CWE-420 · Unprotected Alternate Channel

38 CVEs classified under CWE-420 (Unprotected Alternate Channel). Browse by severity and year.

Top CVEs for CWE-420
CVESeverityScorePublishedSummary
CVE-2024-10081Critical10.02024-11-06CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the A…
CVE-2023-20198Critical10.02023-10-16Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list…
CVE-2025-52921Critical9.92025-06-23In Innoshop through 0.4.1, an authenticated attacker could exploit the File Manager functions in the admin panel to achieve code execution on the server, by up…
CVE-2025-13315Critical9.82025-11-19Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication control…
CVE-2025-54309Critical9.02025-07-18CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers t…
CVE-2025-54351High8.92025-08-03In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).
CVE-2026-40217High8.82026-04-10LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.
CVE-2025-62001High8.82025-12-18BullWall Ransomware Containment supports configurable file and directory exclusions such as '$RECYCLE.BIN' to balance monitoring scope and performance. Certain…
CVE-2025-8557High8.82025-09-11An internal product security audit of Lenovo XClarity Orchestrator (LXCO) discovered the below vulnerability: An attacker with access to a device on the local…
CVE-2025-1095High8.82025-04-08IBM Personal Communications v14 and v15 include a Windows service that is vulnerable to local privilege escalation (LPE). The vulnerability allows any interact…
CVE-2023-4570High8.82023-10-05An improper access restriction in NI MeasurementLink Python services could allow an attacker on an adjacent network to reach services exposed on localhost. Th…
CVE-2023-31241High8.62023-05-22Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and claim devices outright.
CVE-2025-53967High8.02025-10-08Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system commands via a crafted HTTP POST reques…
CVE-2024-8038High7.92024-10-02Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication loc…
CVE-2025-41727High7.82026-01-27A local low privileged attacker can bypass the authentication of the Device Manager user interface, allowing them to perform privileged operations and gain adm…
CVE-2025-67303High7.52026-01-05An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the a…
CVE-2023-7266High7.52024-12-28Some Huawei home routers have a connection hijacking vulnerability. Successful exploitation of this vulnerability may cause DoS or information leakage.(Vulnera…
CVE-2023-28840High7.52023-04-04Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream pro…
CVE-2025-59033High7.42025-09-08The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. Entries that specify only the to-be-signed (TB…
CVE-2023-28842Medium6.82023-04-04Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream pr…
All CVEs classified under CWE-420 — newest first (page 1 of 1)
CVESeverityScorePublishedSummary
CVE-2026-77639Medium5.32026-08-20Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream det…
CVE-2026-40435Medium5.32026-05-13When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses.  Note: Software version…
CVE-2026-43505Medium6.52026-05-01An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access con…
CVE-2026-40217High8.82026-04-10LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.
CVE-2026-35388Low2.52026-04-02OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.
CVE-2026-25916Medium4.32026-02-09Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.
CVE-2025-41727High7.82026-01-27A local low privileged attacker can bypass the authentication of the Device Manager user interface, allowing them to perform privileged operations and gain adm…
CVE-2025-67303High7.52026-01-05An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the a…
CVE-2025-62001High8.82025-12-18BullWall Ransomware Containment supports configurable file and directory exclusions such as '$RECYCLE.BIN' to balance monitoring scope and performance. Certain…
CVE-2025-66432Medium5.02025-11-30In Oxide control plane 15 through 17 before 17.1, API tokens can be renewed past their expiration date.
CVE-2025-13315Critical9.82025-11-19Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication control…
CVE-2025-56558Low3.02025-10-29The Dyson MQTT server (2022 and possibly later) allows publications and subscriptions by a client that has the correct values of AWS_ACCESS_KEY_ID, AWS_SECRET_…
CVE-2025-62820Medium4.92025-10-23Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.
CVE-2025-53967High8.02025-10-08Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system commands via a crafted HTTP POST reques…
CVE-2025-8557High8.82025-09-11An internal product security audit of Lenovo XClarity Orchestrator (LXCO) discovered the below vulnerability: An attacker with access to a device on the local…
CVE-2025-59033High7.42025-09-08The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. Entries that specify only the to-be-signed (TB…
CVE-2025-54351High8.92025-08-03In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).
CVE-2025-54309Critical9.02025-07-18CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers t…
CVE-2025-52968Low2.72025-06-23xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (For example, xdg-open could be modified t…
CVE-2025-52921Critical9.92025-06-23In Innoshop through 0.4.1, an authenticated attacker could exploit the File Manager functions in the admin panel to achieve code execution on the server, by up…
CVE-2025-1095High8.82025-04-08IBM Personal Communications v14 and v15 include a Windows service that is vulnerable to local privilege escalation (LPE). The vulnerability allows any interact…
CVE-2022-28693Medium4.72025-02-14Unprotected alternative channel of return branch target prediction in some Intel(R) Processors may allow an authorized user to potentially enable information d…
CVE-2023-52718Medium6.42024-12-28A connection hijacking vulnerability exists in some Huawei home routers. Successful exploitation of this vulnerability may cause DoS or information leakage.(Vu…
CVE-2023-7266High7.52024-12-28Some Huawei home routers have a connection hijacking vulnerability. Successful exploitation of this vulnerability may cause DoS or information leakage.(Vulnera…
CVE-2024-10081Critical10.02024-11-06CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the A…
CVE-2024-8038High7.92024-10-02Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication loc…
CVE-2024-62422024-08-01A vulnerability exists in Rockwell Automation affected products that allows a threat actor to bypass the Trusted® Slot feature in a ControlLogix® controller. I…
CVE-2024-6099Medium5.32024-07-02The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthenticated bypass to user registration in versions up to, and including, 4.2.6…
CVE-2024-4444Medium5.32024-05-14The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 4.2.6.5. This is due…
CVE-2023-20198Critical10.02023-10-16Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list…
CVE-2023-4570High8.82023-10-05An improper access restriction in NI MeasurementLink Python services could allow an attacker on an adjacent network to reach services exposed on localhost. Th…
CVE-2023-30946Low3.52023-06-29A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not s…
CVE-2023-31241High8.62023-05-22Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and claim devices outright.
CVE-2023-0317Medium4.92023-04-19Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information.
CVE-2023-28842Medium6.82023-04-04Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream pr…
CVE-2023-28840High7.52023-04-04Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream pro…
CVE-2022-25786Medium4.92022-05-04Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information. This issue affects: Ga…
CVE-2020-8558Medium5.42020-07-27The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent…