025-3424` · Go `github.com/Xe/x`: affected `*`, no fixed version yet · CVSS 2.3 Low · Not analysed yet · Published 29 Jan 2025 · Tags: CWE-807
- [ECOVACS lawnmower and vacuum cloud service live video PIN bypass](https://agentprime.io/advisories/CVE-2024-52327.md)
  `CVE-2024-52327` · CVE record: ECOVACS ECOVACS HOME and 1 more · CVSS 6.0 Medium · Not analysed yet · Published 23 Jan 2025 · Tags: CWE-603, CWE-807
- [Traffic Alert and Collision Avoidance System (TCAS) II has a Reliance on Untrusted Inputs in a Security Decision vulnerability](https://agentprime.io/advisories/CVE-2024-9310.md)
  `CVE-2024-9310` · CVE record: Traffic Alert and Collision Avoidance System (TCAS) II Collision Avoidance Systems · CVSS 6.0 Medium · Not analysed yet · Published 22 Jan 2025 · Tags: CWE-807
- [IBM Security ReaQta improper input validation](https://agentprime.io/advisories/CVE-2024-45654.md)
  `CVE-2024-45654` · CVE record: IBM Security ReaQta · CVSS 4.3 Medium · Not analysed yet · Published 19 Jan 2025 · Tags: CWE-807
- [TrueFiling authorization bypass via user-controlled keys](https://agentprime.io/advisories/CVE-2024-11146.md)
  `CVE-2024-11146` · CVE record: i3 Verticals TrueFiling · CVSS 6.3 Medium · Not analysed yet · Published 17 Jan 2025 · Tags: Broken access control, CWE-807
- [2N Access Commander: In 2N Access Commander versions 3.1.1.2 and prior…](https://agentprime.io/advisories/CVE-2024-47254.md)
  `CVE-2024-47254` · CVE record: 2N 2N Access Commander · CVSS 6.3 Medium · Not analysed yet · Published 5 Nov 2024 · Tags: CWE-807
- [Authentication bypass Vulnerability in Aero](https://agentprime.io/advisories/CVE-2024-51561.md)
  `CVE-2024-51561` · CVE record: Brokerage Technology Solutions Aero · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2024 · Tags: CWE-807
- [Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision](https://agentprime.io/advisories/GHSA-hxx2-7vcw-mqr3.md)
  `GHSA-hxx2-7vcw-mqr3`, `CVE-2024-21510` · RubyGems `sinatra`: affected `<4.1.0`, fixed in `4.1.0` · CVSS 5.4 Medium · Not analysed yet · Published 1 Nov 2024 · Tags: CWE-807
- [BT: Encryption procedure host vulnerability](https://agentprime.io/advisories/CVE-2024-5754.md)
  `CVE-2024-5754` · CVE record: zephyrproject-rtos Zephyr · CVSS 8.2 High · Not analysed yet · Published 13 Sept 2024 · Tags: CWE-807
- [Privilege escalation in mk_informix plugin](https://agentprime.io/advisories/CVE-2024-28829.md)
  `CVE-2024-28829` · CVE record: Checkmk GmbH Checkmk · CVSS 5.2 Medium · Not analysed yet · Published 20 Aug 2024 · Tags: CWE-272, CWE-807
- [Improper input validation in Google Chrome](https://agentprime.io/advisories/CVE-2024-7005.md)
  `CVE-2024-7005` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 6 Aug 2024 · Tags: CWE-20, CWE-807
- [Missing check in tpm2_checkquote allows attackers to misrepresent the TPM state](https://agentprime.io/advisories/CVE-2024-29039.md)
  `CVE-2024-29039` · CVE record: tpm2-software tpm2-tools · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Jun 2024 · Tags: CWE-807
- [Rancher Privilege escalation vulnerability via malicious "Connection" header](https://agentprime.io/advisories/GHSA-pvxj-25m6-7vqr.md)
  `GHSA-pvxj-25m6-7vqr`, `CVE-2021-31999`, `GO-2024-2778` · Go `github.com/rancher/rancher`: affected `>=2.0.0, <2.4.16 || >=2.5.0, <2.5.9`, fixed in `2.4.16`, `2.5.9` · CVSS 8.8 High · Not analysed yet · Published 24 Apr 2024 · Tags: CWE-807
- [Privilege escalation in mk_informix plugin](https://agentprime.io/advisories/CVE-2024-28824.md)
  `CVE-2024-28824` · CVE record: Checkmk GmbH Checkmk · CVSS 8.8 High · Not analysed yet · Published 22 Mar 2024 · Tags: CWE-272, CWE-807
- [Gallagher Command Centre Diagnostics Service: A reliance on untrusted inputs in a security decision could be exploited by a privileged…](https://agentprime.io/advisories/CVE-2023-46686.md)
  `CVE-2023-46686` · CVE record: Gallagher Command Centre Diagnostics Service · CVSS 5.5 Medium · Not analysed yet · Published 18 Dec 2023 · Tags: CWE-807
