Browse / Other weaknesses

Other weaknesses

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Unclassified630
• Use of Incorrectly-Resolved Name or Reference4
• File Manipulation1
• Insecure Default Initialization of Resource1
• Improper Initialization1
• Reachable Assertion1
• Reusing Session IDs (aka Session Replay)1
• Unchecked Error Condition1
• Misinterpretation of Input1
• ASI05: Unexpected Code Execution (RCE)1
• LLM09:2025 Misinformation1
• Improper Resource Shutdown or Release1
• Improper Handling of Case Sensitivity1
• Improper Handling of Unexpected Data Type1
• Server Side Request Forgery1
• LLM05: Supply Chain Vulnerabilities1
• Improper Handling of Unicode Encoding1
• Improper Handling of Highly Compressed Data (Data Amplification)1
• Encoding Error1
• Embedded Malicious Code1
• Improper Validation of Syntactic Correctness of Input1
• Wrap-around Error1
• Inconsistency Between Implementation and Documented Design1
• Improper Synchronization1

Most upvoted Other weaknesses reports

AllValidInformativeN/ADuplicate

1. Direct IP Access to WebsiteInformativecritical · Lichess
   95 votes
2. admin.shopify.com: Shopify Flow continues sending internal emails to a configured recipient after the staff author is removedInformativeShopify
   78 votes
3. CWE-195 in ExternalMemoryAccounter::Increase()InformativeNode.js
   55 votes
4. Bedrock Guardrails Evasion with Prompt FormattingInformativeAWS VDP
   53 votes
5. The taint flag is not propagated at JSON.parseInformativeRuby
   40 votes
6. Windows filename sanitizer misses Unicode COM/LPT reserved device namesInformativecurl
   35 votes
7. Credentials forwarded to HTTP after HTTPS→HTTP same-port redirect — url_set_data_creds uses scheme-blind comparatorInformativecurl
   35 votes
8. MQTT CONNACK Packet Type Bypass leads to RCE via Malicious BrokerInformativeASI05: Unexpected Code Execution (RCE) · critical · curl
   31 votes
9. IMAP connection reuse runs requests in the wrong case-sensitive mailboxInformativeImproper Handling of Case Sensitivity · low · curl
   22 votes
10. Health check errors silently dropped when channel buffer fullInformativeAWS VDP
    22 votes
11. 27: IMAP custom FETCH listing classification skips literal boundaries, enabling response desynchronizationInformativecurl
    18 votes
12. Socket API drops expired timeouts for transfers queued behind a connection limitInformativecurl
    14 votes
13. Unbound cross-peer HTTP Digest challenge stateInformativemedium · curl
    13 votes
14. Apple SecTrust fallback ignores CURLOPT_CRLFILE, letting a revoked cert passInformativelow · curl
    12 votes
15. 33: CONNECT_ONLY raw I/O selects wrong connection after CURLOPT_SHARE detach (incomplete fix for CVE-2020-8231)Informativecurl
    12 votes
16. Missing restriction on string size of Full Name at browser.blockstack.orgInformativeHiro
    12 votes
17. Users can make accounts with a fake email address.Informativelow · Khan Academy
    11 votes
18. IMAP literal size truncation on 32-bit platforms corrupts downloads and desynchronizes the response parserInformativehigh · curl
    9 votes
19. Exceed photo dimensions, Flickr.comInformativelow · Flickr
    9 votes
20. Report Regarding Security VulnerabilityInformativeTor
    9 votes
21. 2 Cache Poisoning Attack Methods Affect Core Functionality www.exodus.comInformativehigh · Exodus
    7 votes
22. Ajouter le même utilisateur que celui déjà inscrit dans les équipesInformativeHackerOne
    7 votes
23. Email abuse and Referral AbuseInformativemedium · Unikrn
    7 votes
24. 43: HTTP proxy CONNECT header chooses the `-OJ` filename after a redirectInformativecurl
    6 votes
25. Broken links make users from France unable to understand the allowed content policyInformativeReddit
