CWE-544
AllowedMissing Standardized Error Handling Mechanism
Abstraction: Base · Status: Draft
The product does not use a standardized method for handling errors throughout the code, which might introduce inconsistent error handling and resultant weaknesses.
14 vulnerabilities reference this CWE, most recent first.
GHSA-Q8XG-8XWF-M598
Vulnerability from github – Published: 2020-04-16 03:14 – Updated: 2021-09-16 20:39All versions of lix are vulnerable to Machine-In-The-Middle. The package accepts downloads with http and follows location header redirects for package downloads. This allows for an attacker in a privileged network position to intercept a lix package installation and redirect the download to a malicious source.
Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "lix"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "15.11.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-10800"
],
"database_specific": {
"cwe_ids": [
"CWE-544",
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2020-04-16T03:10:39Z",
"nvd_published_at": "2020-03-21T15:15:00Z",
"severity": "HIGH"
},
"details": "All versions of `lix` are vulnerable to Machine-In-The-Middle. The package accepts downloads with `http` and follows `location` header redirects for package downloads. This allows for an attacker in a privileged network position to intercept a lix package installation and redirect the download to a malicious source.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative package until a fix is made available.",
"id": "GHSA-q8xg-8xwf-m598",
"modified": "2021-09-16T20:39:54Z",
"published": "2020-04-16T03:14:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10800"
},
{
"type": "PACKAGE",
"url": "https://github.com/lix-pm/lix.client"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1306"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Machine-In-The-Middle in lix"
}
GHSA-R5J8-58V3-G23G
Vulnerability from github – Published: 2025-01-04 15:30 – Updated: 2025-01-04 15:30IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to cause an unhandled SSL exception which could leave the connection in an unexpected or insecure state.
{
"affected": [],
"aliases": [
"CVE-2024-41768"
],
"database_specific": {
"cwe_ids": [
"CWE-544"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-04T15:15:07Z",
"severity": "MODERATE"
},
"details": "IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to cause an unhandled SSL exception which could leave the connection in an unexpected or insecure state.",
"id": "GHSA-r5j8-58v3-g23g",
"modified": "2025-01-04T15:30:45Z",
"published": "2025-01-04T15:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41768"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7180202"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-R72R-FHV8-5QGQ
Vulnerability from github – Published: 2026-10-07 18:32 – Updated: 2026-10-07 18:32A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials.
This vulnerability is due to insufficient input validation of user-controlled command arguments. An attacker could exploit this vulnerability by authenticating using the API and sending crafted input. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system of an affected device with root-level privileges.
{
"affected": [],
"aliases": [
"CVE-2026-20321"
],
"database_specific": {
"cwe_ids": [
"CWE-544"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-07T17:16:55Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials.\n\nThis vulnerability is due to insufficient input validation of user-controlled command arguments. An attacker could exploit this vulnerability by authenticating using the API and sending crafted input. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system of an affected device with root-level privileges.",
"id": "GHSA-r72r-fhv8-5qgq",
"modified": "2026-10-07T18:32:10Z",
"published": "2026-10-07T18:32:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20321"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apic-cmdinj-L6VR4E7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XGM7-3X53-GQ2C
Vulnerability from github – Published: 2024-05-22 09:31 – Updated: 2024-07-03 18:43In the Linux kernel, the following vulnerability has been resolved:
net: batman-adv: fix error handling
Syzbot reported ODEBUG warning in batadv_nc_mesh_free(). The problem was in wrong error handling in batadv_mesh_init().
Before this patch batadv_mesh_init() was calling batadv_mesh_free() in case of any batadv_*_init() calls failure. This approach may work well, when there is some kind of indicator, which can tell which parts of batadv are initialized; but there isn't any.
All written above lead to cleaning up uninitialized fields. Even if we hide ODEBUG warning by initializing bat_priv->nc.work, syzbot was able to hit GPF in batadv_nc_purge_paths(), because hash pointer in still NULL. [1]
To fix these bugs we can unwind batadv_init() calls one by one. It is good approach for 2 reasons: 1) It fixes bugs on error handling path 2) It improves the performance, since we won't call unneeded batadv_free() functions.
So, this patch makes all batadv_init() clean up all allocated memory before returning with an error to no call correspoing batadv_free() and open-codes batadv_mesh_free() with proper order to avoid touching uninitialized fields.
{
"affected": [],
"aliases": [
"CVE-2021-47482"
],
"database_specific": {
"cwe_ids": [
"CWE-544"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-22T09:15:10Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: batman-adv: fix error handling\n\nSyzbot reported ODEBUG warning in batadv_nc_mesh_free(). The problem was\nin wrong error handling in batadv_mesh_init().\n\nBefore this patch batadv_mesh_init() was calling batadv_mesh_free() in case\nof any batadv_*_init() calls failure. This approach may work well, when\nthere is some kind of indicator, which can tell which parts of batadv are\ninitialized; but there isn\u0027t any.\n\nAll written above lead to cleaning up uninitialized fields. Even if we hide\nODEBUG warning by initializing bat_priv-\u003enc.work, syzbot was able to hit\nGPF in batadv_nc_purge_paths(), because hash pointer in still NULL. [1]\n\nTo fix these bugs we can unwind batadv_*_init() calls one by one.\nIt is good approach for 2 reasons: 1) It fixes bugs on error handling\npath 2) It improves the performance, since we won\u0027t call unneeded\nbatadv_*_free() functions.\n\nSo, this patch makes all batadv_*_init() clean up all allocated memory\nbefore returning with an error to no call correspoing batadv_*_free()\nand open-codes batadv_mesh_free() with proper order to avoid touching\nuninitialized fields.",
"id": "GHSA-xgm7-3x53-gq2c",
"modified": "2024-07-03T18:43:07Z",
"published": "2024-05-22T09:31:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47482"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/07533f1a673ce1126d0a72ef1e4b5eaaa3dd6d20"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0c6b199f09be489c48622537a550787fc80aea73"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6422e8471890273994fe8cc6d452b0dcd2c9483e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6f68cd634856f8ca93bafd623ba5357e0f648c68"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a8f7359259dd5923adc6129284fdad12fc5db347"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b0a2cd38553c77928ef1646ed1518486b1e70ae8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e50f957652190b5a88a8ebce7e5ab14ebd0d3f00"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fbf150b16a3635634b7dfb7f229d8fcd643c6c51"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
define a strategy for handling errors of different severities, such as fatal errors versus basic log events. Use or create built-in language features, or an external package, that provides an easy-to-use API and define coding standards for the detection and handling of errors.
No CAPEC attack patterns related to this CWE.