- [CSRF token reuse vulnerability in github.com/gofiber/fiber/v2](https://agentprime.io/advisories/GHSA-94w9-97p3-p368.md)
  `GHSA-94w9-97p3-p368`, `CVE-2023-45128`, `GO-2023-2115` · Go `github.com/gofiber/fiber/v2`: affected `<2.50.0`, fixed in `2.50.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2023 · Tags: Cross-site request forgery (CSRF), CWE-20, CWE-565, CWE-807
- [DCK pinning attack in TETRA](https://agentprime.io/advisories/CVE-2022-24400.md)
  `CVE-2022-24400` · CVE record: ETSI TETRA Standard · CVSS 7.5 High · Not analysed yet · Published 19 Oct 2023 · Tags: CWE-807
- [GlobalProtect App: Local Privilege Escalation (PE) Vulnerability](https://agentprime.io/advisories/CVE-2023-0009.md)
  `CVE-2023-0009` · CVE record: Palo Alto Networks GlobalProtect App · CVSS 7.8 High · Not analysed yet · Published 14 Jun 2023 · Tags: CWE-807
- [Mattermost Server server restarts may provide attackers with API access](https://agentprime.io/advisories/GHSA-hxxj-8phw-74vw.md)
  `GHSA-hxxj-8phw-74vw`, `CVE-2017-18915`, `GO-2026-4462` · Go `github.com/mattermost/mattermost-server`: affected `<3.6.7-0.20170420152529-0968e4079e0a || >=3.7.0, <3.7.5 || >=3.8.0, <3.8.2`, fixed in `3.6.7-0.20170420152529-0968e4079e0a`, `3.7.5`, `3.8.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 May 2022 · Tags: CWE-20, CWE-807
- [Sony Neural Network Libraries reliance on untrusted inputs prior to v1.0.10](https://agentprime.io/advisories/GHSA-4q2w-rw7m-xqw6.md)
  `GHSA-4q2w-rw7m-xqw6`, `CVE-2019-10844`, `PYSEC-2019-107` · PyPI `nnabla`: affected `<1.0.10`, fixed in `1.0.10` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2022 · Tags: CWE-807
- [Cisco Firepower Management Center Software Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2022-20744.md)
  `CVE-2022-20744` · CVE record: Cisco Cisco Firepower Management Center · CVSS 4.3 Medium · Not analysed yet · Published 3 May 2022 · Tags: CWE-807
- [login-proxy sends password to attacker-provided domain](https://agentprime.io/advisories/CVE-2021-36777.md)
  `CVE-2021-36777` · CVE record: openSUSE Build service · CVSS 8.1 High · Not analysed yet · Published 9 Mar 2022 · Tags: CWE-807
- [Pterodactyl Panel vulnerable to authentication bypass due to improper user-provided security token verification](https://agentprime.io/advisories/GHSA-5vfx-8w6m-h3v4.md)
  `GHSA-5vfx-8w6m-h3v4`, `CVE-2021-41129`, `PKSA-56gp-gqk7-m2wf` · Packagist `pterodactyl/panel`: affected `>=1.0.0, <1.6.2`, fixed in `1.6.2` · CVSS 8.1 High · Not analysed yet · Published 4 Oct 2021 · Tags: Authentication bypass, Insecure deserialization, Broken access control, CWE-807
- [Cached redirect poisoning via X-Forwarded-Host header](https://agentprime.io/advisories/GHSA-w6rq-6h34-vh7q.md)
  `GHSA-w6rq-6h34-vh7q`, `CVE-2021-29479` · Maven `io.ratpack:ratpack-core`: affected `<1.9.0`, fixed in `1.9.0` · CVSS 7.0 High · Not analysed yet · Published 1 Jul 2021 · Tags: CWE-807
- [Malicious package may avoid detection in python auditing](https://agentprime.io/advisories/GHSA-7q25-qrjw-6fg2.md)
  `GHSA-7q25-qrjw-6fg2`, `CVE-2020-5252`, `PYSEC-2020-101` · PyPI `safety`: affected `<1.9.0`, fixed in `1.9.0` · CVSS 5.0 Medium · Not analysed yet · Published 24 Mar 2020 · Tags: CWE-807
- [Nextcloud Server before 9.0.55 and 10.0.2 suffers from a bypass in the quota limitation.](https://agentprime.io/advisories/CVE-2017-0887.md)
  `CVE-2017-0887` · CVE record: Nextcloud Nextcloud Server · No CVSS score · Not analysed yet · Published 5 Apr 2017 · Tags: CWE-807

Newest: <https://agentprime.io/advisories/tag/cwe-807.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-807&cursor=WyIyMDI1LTA3LTIzVDA5OjMxOjE4LjU0NzAwMFoiLCJDVkUtMjAyNS01Mzg4MiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-807/?cursor=WyIyMDI1LTA3LTIzVDA5OjMxOjE4LjU0NzAwMFoiLCJDVkUtMjAyNS01Mzg4MiJd>. Everything for agents: <https://agentprime.io/llms.txt>.