CWE-670
Allowed-with-ReviewAlways-Incorrect Control Flow Implementation
Abstraction: Class · Status: Draft
The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
217 vulnerabilities reference this CWE, most recent first.
GHSA-256G-W77V-WXMX
Vulnerability from github – Published: 2025-03-24 21:30 – Updated: 2025-03-26 15:32An issue in onos v2.7.0 allows attackers to trigger unexpected behavior within a device connected to a legacy switch via changing the link type from indirect to direct.
{
"affected": [],
"aliases": [
"CVE-2025-29312"
],
"database_specific": {
"cwe_ids": [
"CWE-670"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-24T21:15:18Z",
"severity": "CRITICAL"
},
"details": "An issue in onos v2.7.0 allows attackers to trigger unexpected behavior within a device connected to a legacy switch via changing the link type from indirect to direct.",
"id": "GHSA-256g-w77v-wxmx",
"modified": "2025-03-26T15:32:36Z",
"published": "2025-03-24T21:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29312"
},
{
"type": "WEB",
"url": "https://gist.github.com/Saber-Berserker/4e54c2aa70abab2b133ce2c2b7e91249"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2595-PF9F-6G58
Vulnerability from github – Published: 2026-03-03 09:30 – Updated: 2026-05-04 15:31Always-Incorrect Control Flow Implementation vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP versions 1.106 and prior and Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP all versions allows a remote attacker to cause a denial-of-service (DoS) condition on the products by continuously sending UDP packets to the products. A system reset of the product is required for recovery.
{
"affected": [],
"aliases": [
"CVE-2026-1874"
],
"database_specific": {
"cwe_ids": [
"CWE-670"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-03T07:16:10Z",
"severity": "HIGH"
},
"details": "Always-Incorrect Control Flow Implementation vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP versions 1.106 and prior and Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP all versions allows a remote attacker to cause a denial-of-service (DoS) condition on the products by continuously sending UDP packets to the products. A system reset of the product is required for recovery.",
"id": "GHSA-2595-pf9f-6g58",
"modified": "2026-05-04T15:31:07Z",
"published": "2026-03-03T09:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1874"
},
{
"type": "WEB",
"url": "https://jvn.jp/vu/JVNVU93286687"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-62-01"
},
{
"type": "WEB",
"url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-021_en.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-26PG-G54Q-JV62
Vulnerability from github – Published: 2026-04-12 21:30 – Updated: 2026-04-12 21:30Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certain amounts of prefetched data. The setup of an HTTP/2 session starts with a speculative HTTP/1 transport, and upon upgrading to h2 the HTTP/1 request is repurposed as stream zero. During the upgrade, a buffer allocation is made to reserve space to send frames to the client. This allocation would split the original workspace, and depending on the amount of prefetched data, the next fetch could perform a pipelining operation that would run out of workspace.
{
"affected": [],
"aliases": [
"CVE-2026-40394"
],
"database_specific": {
"cwe_ids": [
"CWE-670"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-12T20:16:17Z",
"severity": "MODERATE"
},
"details": "Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a \"workspace overflow\" denial of service (daemon panic) for certain amounts of prefetched data. The setup of an HTTP/2 session starts with a speculative HTTP/1 transport, and upon upgrading to h2 the HTTP/1 request is repurposed as stream zero. During the upgrade, a buffer allocation is made to reserve space to send frames to the client. This allocation would split the original workspace, and depending on the amount of prefetched data, the next fetch could perform a pipelining operation that would run out of workspace.",
"id": "GHSA-26pg-g54q-jv62",
"modified": "2026-04-12T21:30:19Z",
"published": "2026-04-12T21:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40394"
},
{
"type": "WEB",
"url": "https://docs.varnish-software.com/security/VEV00002"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-27C2-9CC9-22V7
Vulnerability from github – Published: 2022-05-24 17:29 – Updated: 2022-05-24 17:29An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels control structures can be accessed lockless as long as the port is considered to be valid. Such a sequence is missing an appropriate memory barrier (e.g., smp_*mb()) to prevent both the compiler and CPU from re-ordering access. A malicious guest may be able to cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded. Systems running all versions of Xen are affected. Whether a system is vulnerable will depend on the CPU and compiler used to build Xen. For all systems, the presence and the scope of the vulnerability depend on the precise re-ordering performed by the compiler used to build Xen. We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code generation options). GCC documentation clearly suggests that re-ordering is possible. Arm systems will also be vulnerable if the CPU is able to re-order memory access. Please consult your CPU vendor. x86 systems are only vulnerable if a compiler performs re-ordering.
{
"affected": [],
"aliases": [
"CVE-2020-25603"
],
"database_specific": {
"cwe_ids": [
"CWE-401",
"CWE-670"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-09-23T22:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels control structures can be accessed lockless as long as the port is considered to be valid. Such a sequence is missing an appropriate memory barrier (e.g., smp_*mb()) to prevent both the compiler and CPU from re-ordering access. A malicious guest may be able to cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded. Systems running all versions of Xen are affected. Whether a system is vulnerable will depend on the CPU and compiler used to build Xen. For all systems, the presence and the scope of the vulnerability depend on the precise re-ordering performed by the compiler used to build Xen. We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code generation options). GCC documentation clearly suggests that re-ordering is possible. Arm systems will also be vulnerable if the CPU is able to re-order memory access. Please consult your CPU vendor. x86 systems are only vulnerable if a compiler performs re-ordering.",
"id": "GHSA-27c2-9cc9-22v7",
"modified": "2022-05-24T17:29:23Z",
"published": "2022-05-24T17:29:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25603"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4JRXMKEMQRQYWYEPHVBIWUEAVQ3LU4FN"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DA633Y3G5KX7MKRN4PFEGM3IVTJMBEOM"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJZERRBJN6E6STDCHT4JHP4MI6TKBCJE"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202011-06"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4769"
},
{
"type": "WEB",
"url": "https://xenbits.xen.org/xsa/advisory-340.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00008.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-27VH-H6MC-Q6G8
Vulnerability from github – Published: 2024-10-10 16:43 – Updated: 2025-08-21 04:05Impact
The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality. This logic is consensus-critical: the difference in behavior with the other Bitcoin clients can lead to btcd clients accepting an invalid Bitcoin block (or rejecting a valid one).
This consensus failure can be leveraged to cause a chain split (accepting an invalid Bitcoin block) or be exploited to DoS the btcd nodes (rejecting a valid Bitcoin block). An attacker can create a standard transaction where FindAndDelete doesn't return a match but removeOpCodeByData does making btcd get a different sighash, leading to a chain split. Importantly, this vulnerability can be exploited remotely by any Bitcoin user and does not require any hash power. This is because the difference in behavior can be triggered by a "standard" Bitcoin transaction, that is a transaction which gets relayed through the P2P network before it gets included in a Bitcoin block.
FindAndDelete vs. removeOpcodeByData
removeOpcodeByData(script []byte, dataToRemove []byte) removes any data pushes from script that contain dataToRemove. However, FindAndDelete only removes exact matches. So for example, with script = "<data> <data||foo>" and dataToRemove = "data" btcd will remove both data pushes but Bitcoin Core's FindAndDelete only removes the first <data> push.
Patches
This has been patched in btcd version v0.24.2-beta.
References
FindAndDelete: https://github.com/btcsuite/btcd/security/advisories/GHSA-27vh-h6mc-q6g8
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/btcsuite/btcd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.24.2-beta.rc1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-38365"
],
"database_specific": {
"cwe_ids": [
"CWE-670"
],
"github_reviewed": true,
"github_reviewed_at": "2024-10-10T16:43:17Z",
"nvd_published_at": "2024-10-11T20:15:04Z",
"severity": "HIGH"
},
"details": "### Impact\n\nThe btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement Bitcoin Core\u0027s \"FindAndDelete()\" functionality. This\nlogic is consensus-critical: the difference in behavior with the other Bitcoin clients can lead to btcd clients accepting an invalid Bitcoin block (or rejecting a valid one). \n\nThis consensus failure can be leveraged to cause a chain split (accepting an invalid Bitcoin block) or be exploited to DoS the btcd nodes (rejecting a valid Bitcoin block). An attacker can create a standard transaction where FindAndDelete doesn\u0027t return a match but removeOpCodeByData does making btcd get a different sighash, leading to a chain split. Importantly, this vulnerability can be exploited remotely by any Bitcoin user and does not require any hash power. This is because the difference in behavior can be triggered by a \"standard\" Bitcoin\ntransaction, that is a transaction which gets relayed through the P2P network before it gets included in a Bitcoin block.\n\n#### `FindAndDelete` vs. `removeOpcodeByData`\n\n`removeOpcodeByData(script []byte, dataToRemove []byte)` removes any data pushes from `script` that *contain* `dataToRemove`. However, `FindAndDelete` only removes *exact* matches. So for example, with `script = \"\u003cdata\u003e \u003cdata||foo\u003e\"` and `dataToRemove = \"data\"` btcd will remove both data pushes but Bitcoin Core\u0027s `FindAndDelete` only removes the first `\u003cdata\u003e` push.\n\n\n### Patches\n\nThis has been patched in `btcd` version v0.24.2-beta. \n\n### References\n\n`FindAndDelete`: https://github.com/btcsuite/btcd/security/advisories/GHSA-27vh-h6mc-q6g8",
"id": "GHSA-27vh-h6mc-q6g8",
"modified": "2025-08-21T04:05:13Z",
"published": "2024-10-10T16:43:17Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/btcsuite/btcd/security/advisories/GHSA-27vh-h6mc-q6g8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38365"
},
{
"type": "WEB",
"url": "https://github.com/btcsuite/btcd/commit/04469e600e7d4a58881e2e5447d19024e49800f5"
},
{
"type": "WEB",
"url": "https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug/1184"
},
{
"type": "PACKAGE",
"url": "https://github.com/btcsuite/btcd"
},
{
"type": "WEB",
"url": "https://github.com/btcsuite/btcd/releases/tag/v0.24.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "btcd did not correctly re-implement Bitcoin Core\u0027s \"FindAndDelete()\" functionality"
}
GHSA-28XX-PPPM-VQFF
Vulnerability from github – Published: 2026-04-30 18:21 – Updated: 2026-06-08 20:10Impact
Transactions were NOT committed despite the explicit options.WithCommit flag using table service client. Because of this, clients did not commit changes to the transaction, relying on the fact that the transaction commit was successful. This led (in rare cases) to a loss of data consistency.
Patches
ydb-go-sdk contains this problem in versions from v3.104.6 to v3.134.1. The fix for this problem has been released in version v3.134.2 (https://github.com/ydb-platform/ydb-go-sdk/pull/2091).
Workarounds
1) Use explicit table.Transaction.CommitTx(ctx) instead use options.WithCommit().
2) Use transaction retrier db.Table().DoTx(ctx, lambda) instead explicit start transaction on session.
3) Use query client db.Query().Do(ctx, lambda) with the same logic in lambda
Resources
Commit with bug https://github.com/ydb-platform/ydb-go-sdk/commit/251128a64763555d9a79ee7a131dd154c9000eb9 Commit with fix https://github.com/ydb-platform/ydb-go-sdk/commit/25dcff4c41153f1f9413512ba12999b40bf7154d
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.134.1"
},
"package": {
"ecosystem": "Go",
"name": "github.com/ydb-platform/ydb-go-sdk/v3"
},
"ranges": [
{
"events": [
{
"introduced": "3.104.6"
},
{
"fixed": "3.134.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-670"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-30T18:21:04Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "### Impact\nTransactions were NOT committed despite the explicit `options.WithCommit` flag using table service client. Because of this, clients did not commit changes to the transaction, relying on the fact that the transaction commit was successful. This led (in rare cases) to a loss of data consistency.\n\n### Patches\n`ydb-go-sdk` contains this problem in versions from [v3.104.6](https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.104.6) to [v3.134.1](https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.134.1). The fix for this problem has been released in version [v3.134.2](https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.134.2) (https://github.com/ydb-platform/ydb-go-sdk/pull/2091).\n\n### Workarounds\n1) Use explicit `table.Transaction.CommitTx(ctx)` instead use `options.WithCommit()`.\n2) Use transaction retrier `db.Table().DoTx(ctx, lambda)` instead explicit start transaction on session.\n3) Use query client `db.Query().Do(ctx, lambda)` with the same logic in `lambda`\n\n### Resources\nCommit with bug https://github.com/ydb-platform/ydb-go-sdk/commit/251128a64763555d9a79ee7a131dd154c9000eb9\nCommit with fix https://github.com/ydb-platform/ydb-go-sdk/commit/25dcff4c41153f1f9413512ba12999b40bf7154d",
"id": "GHSA-28xx-pppm-vqff",
"modified": "2026-06-08T20:10:28Z",
"published": "2026-04-30T18:21:04Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ydb-platform/ydb-go-sdk/security/advisories/GHSA-28xx-pppm-vqff"
},
{
"type": "WEB",
"url": "https://github.com/ydb-platform/ydb-go-sdk/pull/2091"
},
{
"type": "WEB",
"url": "https://github.com/ydb-platform/ydb-go-sdk/commit/251128a64763555d9a79ee7a131dd154c9000eb9"
},
{
"type": "WEB",
"url": "https://github.com/ydb-platform/ydb-go-sdk/commit/25dcff4c41153f1f9413512ba12999b40bf7154d"
},
{
"type": "PACKAGE",
"url": "https://github.com/ydb-platform/ydb-go-sdk"
},
{
"type": "WEB",
"url": "https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.104.6"
},
{
"type": "WEB",
"url": "https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.134.1"
},
{
"type": "WEB",
"url": "https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.134.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "ydb-go-sdk\u0027s transactions are not committed using the `options.WithCommit()` option on last call `table.Transaction.Execute` in transaction"
}
GHSA-2C6M-4RMX-M2M7
Vulnerability from github – Published: 2026-08-11 18:30 – Updated: 2026-08-11 18:30Always-incorrect control flow implementation in some firmware for some Intel(R) Xeon(R) processors may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts.
{
"affected": [],
"aliases": [
"CVE-2026-20713"
],
"database_specific": {
"cwe_ids": [
"CWE-670"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-11T17:17:49Z",
"severity": "MODERATE"
},
"details": "Always-incorrect control flow implementation in some firmware for some Intel(R) Xeon(R) processors may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts.",
"id": "GHSA-2c6m-4rmx-m2m7",
"modified": "2026-08-11T18:30:51Z",
"published": "2026-08-11T18:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20713"
},
{
"type": "WEB",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01442.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-2G8X-WXP8-JHPG
Vulnerability from github – Published: 2024-09-25 18:31 – Updated: 2024-09-25 18:31A vulnerability in the DHCP Snooping feature of Cisco IOS XE Software on Software-Defined Access (SD-Access) fabric edge nodes could allow an unauthenticated, remote attacker to cause high CPU utilization on an affected device, resulting in a denial of service (DoS) condition that requires a manual reload to recover.
This vulnerability is due to improper handling of IPv4 DHCP packets. An attacker could exploit this vulnerability by sending certain IPv4 DHCP packets to an affected device. A successful exploit could allow the attacker to cause the device to exhaust CPU resources and stop processing traffic, resulting in a DoS condition that requires a manual reload to recover.
{
"affected": [],
"aliases": [
"CVE-2024-20480"
],
"database_specific": {
"cwe_ids": [
"CWE-670",
"CWE-783"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-25T17:15:17Z",
"severity": "HIGH"
},
"details": "A vulnerability in the DHCP Snooping feature of Cisco IOS XE Software on Software-Defined Access (SD-Access) fabric edge nodes could allow an unauthenticated, remote attacker to cause high CPU utilization on an affected device, resulting in a denial of service (DoS) condition that requires a manual reload to recover. \n\n This vulnerability is due to improper handling of IPv4 DHCP packets. An attacker could exploit this vulnerability by sending certain IPv4 DHCP packets to an affected device. A successful exploit could allow the attacker to cause the device to exhaust CPU resources and stop processing traffic, resulting in a DoS condition that requires a manual reload to recover.",
"id": "GHSA-2g8x-wxp8-jhpg",
"modified": "2024-09-25T18:31:21Z",
"published": "2024-09-25T18:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20480"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sda-edge-dos-MBcbG9k"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-327C-QX3V-H673
Vulnerability from github – Published: 2022-05-24 17:30 – Updated: 2022-06-27 17:05A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fdddfc allows attackers to potentially read out of bounds or theoretically execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.7.1"
},
"package": {
"ecosystem": "npm",
"name": "hermes-engine"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.7.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-1914"
],
"database_specific": {
"cwe_ids": [
"CWE-1119",
"CWE-670"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-24T01:23:21Z",
"nvd_published_at": "2020-10-08T19:15:00Z",
"severity": "CRITICAL"
},
"details": "A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fdddfc allows attackers to potentially read out of bounds or theoretically execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.",
"id": "GHSA-327c-qx3v-h673",
"modified": "2022-06-27T17:05:26Z",
"published": "2022-05-24T17:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1914"
},
{
"type": "WEB",
"url": "https://github.com/facebook/hermes/issues/373"
},
{
"type": "WEB",
"url": "https://github.com/facebook/hermes/commit/b2021df620824627f5a8c96615edbd1eb7fdddfc"
},
{
"type": "PACKAGE",
"url": "https://github.com/facebook/hermes"
},
{
"type": "WEB",
"url": "https://www.facebook.com/security/advisories/cve-2020-1914"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Always-Incorrect Control Flow Implementation in Facebook Hermes"
}
GHSA-3288-5P9J-WPHM
Vulnerability from github – Published: 2023-04-13 09:30 – Updated: 2024-04-04 03:26Memory corruption in modem due to improper input validation while handling the incoming CoAP message
{
"affected": [],
"aliases": [
"CVE-2022-25745"
],
"database_specific": {
"cwe_ids": [
"CWE-670"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-13T07:15:00Z",
"severity": "CRITICAL"
},
"details": "Memory corruption in modem due to improper input validation while handling the incoming CoAP message",
"id": "GHSA-3288-5p9j-wphm",
"modified": "2024-04-04T03:26:50Z",
"published": "2023-04-13T09:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25745"
},
{
"type": "WEB",
"url": "https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.