# CWE-840.

Every Advisory and CVE whose sources give the weakness CWE-840, newest first.

## Records, newest first (an older page)

- [Business Logic Errors in GitLab](https://agentprime.io/advisories/CVE-2024-6446.md)
  `CVE-2024-6446` · CVE record: GitLab GitLab · CVSS 3.5 Low · Not analysed yet · Published 12 Sept 2024 · Tags: CWE-840
- [Answer vulnerable to Business Logic Errors in github.com/answerdev/answer](https://agentprime.io/advisories/GHSA-r95w-7cpx-h5mx.md)
  `GHSA-r95w-7cpx-h5mx`, `CVE-2023-1542`, `GO-2023-1660` · Go `github.com/answerdev/answer`: affected `<1.0.6`, fixed in `1.0.6` · CVSS 8.1 High · Not analysed yet · Published 20 Aug 2024 · Tags: CWE-840
- [Answer vulnerable to Business Logic Errors in github.com/answerdev/answer](https://agentprime.io/advisories/GHSA-h2wg-83fc-xvm9.md)
  `GHSA-h2wg-83fc-xvm9`, `CVE-2023-1541`, `GO-2023-1658` · Go `github.com/answerdev/answer`: affected `<1.0.6`, fixed in `1.0.6` · CVSS 6.0 Medium · Not analysed yet · Published 20 Aug 2024 · Tags: CWE-840
- [LaunchAnywhere vulnerability in the account module.](https://agentprime.io/advisories/CVE-2024-42034.md)
  `CVE-2024-42034` · CVE record: Huawei HarmonyOS and 1 more · CVSS 6.6 Medium · Not analysed yet · Published 8 Aug 2024 · Tags: CWE-840
- [Access control vulnerability in the security verification module.](https://agentprime.io/advisories/CVE-2024-39671.md)
  `CVE-2024-39671` · CVE record: Huawei HarmonyOS and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Jul 2024 · Tags: CWE-840
- [Privilege escalation vulnerability in the NMS module Impact: Successful exploitation of this vulnerability will affect availability.](https://agentprime.io/advisories/CVE-2023-7271.md)
  `CVE-2023-7271` · CVE record: Huawei HarmonyOS and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 25 Jul 2024 · Tags: CWE-840
- [Cracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability.](https://agentprime.io/advisories/CVE-2024-4046.md)
  `CVE-2024-4046` · CVE record: Huawei HarmonyOS and 1 more · CVSS 6.4 Medium · Not analysed yet · Published 11 May 2024 · Tags: CWE-840
- [Cracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability.](https://agentprime.io/advisories/CVE-2024-32999.md)
  `CVE-2024-32999` · CVE record: Huawei HarmonyOS and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 11 May 2024 · Tags: CWE-840
- [S3 Bucket Takeover in h2oai/h2o-3](https://agentprime.io/advisories/CVE-2024-1456.md)
  `CVE-2024-1456` · CVE record: h2oai h2oai/h2o-3 · CVSS 7.1 High · Not analysed yet · Published 16 Apr 2024 · Tags: CWE-840
- [keerti1924 Online-Book-Store-Website shop.php logic error](https://agentprime.io/advisories/CVE-2024-2267.md)
  `CVE-2024-2267` · CVE record: keerti1924 Online-Book-Store-Website · CVSS 4.3 Medium · Not analysed yet · Published 7 Mar 2024 · Tags: CWE-840
- [SourceCodester Online Mobile Management Store Product Price logic error](https://agentprime.io/advisories/CVE-2024-2151.md)
  `CVE-2024-2151` · CVE record: SourceCodester Online Mobile Management Store · CVSS 4.3 Medium · Not analysed yet · Published 3 Mar 2024 · Tags: CWE-840
- [Business Logic Errors in microweber/microweber](https://agentprime.io/advisories/GHSA-qjfx-fvx7-3wvw.md)
  `GHSA-qjfx-fvx7-3wvw`, `CVE-2023-6832`, `PKSA-y5qg-3krh-f9b5` · Packagist `microweber/microweber`: affected `<2.0.0`, fixed in `2.0.0` · CVSS 6.0 Medium · Not analysed yet · Published 15 Dec 2023 · Tags: CWE-840
- [Microweber Business Logic Errors](https://agentprime.io/advisories/GHSA-3rpx-pgmf-j96h.md)
  `GHSA-3rpx-pgmf-j96h`, `CVE-2023-6566`, `PKSA-xhwv-tsn6-jm7k` · Packagist `microweber/microweber`: affected `<2.0.0`, fixed in `2.0.0` · CVSS 5.9 Medium · Not analysed yet · Published 7 Dec 2023 · Tags: CWE-840
- [The Bluetooth module of some Huawei Smart Screen products has an identity authentication bypass vulnerability.](https://agentprime.io/advisories/CVE-2023-6514.md)
  `CVE-2023-6514` · CVE record: Huawei AJMD-370S · CVSS 8.8 High · Not analysed yet · Published 6 Dec 2023 · Tags: CWE-840
- [H2O S3 Bucket Takeover](https://agentprime.io/advisories/CVE-2023-6017.md)
  `CVE-2023-6017` · CVE record: h2oai h2oai/h2o-3 · CVSS 8.7 High · Not analysed yet · Published 16 Nov 2023 · Tags: CWE-840
- [Froxlor vulnerable to business logic errors](https://agentprime.io/advisories/GHSA-9rmf-6qgj-g3wj.md)
  `GHSA-9rmf-6qgj-g3wj`, `CVE-2023-4304`, `PKSA-g52h-rdch-wgq3` · Packagist `froxlor/froxlor`: affected `<2.0.22`, fixed in `2.0.22` · CVSS 3.8 Low · Not analysed yet · Published 11 Aug 2023 · Tags: Broken access control, CWE-840
- [Magento Open Source has Business Logic Errors Vulnerability](https://agentprime.io/advisories/GHSA-28vp-39rf-3q2j.md)
  `GHSA-28vp-39rf-3q2j`, `CVE-2023-29294`, `PKSA-88j6-sqdg-73f7`, `PKSA-nzp1-7tdf-p1fn` · Packagist `magento/community-edition` and 1 more: affected `>=2.4.4-p1, <2.4.4-p4 || >=2.4.5-p1, <2.4.5-p3`, fixed in `2.4.4-p4`, `2.4.5-p3` · CVSS 4.3 Medium · Not analysed yet · Published 15 Jun 2023 · Tags: CWE-840
- [Business Logic Errors in fossbilling/fossbilling](https://agentprime.io/advisories/CVE-2023-3229.md)
  `CVE-2023-3229` · CVE record: fossbilling fossbilling/fossbilling · CVSS 5.4 Medium · Not analysed yet · Published 14 Jun 2023 · Tags: CWE-840
- [Business Logic Errors in fossbilling/fossbilling](https://agentprime.io/advisories/CVE-2023-3228.md)
  `CVE-2023-3228` · CVE record: fossbilling fossbilling/fossbilling · CVSS 5.4 Medium · Not analysed yet · Published 14 Jun 2023 · Tags: CWE-840
- [thorsten/phpmyfaq vulnerable to business logic errors](https://agentprime.io/advisories/GHSA-gx43-fqrx-6fcw.md)
  `GHSA-gx43-fqrx-6fcw`, `CVE-2023-1887`, `PKSA-w163-ccsb-gq3p` · Packagist `thorsten/phpmyfaq`: affected `<3.1.12`, fixed in `3.1.12` · CVSS 8.3 High · Not analysed yet · Published 5 Apr 2023 · Tags: CWE-840
- [Froxlor contains Business Logic Errors](https://agentprime.io/advisories/GHSA-vqqm-c9gx-773q.md)
  `GHSA-vqqm-c9gx-773q`, `CVE-2023-0565`, `PKSA-k44n-5k61-zjy7` · Packagist `froxlor/froxlor`: affected `<2.0.10`, fixed in `2.0.10` · CVSS 5.5 Medium · Not analysed yet · Published 30 Jan 2023 · Tags: CWE-840
- [Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5.](https://agentprime.io/advisories/GHSA-2wpw-cm9w-v4xm.md)
  `GHSA-2wpw-cm9w-v4xm`, `CVE-2022-4719`, `PYSEC-2022-43005` · PyPI `rdiffweb`: affected `<2.5.5`, fixed in `2.5.5` · CVSS 5.7 Medium · Not analysed yet · Published 27 Dec 2022 · Tags: CWE-840
- [Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7.](https://agentprime.io/advisories/GHSA-jw36-mrvg-j5fx.md)
  `GHSA-jw36-mrvg-j5fx`, `CVE-2022-3363`, `PYSEC-2022-42978` · PyPI `rdiffweb`: affected `<2.5.0`, fixed in `2.5.0` · CVSS 2.8 Low · Not analysed yet · Published 26 Oct 2022 · Tags: CWE-840
- [When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly.](https://agentprime.io/advisories/CVE-2022-32208.md)
  `CVE-2022-32208` · CVE record: https\://github.com/curl/curl · CVSS 5.9 Medium · Not analysed yet · Published 7 Jul 2022 · Tags: CWE-840
- [When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In…](https://agentprime.io/advisories/CVE-2022-32207.md)
  `CVE-2022-32207` · CVE record: https\://github.com/curl/curl · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.12 · Not analysed yet · Published 7 Jul 2022 · Tags: CWE-840
- [libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection p…](https://agentprime.io/advisories/CVE-2022-27782.md)
  `CVE-2022-27782` · CVE record: https\://github.com/curl/curl · CVSS 7.5 High · Not analysed yet · Published 1 Jun 2022 · Tags: CWE-840
- [Business Logic Errors in Para](https://agentprime.io/advisories/GHSA-4793-8wwh-jxxr.md)
  `GHSA-4793-8wwh-jxxr`, `CVE-2022-1848` · Maven `com.erudika:para-core`: affected `<1.46.0`, fixed in `1.46.0` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 May 2022 · Tags: CWE-840
- [Magento affected by a business logic error in the placeOrder graphql mutation](https://agentprime.io/advisories/GHSA-3f97-7pgv-gmgr.md)
  `GHSA-3f97-7pgv-gmgr`, `CVE-2021-36012`, `PKSA-mp3d-tp64-1b25`, `PKSA-t2xp-vd66-ybyt` · Packagist `magento/community-edition` and 1 more: affected `<2.3.7-p1 || >=2.4.2-p1, <2.4.2-p2`, fixed in `2.3.7-p1`, `2.4.2-p2` · CVSS 6.5 Medium · Not analysed yet · Published 24 May 2022 · Tags: CWE-840
- [Host Header injection in password Reset in livehelperchat/livehelperchat](https://agentprime.io/advisories/CVE-2022-0935.md)
  `CVE-2022-0935` · CVE record: livehelperchat livehelperchat/livehelperchat · CVSS 8.8 High · Not analysed yet · Published 7 Apr 2022 · Tags: CWE-840
- [Old sessions not blocked by login enable function in Snipe-IT](https://agentprime.io/advisories/GHSA-636j-7x7r-gvw2.md)
  `GHSA-636j-7x7r-gvw2`, `CVE-2022-1155`, `PKSA-111v-cp4h-45pv` · Packagist `snipe/snipe-it`: affected `<5.4.2 || >=6.0.0-RC-1, <6.0.0-RC-6`, fixed in `5.4.2`, `6.0.0-RC-6` · CVSS 7.4 High · Not analysed yet · Published 31 Mar 2022 · Tags: Authentication bypass, CWE-840
- [Business Logic Errors in crater-invoice/crater](https://agentprime.io/advisories/CVE-2022-0514.md)
  `CVE-2022-0514` · CVE record: crater-invoice crater-invoice/crater · CVSS 6.5 Medium · Not analysed yet · Published 21 Mar 2022 · Tags: CWE-840
- [Logic error in dolibarr/dolibarr](https://agentprime.io/advisories/GHSA-8vq6-5f66-hp3r.md)
  `GHSA-8vq6-5f66-hp3r`, `BIT-dolibarr-2022-0746`, `CVE-2022-0746`, `PKSA-n91r-qpfg-6986` · Packagist `dolibarr/dolibarr`: affected `<16.0`, fixed in `16.0` · CVSS 4.3 Medium · Not analysed yet · Published 26 Feb 2022 · Tags: CWE-840
- [Business Logic Errors in microweber](https://agentprime.io/advisories/GHSA-c5gj-w4hx-gvmx.md)
  `GHSA-c5gj-w4hx-gvmx`, `CVE-2022-0688`, `PKSA-79zq-cn4k-wzfk` · Packagist `microweber/microweber`: affected `<1.2.11`, fixed in `1.2.11` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Feb 2022 · Tags: CWE-840
- [Business Logic Errors in microweber](https://agentprime.io/advisories/GHSA-3p9j-442x-hjp7.md)
  `GHSA-3p9j-442x-hjp7`, `CVE-2022-0689`, `PKSA-ykwf-njxv-2829` · Packagist `microweber/microweber`: affected `<1.2.11`, fixed in `1.2.11` · CVSS 5.3 Medium · Not analysed yet · Published 20 Feb 2022 · Tags: CWE-840
- [TOCTOU Race Condition in Yarn](https://agentprime.io/advisories/GHSA-hjxc-462x-x77j.md)
  `GHSA-hjxc-462x-x77j`, `CVE-2019-15608` · npm `yarn`: affected `<1.19.0`, fixed in `1.19.0` · CVSS 5.9 Medium · Not analysed yet · Published 9 Feb 2022 · Tags: Race condition, CWE-840
- [Publify Business Logic Errors](https://agentprime.io/advisories/GHSA-x3rq-r3cm-5vc4.md)
  `GHSA-x3rq-r3cm-5vc4`, `BIT-publify-2022-0524`, `CVE-2022-0524` · RubyGems `publify_core`: affected `<9.2.7`, fixed in `9.2.7` · CVSS 6.5 Medium · Not analysed yet · Published 9 Feb 2022 · Tags: CWE-840, CWE-841
