Advisories · Weakness

CWE-840.

Every Advisory and CVE whose sources give the weakness CWE-840, newest first.

CVE-2024-6446 CVE record

CVSS 3.5 Low

Business Logic Errors in GitLab
- GitLab
- CWE-840
Not analysed yet 12 Sept 2024
github.com/answerdev/answer Go

CVSS 8.1 High

Answer vulnerable to Business Logic Errors in github.com/answerdev/answer
- CWE-840
<1.0.6 · fixed in 1.0.6

GHSA-r95w-7cpx-h5mx · CVE-2023-1542 Not analysed yet 20 Aug 2024
github.com/answerdev/answer Go

CVSS 6.0 Medium

Answer vulnerable to Business Logic Errors in github.com/answerdev/answer
- CWE-840
<1.0.6 · fixed in 1.0.6

GHSA-h2wg-83fc-xvm9 · CVE-2023-1541 Not analysed yet 20 Aug 2024
CVE-2024-42034 CVE record

CVSS 6.6 Medium

LaunchAnywhere vulnerability in the account module.
- Huawei HarmonyOS
- Huawei EMUI
- CWE-840
Not analysed yet 8 Aug 2024
CVE-2024-39671 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Access control vulnerability in the security verification module.
- Huawei HarmonyOS
- Huawei EMUI
- CWE-840
Not analysed yet 25 Jul 2024
CVE-2023-7271 CVE record

CVSS 5.5 Medium

Privilege escalation vulnerability in the NMS module Impact: Successful exploitation of this vulnerability will affect availability.
- Huawei HarmonyOS
- Huawei EMUI
- CWE-840
Not analysed yet 25 Jul 2024
CVE-2024-4046 CVE record

CVSS 6.4 Medium

Cracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability.
- Huawei HarmonyOS
- Huawei EMUI
- CWE-840
Not analysed yet 11 May 2024
CVE-2024-32999 CVE record

CVSS 6.8 Medium

Cracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability.
- Huawei HarmonyOS
- Huawei EMUI
- CWE-840
Not analysed yet 11 May 2024
CVE-2024-1456 CVE record

CVSS 7.1 High

S3 Bucket Takeover in h2oai/h2o-3
- h2oai/h2o-3
- CWE-840
Not analysed yet 16 Apr 2024
CVE-2024-2267 CVE record

CVSS 4.3 Medium

keerti1924 Online-Book-Store-Website shop.php logic error
- keerti1924 Online-Book-Store-Website
- CWE-840
Not analysed yet 7 Mar 2024
CVE-2024-2151 CVE record

CVSS 4.3 Medium

SourceCodester Online Mobile Management Store Product Price logic error
- SourceCodester Online Mobile Management Store
- CWE-840
Not analysed yet 3 Mar 2024
microweber/microweber Packagist

CVSS 6.0 Medium

Business Logic Errors in microweber/microweber
- CWE-840
<2.0.0 · fixed in 2.0.0

GHSA-qjfx-fvx7-3wvw · CVE-2023-6832 Not analysed yet 15 Dec 2023
microweber/microweber Packagist

CVSS 5.9 Medium

Microweber Business Logic Errors
- CWE-840
<2.0.0 · fixed in 2.0.0

GHSA-3rpx-pgmf-j96h · CVE-2023-6566 Not analysed yet 7 Dec 2023
CVE-2023-6514 CVE record

CVSS 8.8 High

The Bluetooth module of some Huawei Smart Screen products has an identity authentication bypass vulnerability.
- Huawei AJMD-370S
- CWE-840
Not analysed yet 6 Dec 2023
CVE-2023-6017 CVE record

CVSS 8.7 High

H2O S3 Bucket Takeover
- h2oai/h2o-3
- CWE-840
Not analysed yet 16 Nov 2023
froxlor/froxlor Packagist

CVSS 3.8 Low

Froxlor vulnerable to business logic errors
- Broken access control
- CWE-840
<2.0.22 · fixed in 2.0.22

GHSA-9rmf-6qgj-g3wj · CVE-2023-4304 Not analysed yet 11 Aug 2023
magento/community-edition +1 Packagist

CVSS 4.3 Medium

Magento Open Source has Business Logic Errors Vulnerability
- CWE-840
>=2.4.4-p1, <2.4.4-p4 || >=2.4.5-p1, <2.4.5-p3 · fixed in 2.4.4-p4, 2.4.5-p3

GHSA-28vp-39rf-3q2j · CVE-2023-29294 Not analysed yet 15 Jun 2023
CVE-2023-3229 CVE record

CVSS 5.4 Medium

Business Logic Errors in fossbilling/fossbilling
- fossbilling/fossbilling
- CWE-840
Not analysed yet 14 Jun 2023
CVE-2023-3228 CVE record

CVSS 5.4 Medium

Business Logic Errors in fossbilling/fossbilling
- fossbilling/fossbilling
- CWE-840
Not analysed yet 14 Jun 2023
thorsten/phpmyfaq Packagist

CVSS 8.3 High

thorsten/phpmyfaq vulnerable to business logic errors
- CWE-840
<3.1.12 · fixed in 3.1.12

GHSA-gx43-fqrx-6fcw · CVE-2023-1887 Not analysed yet 5 Apr 2023
froxlor/froxlor Packagist

CVSS 5.5 Medium

Froxlor contains Business Logic Errors
- CWE-840
<2.0.10 · fixed in 2.0.10

GHSA-vqqm-c9gx-773q · CVE-2023-0565 Not analysed yet 30 Jan 2023
rdiffweb PyPI

CVSS 5.7 Medium

Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5.
- CWE-840
<2.5.5 · fixed in 2.5.5

GHSA-2wpw-cm9w-v4xm · CVE-2022-4719 Not analysed yet 27 Dec 2022
rdiffweb PyPI

CVSS 2.8 Low

Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7.
- CWE-840
<2.5.0 · fixed in 2.5.0

GHSA-jw36-mrvg-j5fx · CVE-2022-3363 Not analysed yet 26 Oct 2022
CVE-2022-32208 CVE record

CVSS 5.9 Medium

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly.
- https://github.com/curl/curl
- CWE-840
Not analysed yet 7 Jul 2022
CVE-2022-32207 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In…
- https://github.com/curl/curl
- CWE-840
Not analysed yet 7 Jul 2022
CVE-2022-27782 CVE record

CVSS 7.5 High

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection p…
- https://github.com/curl/curl
- CWE-840
Not analysed yet 1 Jun 2022
com.erudika:para-core Maven

CVSS 9.0 CriticalCritical · CVSS 9+

Business Logic Errors in Para
- CWE-840
<1.46.0 · fixed in 1.46.0

GHSA-4793-8wwh-jxxr · CVE-2022-1848 Not analysed yet 25 May 2022
magento/community-edition +1 Packagist

CVSS 6.5 Medium

Magento affected by a business logic error in the placeOrder graphql mutation
- CWE-840
<2.3.7-p1 || >=2.4.2-p1, <2.4.2-p2 · fixed in 2.3.7-p1, 2.4.2-p2

GHSA-3f97-7pgv-gmgr · CVE-2021-36012 Not analysed yet 24 May 2022
CVE-2022-0935 CVE record

CVSS 8.8 High

Host Header injection in password Reset in livehelperchat/livehelperchat
- livehelperchat/livehelperchat
- CWE-840
Not analysed yet 7 Apr 2022
snipe/snipe-it Packagist

CVSS 7.4 High

Old sessions not blocked by login enable function in Snipe-IT
- Authentication bypass
- CWE-840
<5.4.2 || >=6.0.0-RC-1, <6.0.0-RC-6 · fixed in 5.4.2, 6.0.0-RC-6

GHSA-636j-7x7r-gvw2 · CVE-2022-1155 Not analysed yet 31 Mar 2022
CVE-2022-0514 CVE record

CVSS 6.5 Medium

Business Logic Errors in crater-invoice/crater
- crater-invoice/crater
- CWE-840
Not analysed yet 21 Mar 2022
dolibarr/dolibarr Packagist

