CWE-420: Unprotected Alternate Channel
The product protects a primary channel, but it does not use the same level of protection for an alternate channel.
A kind of CWE-923 Improper Restriction of Communication Channel to Intended Endpoints.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 more Windows Schannel Spoofing Vulnerability 9.0 Critical
- accellion kiteworks, kiteworks core +1 more Kiteworks Core Unprotected Alternate Channel 5.4 Medium
- cyrus imap, cyrusimap cyrus imap +1 more An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href... 3.5 Low
- torproject tor Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate... 5.3 Medium
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +19 more +21 more BIG-IP httpd access control vulnerability 6.9 Medium
- prosody An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when... 6.5 Medium
- berriai litellm, red hat lightspeed core, ansible automation platform 2.6 +2 more +4 more Duplicate Advisory: LiteLLM has a sandbox escape in custom-code guardrail 8.8 High
- openbsd openssh OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions. 2.5 Low
- bulwarkmail webmail Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does... 4.3 Medium
- beckhoff automation beckhoff.device.manager.xar, mdp for beckhoff rt linux(r), mdp software package for twincat/bsd +2 more Beckhoff: Performing privileged operations and gaining administrator access 7.8 High
- comfy comfyui-manager Duplicate Advisory: ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420) 7.5 High
- bullwall ransomware containment BullWall Ransomware Containment hard-coded folder exclusions 8.7 High
- oxide omicron In Oxide control plane 15 through 17 before 17.1, API tokens can be renewed past their expiration... 5.0 Medium
- lynxtechnology twonky server Unauthenticated log access in Twonky Server 9.3 Critical
- dyson mqtt server An issue discovered in Dyson App v6.1.23041-23595 allows unauthenticated attackers to control... 3.0 Low
- slack nebula Slack Nebula may accept arbitrary source IP addresses 4.9 Medium
- framelink figma mcp server figma-developer-mcp vulnerable to command injection in get_figma_data tool 8.0 High
- framelink figma mcp server Framelink Figma MCP Server fetchWithRetry Command Injection Remote Code Execution Vulnerability 9.8 Critical
- lenovo xclarity orchestrator (lxco) An internal product security audit of Lenovo XClarity Orchestrator (LXCO) discovered the below... 8.7 High
- microsoft windows The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control... 7.4 High
- es iperf3 In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in... 8.9 High
- crushftp CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used,... 9.0 Critical
- freedesktop xdg-utils xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which... 2.7 Low
- innocommerce innoshop In Innoshop through 0.4.1, an authenticated attacker could exploit the File Manager functions in... 9.9 Critical
- ibm personal communications IBM Personal Communications command execution 8.8 High
- huawei pt9030-15, pt9030-15 firmware, ws7206-10 +15 more +17 more A connection hijacking vulnerability exists in some Huawei home routers. Successful exploitation... 6.4 Medium
- huawei tc7001-10, tc7001-10 firmware, ws7200-10 +3 more +5 more Some Huawei home routers have a connection hijacking vulnerability. Successful exploitation of... 7.5 High
- ericsson codechecker codechecker vulnerable to authentication bypass when using specifically crafted URLs 10.0 Critical
- canonical juju Vulnerable juju introspection abstract UNIX domain socket 7.9 High
- rockwell automation 1756-en2f, 1756-en2t, 1756-en2tp +5 more +7 more Rockwell Automation Chassis Restrictions Bypass Vulnerability in Select Logix Devices 7.3 High
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 more LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Unauthenticated Bypass to User Registration 5.3 Medium
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 more LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Bypass to User Registration 5.3 Medium
- cisco ios xe software, ios xe, ios xe web ui +2 more +4 more Cisco is aware of active exploitation of a previously unknown vulnerability in the web UI feature... 10.0 Critical
- ni measurementlink Improper Restriction in NI MeasurementLink Python Services 8.8 High
- palantir foundry issues, com.palantir.issues:issues +1 more Issues notification metadata lacks authorization 3.5 Low
- snap one ovrc cloud, snapone orvc +1 more Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and... 8.6 High
- secomea gatemanager GateManager debug interface is included in non-debug builds 4.9 Medium
- moby moby/moby's dockerd daemon encrypted overlay network may be unauthenticated 7.5 High
- moby moby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticated 6.8 Medium
-
kernelRed Hat,bpftoolRed Hat,bpftool-debuginfoRed Hat +217 more +219 more Red Hat Security Advisory: kernel security, bug fix, and enhancement update 4.7 Medium - secomea gatemanager GateManager debug interface is included in production builds 4.9 Medium
- kubernetes Kubernetes node setting allows for neighboring hosts to bypass localhost boundary 5.4 Medium