- [Business Logic Errors in pimcore](https://agentprime.io/advisories/GHSA-54hw-mhgh-x4vc.md)
  `GHSA-54hw-mhgh-x4vc`, `CVE-2021-4146`, `PKSA-vqmw-jbcz-xzf9` · Packagist `pimcore/pimcore`: affected `<10.2.9`, fixed in `10.2.9` · CVSS 4.3 Medium · Not analysed yet · Published 26 Jan 2022 · Tags: CWE-840
- [calibre-web is vulnerable to Business Logic Errors](https://agentprime.io/advisories/GHSA-xp7p-3gx7-j6wx.md)
  `GHSA-xp7p-3gx7-j6wx`, `CVE-2021-4171`, `PYSEC-2026-307` · PyPI `calibreweb`: affected `<0.6.15`, fixed in `0.6.15` · CVSS 7.7 High · Not analysed yet · Published 21 Jan 2022 · Tags: CWE-840
- [YetiForceCRM is vulnerable to Business Logic Errors because product amount can be a negative number](https://agentprime.io/advisories/GHSA-7v7w-f7c6-f829.md)
  `GHSA-7v7w-f7c6-f829`, `CVE-2021-4111`, `PKSA-thkn-vr5y-wnx8` · Packagist `yetiforce/yetiforce-crm`: affected `<=6.3.0`, no fixed version yet · CVSS 7.3 High · Not analysed yet · Published 16 Dec 2021 · Tags: CWE-20, CWE-840
- [YetiForceCRM is vulnerable to Business Logic Errors in the weight of a product](https://agentprime.io/advisories/GHSA-cxg7-84wp-8pcq.md)
  `GHSA-cxg7-84wp-8pcq`, `CVE-2021-4117`, `PKSA-5pn3-2wm5-23ny` · Packagist `yetiforce/yetiforce-crm`: affected `<=6.3.0`, no fixed version yet · CVSS 7.7 High · Not analysed yet · Published 16 Dec 2021 · Tags: CWE-20, CWE-840
- [libcurl-using applications can ask for a specific client certificate to be used in a transfer.](https://agentprime.io/advisories/CVE-2021-22926.md)
  `CVE-2021-22926` · CVE record: https\://github.com/curl/curl · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.15 · Not analysed yet · Published 5 Aug 2021 · Tags: CWE-840
- [When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to…](https://agentprime.io/advisories/CVE-2021-22922.md)
  `CVE-2021-22922` · CVE record: https\://github.com/curl/curl · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2021 · Tags: CWE-840
- [curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library.](https://agentprime.io/advisories/CVE-2021-22897.md)
  `CVE-2021-22897` · CVE record: https\://github.com/curl/curl · CVSS 5.3 Medium · Not analysed yet · Published 11 Jun 2021 · Tags: CWE-840
- [A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times.](https://agentprime.io/advisories/CVE-2020-8228.md)
  `CVE-2020-8228` · CVE record: Nextcloud Preferred Provider · No CVSS score · Not analysed yet · Published 5 Oct 2020 · Tags: CWE-840
- [Nextcloud Contact: A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload…](https://agentprime.io/advisories/CVE-2020-8181.md)
  `CVE-2020-8181` · CVE record: Nextcloud Contact · No CVSS score · Not analysed yet · Published 10 Jul 2020 · Tags: CWE-840
- [UAA defaults email address to an insecure domain](https://agentprime.io/advisories/CVE-2019-3787.md)
  `CVE-2019-3787` · CVE record: Cloud Foundry UAA Release (OSS) · CVSS 8.3 High · Not analysed yet · Published 19 Jun 2019 · Tags: CWE-840
- [Gorouter allows space developer to hijack route services hosted outside the platform](https://agentprime.io/advisories/CVE-2019-3789.md)
  `CVE-2019-3789` · CVE record: Cloud Foundry CF Routing · CVSS 8.8 High · Not analysed yet · Published 24 Apr 2019 · Tags: CWE-840

Newest: <https://agentprime.io/advisories/tag/cwe-840.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-840&cursor=WyIyMDI0LTEwLTE3VDE1OjMxOjA0Ljg0ODAwMFoiLCJDVkUtMjAxOC0yNTEwNCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-840/?cursor=WyIyMDI0LTEwLTE3VDE1OjMxOjA0Ljg0ODAwMFoiLCJDVkUtMjAxOC0yNTEwNCJd>. Everything for agents: <https://agentprime.io/llms.txt>.