Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Insufficient control flow management in certain Zoom Clients for iOS before version 6.4.5 may allow an unauthenticated user to conduct a disclosure of information via network access.

CVE-2025-49463 is a vulnerability identified in Zoom Communications Inc.'s Zoom Clients for iOS versions prior to 6.4.5. The root cause is categorized under CWE-691, which refers to insufficient control flow management. This weakness allows an unauthenticated attacker to potentially disclose sensitive information over the network. Specifically, the vulnerability arises because the affected Zoom client does not properly manage control flow, which can be exploited remotely without requiring any prior authentication. The attack vector is network-based (AV:N), with low attack complexity (AC:L), no privileges required (PR:N), but requires some user interaction (UI:R). The scope is unchanged (S:U), and the impact is primarily on confidentiality (C:H), with no impact on integrity (I:N) or availability (A:N). This means that an attacker could gain access to sensitive information from the Zoom client on iOS devices without altering data or disrupting service. The CVSS v3.1 base score is 6.5, indicating a medium severity level. No known exploits are currently reported in the wild, and no patches or mitigation links are provided in the source data, though the vulnerability is fixed in versions 6.4.5 and later. The vulnerability is significant because Zoom is widely used for communication, including sensitive business and governmental meetings, and iOS devices are common endpoints in enterprise environments. The insufficient control flow management could allow attackers to bypass intended security controls and extract confidential information from the client application during network interactions.

Detailed information about CVE-2025-49463: CWE-691: Insufficient Control Flow Management in Zoom Communications Inc. Zoom Clients for iOS affecting Zoom Communi

CVE-2025-49463: CWE-691: Insufficient Control Flow Management in Zoom Communications Inc. Zoom Clients for iOS - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-49463: CWE-691: Insufficient Control Flow Management in Zoom Communications Inc. Zoom Clients for iOS

In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible.

CVE-2022-46828 is a medium-severity vulnerability identified in JetBrains IntelliJ IDEA versions prior to 2022.3, specifically affecting the macOS platform. The vulnerability is categorized under CWE-691, which relates to an incorrect control of resource identifiers, leading to potential security issues. In this case, the flaw allows for DYLIB (dynamic library) injection on macOS systems. DYLIB injection is a technique where an attacker can load a malicious dynamic library into the process space of a legitimate application, potentially altering its behavior or gaining unauthorized access to system resources. Since IntelliJ IDEA is a widely used integrated development environment (IDE) among software developers, exploitation of this vulnerability could allow an attacker to execute arbitrary code within the context of the IDE process. This could lead to unauthorized access to source code, credentials, or other sensitive data handled by the IDE. The vulnerability does not require known exploits in the wild at the time of reporting, and no patch links were provided, indicating that remediation may require updating to IntelliJ IDEA 2022.3 or later versions once available. The vulnerability is specific to macOS due to the nature of DYLIB injection, which is a macOS-specific dynamic linking mechanism. The flaw likely arises from insufficient validation or control over the loading of dynamic libraries, allowing an attacker to inject malicious code by manipulating environment variables or library search paths. Given the technical details and the nature of the vulnerability, exploitation would require local access or the ability to influence the environment in which IntelliJ IDEA is launched, such as through malicious scripts or compromised user accounts.

Detailed information about CVE-2022-46828: CWE-691 in JetBrains IntelliJ IDEA affecting JetBrains IntelliJ IDEA. Get real-time updates, technical details, and m

CVE-2022-46828: CWE-691 in JetBrains IntelliJ IDEA - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-46828: CWE-691 in JetBrains IntelliJ IDEA

Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, the `slice()` builtin can elide side effects when the output length is 0, and the source bytestring is a builtin (`msg.data` or `<address>.code`). The reason is that for these source locations, the check that `length >= 1` is skipped. The result is that a 0-length bytestring constructed with slice can be passed to `make_byte_array_copier`, which elides evaluation of its source argument when the max length is 0. The impact is that side effects in the `start` argument may be elided when the `length` argument is 0, e.g. `slice(msg.data, self.do_side_effect(), 0)`. The fix in pull request 4645 disallows any invocation of `slice()` with length 0, including for the ad hoc locations discussed in this advisory. The fix is expected to be part of version 0.4.2.

