Expected Behavior Violation
CWE-440
A feature, API, or function does not perform according to its specification.
We track 11 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.1.
Latest Expected Behavior Violation vulnerabilities
- 9.6 Critical severity
EOS: Expected Behavior Violation
On affected Arista EOS platforms with Routing Information Protocol version 2 (RIPv2) configured, under certain conditions, RIPv2 might be silently enabled on management interfaces even when the RIP agent intends to disable it. It allows an unauthenticated atta
- 7.5 High severity
EOS: Expected Behavior Violation
On affected platforms running Arista EOS with Border Gateway Protocol (BGP) configured, An unauthenticated attacker who can establish a BGP peering session with an affected device and can send specially crafted BGP messages to cause repeated BGP session resets
- 8.1 High severity
urllib3: Improper Certificate Validation
urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain
- 7.1 High severity
WiseCnnect: Expected Behavior Violation
An unencrypted 'pause encryption request' message causes a denial of service in the in the RS9116W/SiWx917. See vulnerability B-E10 in the related paper below.
- 8.7 High severity
Mitsubishi Electric MELSEC iQ-F Series…: Expected Behavior Violation
Expected Behavior Violation vulnerability in Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP all versions allows a remote attacker to cause a denial-of-service (DoS) condition in the affected product by continuously sending a lar
- 8.8 High severity
danny-avila/librechat: Expected Behavior Violation
In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA) flow. The system allows users to disable 2FA without requiring a valid OTP or backup code, bypassing the intended verification process. This vuln
- 9.0 Critical severity
router: Expected Behavior Violation
Apollo Router is a configurable, graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. The affected versions of Apollo Router contain a bug that in limited circumstances, could lead to unexpected operations being executed wh
- 7.1 High severity
tuleap: Expected Behavior Violation
Tuleap is an Open Source Suite to improve management of software developments and collaboration. A malicious user could exploit this issue on purpose to delete information on the instance or possibly gain access to restricted artifacts. It is however not possi
- 7.8 High severity
OpenSSL: Expected Behavior Violation
Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions. Impact
- 7.5 High severity
gRPC: Expected Behavior Violation
When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say
- 7.5 High severity
750-81xx/xxx-xxx Series PFC100/PFC200: Expected Behavior Violation
WAGO Series PFC100/PFC200, Series Touch Panel 600, Compact Controller CC100 and Edge Controller in multiple versions are prone to a loss of MAC-Address-Filtering after reboot. This may allow an remote attacker to circumvent the reach the network that should be