Incomplete in the CWE catalog · 25 CVEs mapped
[PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES AND CONSIDER CWE-252, CWE-248, OR CWE-1069.] Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.
openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available encapsulated key data. Attackers who obtain 16 bytes of the private key can compute the shared secret and decrypt all ciphertext, as the fallback triggers on any KEM failure without raising an error.
picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling STACK_GLOBAL opcodes, failing to track arguments in the correct range and allowing malicious pickle files to bypass detection. Attackers can craft pickle files with arguments at position zero to trigger unexpected exceptions and evade security scanning.
🚨 A configuration quirk in Apache Tomcat could let users waltz right past authentication, all because of an unchecked error condition! 🔥 Think of it like a hotel where a guest checks in but the front desk clerk forgets to ask for identification. In this case, the system fails to indicate a failed authentication attempt, so anyone can stroll right in without proper clearance! An attacker could potentially bypass authentication entirely, granting access to sensitive applications or data, which could be absolutely devastating for your system's security! Imagine unauthorized users mingling in your private space, wreaking havoc without any signs of their entry!