Incorrectly Specified Destination in a Communication Channel
CWE-941
The product creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor.
We track 5 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.5.
Latest Incorrectly Specified Destination in a Communication Channel vulnerabilities
- 7.5 High severity
FreeBSD: Incorrectly Specified Destination in a Communication Channel
The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. A process in a classic (non-VNET) jail can send UDP datagrams to services listening on the host's IPv6
- 7.2 High severity
guzzle: Incorrect Behavior Order: Validate Before Canonicalize
Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPT_URL to the URI exactly as written and push that Host into CURLOPT_HTTPHE
- 7.2 High severity
security-advisories: Incorrectly Specified Destination in a Communication Channel
Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incorrectly specified destination in a communication channel which allows an attacker with administrative privileges on the
- 8.1 High severity
ip: Server-Side Request Forgery
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of a
- 7.5 High severity
tgstation-server: Incorrectly Specified Destination in a Communication Channel
tgstation-server is a production scale tool for BYOND server management. The DreamMaker API (DMAPI) chat channel cache can possibly be poisoned by a tgstation-server (TGS) restart and reattach. This can result in sending chat messages to one of any of the conf