Incorrect Provision of Specified Functionality
CWE-684
The code does not function according to its published specifications, potentially leading to incorrect usage.
We track 13 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.4.
How this weakness is prevented
- Implementation: Ensure that your code strictly conforms to specifications.
Latest Incorrect Provision of Specified Functionality vulnerabilities
- 9.1 Critical severity
Apache Commons Codec: Incorrect Provision of Specified Functionality
Apache Commons Codec's Blake3 class documented the output of its doFinalize methods as depending on any previously finalized bytes, so that consecutive calls would return different output. In fact, doFinalize does not change the hash state: calling it again wi
- 9.3 Critical severity
zebra: Incorrect Provision of Specified Functionality
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, Zebra can accept a block that zcashd rejects because the P2SH signature-operation counter undercounts redeem scripts containing a disabled opcode followed by signature opcodes. In zebra-script/src
- 9.8 Critical severity
Exim: Out-of-bounds Write
In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, because of an incorrect implementation of \ skipping.
- 7.5 High severity
Exim: Incorrect Provision of Specified Functionality
In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.
- 7.5 High severity
Apache Log4j Core: Improper Output Neutralization for Logs
Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attri
- 7.5 High severity
RustDesk Server Pro: Use of a Broken or Risky Cryptographic Algorithm
Use of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-server-pro RustDesk Server Pro rustdesk-server-pro on Windows, MacOS, Linux (Config string generation, web console export modules) allows Retrieve Embedded Sensitive Data. This vulnerab
- 7.5 High severity
RustDesk Client: Use of a Broken or Risky Cryptographic Algorithm
Use of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Config import, URI scheme handler, CLI --config modules) allows Retrieve Embedded Sensitive Dat
- 7.5 High severity
ScriptCase: Incorrect Provision of Specified Functionality
In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authenti
- 9.8 Critical severity
FutureNet NXR-G110 series: Incorrect Provision of Specified Functionality
FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial (factory default) configuration. But, REST-APIs are unexpectedly enabled when the affected product is powered up, provided either
- 7.4 High severity
Cisco IOS XR Software: Incorrect Provision of Specified Functionality
A vulnerability in the handling of specific Ethernet frames by Cisco IOS XR Software for various Cisco Network Convergence System (NCS) platforms could allow an unauthenticated, adjacent attacker to cause critical priority packets to be dropped, resulting in a
- 9.1 Critical severity
MESbook: Incorrect Provision of Specified Functionality
Incorrect Provision of Specified Functionality vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can register user accounts without being authenticated from the route "/account/Register/" and in the parameters "UserName=<RANDOMUS
- 7.5 High severity
OpenSSL: Incorrect Provision of Specified Functionality
Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A truncation in the IV can result i
- 9.8 Critical severity
RUGGEDCOM i800: Incorrect Provision of Specified Functionality
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2100NC, RUGGEDCOM M2200, RUGGEDCOM M220