    6 votes
26. Feature-Policy Header is Missing and Pastebin filesInformativearkadiyt-projects
    6 votes
27. 2 vulns InformativeLegal Robot
    6 votes
28. Logical Issue (Boosting Reputation points)InformativeHackerOne
    6 votes
29. harvesting attack on user registrationInformativeHackerOne
    6 votes
30. `settingcontent-ms` files lacks "mark of the web" => execute code by dbl click in Downloads toolbarInformativelow · Brave Software
    5 votes
31. Drone NextcloudInformativeNextcloud
    5 votes
32. --etag-save - truncates append-redirected stdoutInformativelow · curl
    4 votes
33. [unikrn.com] Profile updated with error":true,"success":false"InformativeUnikrn
    4 votes
34. Cross-origin resource sharingInformativehigh · Semrush
    4 votes
35. JavaScript URL Issues in the latest version of Brave BrowserInformativemedium · Brave Software
    4 votes
36. 46: `--libcurl` output carries `--insecure` across `--next` boundariesInformativecurl
    3 votes
37. 36: HTTP upload resume offset consumed twice after early 307/308 redirectInformativecurl
    3 votes
38. 28: HTTP/3 UDP path ignores CURL_SOCKOPT_ALREADY_CONNECTED, reconnects callback-provided socketInformativelow · curl
    3 votes
39. Stacked --proto modifiers leave denied protocol enabledInformativelow · curl
    3 votes
40. hosted.weblate.org display of unfiltered resultsInformativeWeblate
    3 votes
41. Default Nextcloud allows http federated sharesInformativemedium · Nextcloud
    3 votes
42. Improper validation of unicode characters#2InformativeWeblate
    3 votes
43. No alert in verify email address with wrong inputInformativeLegal Robot
    3 votes
44. Showing Up Source CodeInformativeUdemy
    3 votes
45. Own downloading link isn't properly checked in the email templateInformativeDigitalSellz
    3 votes
46. Improper validation of Email InformativeParagon Initiative Enterprises
    2 votes
47. Content type incorrectly statedInformativeGratipay
    2 votes
48. CSSInformativeEternal
    2 votes
49. Balance Manipulation - BUGInformativeCoinbase
    2 votes
50. Option Method Enabled on web serverInformativeX / xAI
    2 votes
51. Mass invitation sendInformativeUzbey
    2 votes
52. IFRAME loaded from External Domains InformativeCoinbase
    2 votes
53. XST(Cross Site Tracing)InformativeInflection
    1 votes
54. Weak crossdomain.xmlInformativeHiro
    1 votes
55. New Device Confirmation BugInformativeCoinbase
    1 votes
56. Invalid Email VerificationInformativelow · Legal Robot
    1 votes
57. Tampering the mail id on chatboxInformativeLegal Robot
    1 votes
58. This is not the security issue.InformativeownCloud
    1 votes
59. LUCKY13 (CVE-2013-0169) effects legalrobot.comInformativeLegal Robot
    1 votes
60. Create Api Key is not workingInformativemedium · Legal Robot
    1 votes
61. There is an vulnerability in https://bridge.cspr.ng where an attacker can users directoryInformativemedium · Paragon Initiative Enterprises
    1 votes
62. Missing GIT tag/commit verification in DockerInformativeParagon Initiative Enterprises
    1 votes
63. Error Message on 404 pageInformativeUber
    1 votes
64. developer.uber.com/404 and developer.uber.com/docs/404 are susceptible to iframesInformativeUber
    1 votes
65. Options Method EnabledInformativeX / xAI
    1 votes
66. Tor Browser: iframe with `data:` uri has access to parent windowInformativehigh · Tor
67. Invalid URL parsing '#'InformativeRuby
68. Improper error messageInformativemedium · Legal Robot
69. Special characters are not filtered out on profile fields InformativeLegal Robot
70. Device confirmation FlawInformativeCoinbase
71. Non-secure requests are not automatically upgraded to HTTPSInformativeLegal Robot