CVSS 4.3 Medium

Logic error in dolibarr/dolibarr
- CWE-840
<16.0 · fixed in 16.0

GHSA-8vq6-5f66-hp3r · CVE-2022-0746 Not analysed yet 26 Feb 2022
microweber/microweber Packagist

CVSS 9.4 CriticalCritical · CVSS 9+

Business Logic Errors in microweber
- CWE-840
<1.2.11 · fixed in 1.2.11

GHSA-c5gj-w4hx-gvmx · CVE-2022-0688 Not analysed yet 21 Feb 2022
microweber/microweber Packagist

CVSS 5.3 Medium

Business Logic Errors in microweber
- CWE-840
<1.2.11 · fixed in 1.2.11

GHSA-3p9j-442x-hjp7 · CVE-2022-0689 Not analysed yet 20 Feb 2022
yarn npm

CVSS 5.9 Medium

TOCTOU Race Condition in Yarn
- Race condition
- CWE-840
<1.19.0 · fixed in 1.19.0

GHSA-hjxc-462x-x77j · CVE-2019-15608 Not analysed yet 9 Feb 2022
publify_core RubyGems

CVSS 6.5 Medium

Publify Business Logic Errors
- CWE-840
- CWE-841
<9.2.7 · fixed in 9.2.7

GHSA-x3rq-r3cm-5vc4 · CVE-2022-0524 Not analysed yet 9 Feb 2022
pimcore/pimcore Packagist

CVSS 4.3 Medium

Business Logic Errors in pimcore
- CWE-840
<10.2.9 · fixed in 10.2.9

GHSA-54hw-mhgh-x4vc · CVE-2021-4146 Not analysed yet 26 Jan 2022
calibreweb PyPI

CVSS 7.7 High

calibre-web is vulnerable to Business Logic Errors
- CWE-840
<0.6.15 · fixed in 0.6.15

GHSA-xp7p-3gx7-j6wx · CVE-2021-4171 Not analysed yet 21 Jan 2022
yetiforce/yetiforce-crm Packagist

CVSS 7.3 High

YetiForceCRM is vulnerable to Business Logic Errors because product amount can be a negative number
- CWE-20
- CWE-840
<=6.3.0 · no fixed version yet

GHSA-7v7w-f7c6-f829 · CVE-2021-4111 Not analysed yet 16 Dec 2021
yetiforce/yetiforce-crm Packagist

CVSS 7.7 High

YetiForceCRM is vulnerable to Business Logic Errors in the weight of a product
- CWE-20
- CWE-840
<=6.3.0 · no fixed version yet

GHSA-cxg7-84wp-8pcq · CVE-2021-4117 Not analysed yet 16 Dec 2021
CVE-2021-22926 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

libcurl-using applications can ask for a specific client certificate to be used in a transfer.
- https://github.com/curl/curl
- CWE-840
Not analysed yet 5 Aug 2021
CVE-2021-22922 CVE record

CVSS 6.5 Medium

When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to…
- https://github.com/curl/curl
- CWE-840
Not analysed yet 5 Aug 2021
CVE-2021-22897 CVE record

CVSS 5.3 Medium

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library.
- https://github.com/curl/curl
- CWE-840
Not analysed yet 11 Jun 2021
CVE-2020-8228 CVE record

A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times.
- Nextcloud Preferred Provider
- CWE-840
Not analysed yet 5 Oct 2020
CVE-2020-8181 CVE record

Nextcloud Contact: A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload…
- Nextcloud Contact
- CWE-840
Not analysed yet 10 Jul 2020
CVE-2019-3787 CVE record

CVSS 8.3 High

UAA defaults email address to an insecure domain
- Cloud Foundry UAA Release (OSS)
- CWE-840
Not analysed yet 19 Jun 2019
CVE-2019-3789 CVE record

CVSS 8.8 High

Gorouter allows space developer to hijack route services hosted outside the platform
- Cloud Foundry CF Routing
- CWE-840
Not analysed yet 24 Apr 2019