CWE-1357: Reliance on Insufficiently Trustworthy Component
The product is built from multiple separate components, but it uses a component that is not sufficiently trusted to meet expectations for security, reliability, updateability, and maintainability.
A kind of CWE-710 Improper Adherence to Coding Standards.
From the CWE List. © The MITRE Corporation.
Newest
- saltyorg docs Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets 10.0 Critical
- red hat quay 3 Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scope 8.0 High
- dell powerprotect one Dell PowerProtect One, versions 20.1.0.0 and below, contain a Reliance on Insufficiently... 5.3 Medium
- red hat multicluster engine for kubernetes 2.10, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.17 +3 more +5 more Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha 7.7 High
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.16, advanced cluster management for kubernetes 2.17 +2 more Submariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref 4.4 Medium
- nvidia dynamo NVIDIA Dynamo for Linux examples and recipes contain a vulnerability where an attacker could... 6.6 Medium
- anaconda conda-build Conda-build vulnerable to supply chain attack vector due to pyproject.toml referring to dependencies not present in PyPI 7.2 High
- subnet substation server SUBNET Substation Server Reliance on Insufficiently Trustworthy Component 8.6 High
- subnet powersystem center SUBNET PowerSYSTEM Center Reliance on Insufficiently Trustworthy Component 8.6 High
- subnet substation server, subnet solutions powersystem server, substation server 2021 +1 more +3 more SUBNET PowerSYSTEM Server and Substation Server Reliance on Insufficiently Trustworthy Component 8.6 High