Unexpected Status Code or Return Value
CWE-394
The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.
We track 6 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.9. 1 has been exploited in real attacks.
Latest Unexpected Status Code or Return Value vulnerabilities
- 8.1 High severity
OpenBSD OpenSSH Unexpected Status Code or Return Value Exploited
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any p
- 7.5 High severity
libexpat: Unexpected Status Code or Return Value
In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.
- 9.8 Critical severity
Copeland XWEB 300D PRO: Unexpected Status Code or Return Value
A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in which an unexpected return value from the authentication routine is later on processed as a legitimate value, resulting in an authentication bypass.
- 7.3 High severity
pam-u2f: Unexpected Status Code or Return Value
In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be deployed to support authentication using a YubiKey or other FIDO compliant authenticators on macOS or Li
- 7.2 High severity
Plv8: Improper Check for Unusual or Exceptional Conditions
A user who can create objects in a database with plv8 3.2.1 installed is able to cause deferred triggers to execute as the Superuser during autovacuum.
- 7.5 High severity
Experion Server: Generation of Error Message Containing Sensitive Information
Server information leak of configuration data when an error is generated in response to a specially crafted message. See Honeywell Security Notification for recommendations on upgrading and versioning.