CVE-2025-47774 is a vulnerability in the Vyper programming language, specifically affecting versions up to and including 0.4.2rc1. Vyper is a Pythonic language designed for writing smart contracts on the Ethereum Virtual Machine (EVM). The vulnerability arises from insufficient control flow management in the implementation of the built-in slice() function. When the slice() function is called with a length argument of zero on certain builtin bytestring sources such as msg.data or <address>.code, the function elides side effects that would normally occur in the evaluation of the start argument. This happens because the check ensuring the length is at least one is skipped for these specific source locations. Consequently, side effects embedded in the start argument are not executed if the length is zero, which can lead to unexpected behavior in smart contracts that rely on these side effects for correct operation. The vulnerability is categorized under CWE-691 (Insufficient Control Flow Management). The root cause is that a 0-length bytestring constructed by slice() can be passed to make_byte_array_copier, which optimizes away the evaluation of the source argument when the maximum length is zero. The fix, introduced in pull request 4645 and expected in version 0.4.2, disallows any invocation of slice() with a length of zero, thereby preventing the elision of side effects. The CVSS 4.0 score is 2.9 (low severity), reflecting limited impact and exploitation complexity. No known exploits are reported in the wild. This vulnerability primarily affects smart contracts written in Vyper that use slice() with zero length on builtin bytestrings, potentially causing logical errors or bypassing intended side effects in contract execution.

Detailed information about CVE-2025-47774: CWE-691: Insufficient Control Flow Management in vyperlang vyper affecting vyperlang vyper. Get real-time updates, te

CVE-2025-47774: CWE-691: Insufficient Control Flow Management in vyperlang vyper - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-47774: CWE-691: Insufficient Control Flow Management in vyperlang vyper

Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, `concat()` may skip evaluation of side effects when the length of an argument is zero. This is due to a fastpath in the implementation which skips evaluation of argument expressions when their length is zero. In practice, it would be very unusual in user code to construct zero-length bytestrings using an expression with side-effects, since zero-length bytestrings are typically constructed with the empty literal `b""`; the only way to construct an empty bytestring which has side effects would be with the ternary operator introduced in v0.3.8, e.g. `b"" if self.do_some_side_effect() else b""`. The fix is available in pull request 4644 and expected to be part of the 0.4.2 release. As a workaround, don't have side effects in expressions which construct zero-length bytestrings.

CVE-2025-47285 is a vulnerability in the Vyper programming language, a Pythonic language designed for writing smart contracts on the Ethereum Virtual Machine (EVM). The issue exists in versions up to and including 0.4.2rc1, specifically in the implementation of the `concat()` function. This function has a fastpath optimization that skips the evaluation of argument expressions when their length is zero. However, this optimization leads to insufficient control flow management (CWE-691), where side effects in expressions constructing zero-length bytestrings may be skipped. Although it is uncommon for user code to create zero-length bytestrings with side effects—typically, empty bytestrings are created using the literal `b""`—the ternary operator introduced in version 0.3.8 allows for expressions like `b"" if self.do_some_side_effect() else b""`, which can have side effects that are not evaluated due to this flaw. The consequence is that expected side effects may not occur, potentially causing logical errors or unexpected contract behavior. The vulnerability does not directly lead to memory corruption or unauthorized access but can affect the integrity of contract execution flow. The fix is included in a pull request (4644) and expected in version 0.4.2. As a workaround, developers are advised to avoid side effects in expressions that construct zero-length bytestrings. The CVSS 4.0 score is 2.9, indicating low severity, with no known exploits in the wild to date.

Detailed information about CVE-2025-47285: CWE-691: Insufficient Control Flow Management in vyperlang vyper affecting vyperlang vyper. Get real-time updates, te

Title	Severity	Type	Source	Date

Threats Tagged 'cwe-691'

Filter Threats

Threats Tagged 'cwe-691'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility