CWE-440

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "uucore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-440",
      "CWE-693"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-07T19:36:17Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "`determine_backup_mode` in `src/uucore/src/lib/features/backup_control.rs` only checks `--backup`/`-b` and returns `BackupMode::None` when only `--suffix` is given. GNU enables backup mode when `--suffix` is used alone (defaulting to existing/numbered, or `$VERSION_CONTROL`). Affects `cp`, `install`, `mv`, `ln` which share this code.\n\n```\n# uutils: no backup created\n$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created\n# GNU: dest.bak created\n$ cp --suffix=.bak src dest\n```\n\n**Impact:** users/scripts relying on `--suffix` to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when `--suffix` is present.\n\n_Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability \u2014 review whether it warrants a CVE._\n\n**Remediation:** Acknowledged by Canonical; fixed in PR #9741 (`uucore: use --suffix to enable backup mode`), commit `939ab037a`, merged 2025-12-21. `determine_backup_mode` now has a `--suffix`-alone branch that resolves the mode from `$VERSION_CONTROL` (defaulting to `existing`). Released in **uucore 0.6.0** and later (vulnerable: `\u003c 0.6.0`). Regression tests added in the same file: `test_backup_mode_suffix_without_backup_option` and `test_backup_mode_suffix_without_backup_option_with_env_var`.\n\n---\n_Reported by Zellic in the *uutils coreutils Program Security Assessment* (prepared for Canonical, Jan 20 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`. Finding 3.7. Credit: Zellic._",
  "id": "GHSA-fqf6-gxhh-2xhw",
  "modified": "2026-07-07T19:36:17Z",
  "published": "2026-07-07T19:36:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/uutils/coreutils/security/advisories/GHSA-fqf6-gxhh-2xhw"
    },
    {
      "type": "WEB",
      "url": "https://github.com/uutils/coreutils/pull/9741"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/uutils/coreutils"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-2088"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-440"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-05-12T21:15:09Z",
    "severity": "MODERATE"
  },
  "details": "A flaw was found in OpenStack due to an inconsistency between Cinder and Nova. This issue can be triggered intentionally or by accident. A remote, authenticated attacker could exploit this vulnerability by detaching one of their volumes from Cinder. The highest impact is to confidentiality.",
  "id": "GHSA-fvf4-jv3j-73mq",
  "modified": "2025-11-04T18:30:40Z",
  "published": "2023-05-12T21:30:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2088"
    },
    {
      "type": "WEB",
      "url": "https://bugs.launchpad.net/bugs/2004555"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00015.html"
    },
    {
      "type": "WEB",
      "url": "https://security.openstack.org/ossa/OSSA-2023-003.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-7246"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-440"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-06T11:16:07Z",
    "severity": "MODERATE"
  },
  "details": "It\u0027s possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It\u0027s also possible to use this vulnerability to leak other clients HTTP header keys, but not values.\n\nThis occurs because the error status for a misencoded header is not cleared between header reads, resulting in subsequent (incrementally indexed) added headers in the first request being poisoned until cleared from the HPACK table.\n\nPlease update to a fixed version of gRPC as soon as possible. This bug has been fixed in 1.58.3, 1.59.5, 1.60.2, 1.61.3, 1.62.3, 1.63.2, 1.64.3, 1.65.4.",
  "id": "GHSA-ghwg-gpp4-w4x3",
  "modified": "2025-07-22T21:31:14Z",
  "published": "2024-08-06T12:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7246"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grpc/grpc/issues/36245"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-5062"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-346",
      "CWE-440"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-12-12T22:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions. By simulating an incomplete new association, an attacker can trigger a deauthentication against stations using 802.11w, resulting in a denial of service.",
  "id": "GHSA-gv78-7qxh-6mj5",
  "modified": "2024-04-04T02:43:12Z",
  "published": "2022-05-24T17:03:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5062"
    },
    {
      "type": "WEB",
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0850"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-52953"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-440"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-11T15:15:26Z",
    "severity": "HIGH"
  },
  "details": "An Expected Behavior Violation\u00a0vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker sending a valid BGP UPDATE packet to cause a BGP session reset, resulting in a Denial of Service (DoS).\u00a0\n\nContinuous receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.\n\nThis issue affects iBGP and eBGP and both IPv4 and IPv6 are affected by this vulnerability.\n\nThis issue affects Junos OS:\n\n\n  *  All versions before 21.2R3-S9,\n  *  from 21.4 before 21.4R3-S11,\n  *  from 22.2 before 22.2R3-S7,\n  *  from 22.4 before 22.4R3-S7,\n  *  from 23.2 before 23.2R2-S4,\n  *  from 23.4 before 23.4R2-S4,\n  *  from 24.2 before 24.2R2,\n  *  from 24.4 before 24.4R1-S3, 24.4R2\n\n\nJunos OS Evolved:\n\n\n\n  *  All versions before 22.2R3-S7-EVO,\n  *  from 22.4-EVO before 22.4R3-S7-EVO,\n  *  from 23.2-EVO before 23.2R2-S4-EVO,\n  *  from 23.4-EVO before 23.4R2-S4-EVO,\n  *  from 24.2-EVO before 24.2R2-EVO,\n  *  from 24.4-EVO before 24.4R1-S3-EVO, 24.4R2-EVO.",
