Draft in the CWE catalog · 40 CVEs mapped
The product protects a primary channel, but it does not use the same level of protection for an alternate channel.
No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.
Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on which those controls, including enforcement of signed-out and revoked sessions, were not applied.
An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.