Threats Tagged 'cwe-420'

Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on which those controls, including enforcement of signed-out and revoked sessions, were not applied.

An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.

A vulnerability in Tor versions before 0.4.9.9 allows an attacker to bypass the compression bomb detection by concatenating multiple gzip or zlib sub-streams, each below the detection threshold. This flaw can lead to denial of service by causing resource exhaustion. The issue is tracked as CVE-2026-77639 and is classified under CWE-420 (Unprotected Alternate Channel).

When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.

CVE-2026-35388 is a low-severity vulnerability in OpenSSH versions before 10.3 where connection multiplexing confirmation is omitted for proxy-mode multiplexing sessions. This issue relates to CWE-420, an unprotected alternate channel, potentially allowing limited unauthorized interaction. The vulnerability does not impact confidentiality or availability but may cause limited integrity issues. There are no known exploits in the wild, and no official patch or vendor advisory is currently provided.

CVE-2026-25916 is a medium severity vulnerability in Roundcube Webmail versions before 1.5.13 and 1.6 before 1.6.13. When the 'Block remote images' feature is enabled, the application fails to block SVG feImage elements, allowing remote image content to be loaded. This unprotected alternate channel can be exploited to bypass privacy protections intended to prevent remote content loading, potentially leaking user information. The vulnerability does not impact integrity or availability and requires user interaction to trigger. No known exploits are currently reported in the wild.

MediumVulnerabilityGermanyFranceNetherlands+5#cve#cve-2026-25916#cwe-420

A local low privileged attacker can bypass the authentication of the Device Manager user interface, allowing them to perform privileged operations and gain administrator access.

HighVulnerabilityGermanyFranceNetherlands+3#cve#cve-2025-41727#cwe-420

BullWall Ransomware Containment supports configurable file and directory exclusions such as '$RECYCLE.BIN' to balance monitoring scope and performance. Certain exclusion patterns could allow an authenticated attacker to rename directories in a way that avoids monitoring. Fixed in 4.6.1.14 and 5.0.0.42, which remove hardcoded exclusion behavior and exposes exclusion handling as configurable settings.

HighVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2025-62001#cwe-420

In Oxide control plane 15 through 17 before 17.1, API tokens can be renewed past their expiration date.

MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2025-66432#cwe-420