  "id": "GHSA-h95q-mmmp-cm4m",
  "modified": "2025-07-11T15:31:38Z",
  "published": "2025-07-11T15:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52953"
    },
    {
      "type": "WEB",
      "url": "https://supportportal.juniper.net/JSA100059"
    },
    {
      "type": "WEB",
      "url": "https://www.juniper.net/documentation/us/en/software/junos/bgp/topics/task/routing-protocol-bgp-security-configuring.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:Amber",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-65934"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-440"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-13T15:19:56Z",
    "severity": "HIGH"
  },
  "details": "An unencrypted \u0027pause encryption request\u0027 message causes a denial of service in the BT122 module.\u00a0\nSee vulnerability B-E10 in the related paper below.",
  "id": "GHSA-j2wh-vq5f-p4wj",
  "modified": "2026-08-13T15:34:43Z",
  "published": "2026-08-13T15:34:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65934"
    },
    {
      "type": "WEB",
      "url": "https://arxiv.org/pdf/2409.02905"
    },
    {
      "type": "WEB",
      "url": "https://community.silabs.com/068Vm00000x0Yqy"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-56202"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-440"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-06T11:15:11Z",
    "severity": "MODERATE"
  },
  "details": "Expected Behavior Violation vulnerability in Apache Traffic Server.\n\nThis issue affects Apache Traffic Server: from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3.\n\nUsers are recommended to upgrade to versions 9.2.9 or 10.0.4 or newer, which fixes the issue.",
  "id": "GHSA-mp92-g2h5-gx86",
  "modified": "2025-03-06T18:31:08Z",
  "published": "2025-03-06T12:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56202"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/btofzws2yqskk2n7f01r3l1819x01023"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "sweetalert2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.6.14"
            },
            {
              "fixed": "11.22.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-440"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-10T19:08:10Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "`sweetalert2` versions from 11.6.14 to before 11.22.4 have potentially undesirable behavior. The package outputs audio and/or video messages that do not pertain to the functionality of the package when run on specific tlds. This functionality is documented on the project\u0027s readme.",
  "id": "GHSA-mrr8-v49w-3333",
  "modified": "2025-08-14T19:15:04Z",
  "published": "2023-07-10T19:08:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sweetalert2/sweetalert2/pull/2847"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sweetalert2/sweetalert2/commit/7de85db5c76ba3ef5f0cdbc335bbc4a7c559e012"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sweetalert2/sweetalert2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sweetalert2/sweetalert2/releases/tag/v11.4.9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sweetalert2/sweetalert2/tree/6d02e1095e5d9db1dfa7f0708df6fa13a1b32be3#important-notice-about-usage-of-this-software-for-ru-su-and-%D1%80%D1%84-domain-zones"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/package/sweetalert2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "sweetalert2 contains potentially undesirable behavior"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "llama-index-readers-papers"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-3044"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-440"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-08T00:03:54Z",
    "nvd_published_at": "2025-07-07T10:15:26Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the ArxivReader class of the run-llama/llama_index repository allows for MD5 hash collisions when generating filenames for downloaded papers. This can lead to data loss as papers with identical titles but different contents may overwrite each other, preventing some papers from being processed for AI model training. The issue is resolved in llama-index-readers-papers version 0.3.1 (in llama-index 0.12.28).",
  "id": "GHSA-p7j4-jwjf-5x9w",
  "modified": "2025-07-08T00:03:54Z",
  "published": "2025-07-07T12:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3044"
    },
    {
      "type": "WEB",
      "url": "https://github.com/run-llama/llama_index/commit/0008041e8dde8e519621388e5d6f558bde6ef42e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/run-llama/llama_index/commit/f69e1c0e7579228fec4cfaf716e4f951e131de77"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/run-llama/llama_index"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/80182c3a-876f-422f-8bac-38267e0345d6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "LlamaIndex vulnerability in ArxivReader class can cause MD5 hash collisions"
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-6569"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-440"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-03-26T22:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into the mirrored network. An attacker could use this behavior to transmit malicious packets to systems in the mirrored network, possibly influencing their configuration and runtime behavior.",
  "id": "GHSA-pq3w-wpr9-q68m",
  "modified": "2022-04-30T00:02:14Z",
  "published": "2022-04-30T00:02:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6569"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-557804.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}