CWE-841

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:24:44.203Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-2102",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-16T15:55:13.164067Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-16T16:16:00.619Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SEPCOS Control and Protection Relay firmware package",
          "vendor": "Secheron",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.24.8",
                  "status": "unaffected"
                },
                {
                  "at": "1.25.3",
                  "status": "unaffected"
                }
              ],
              "lessThan": "1.23.21",
              "status": "affected",
              "version": "All versions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Anthony Candarini of AECOM, Clark Bradley of Elliott Davis, Mike Curnow of AECOM, and Balakrishna Subramoney of SAM Analytic Solutions reported these vulnerabilities to CISA."
        }
      ],
      "datePublic": "2022-06-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the initial file upload page response and modify the associated code. This modified code can be forwarded and used by a script loaded later in the sequence, allowing for arbitrary file upload into a location where PHP scripts may be executed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-841",
              "description": "CWE-841  IMPROPER ENFORCEMENT OF BEHAVIORAL WORKFLOW",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-06-24T15:00:33.000Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Secheron recommends updating its software to the latest version:\n\nSEPCOS Single Package firmware (1.23.xx feature level): Update to 1.23.22 or higher version\nSEPCOS Single Package firmware (1.24.xx feature level): Update to 1.24.8 or higher version\nSEPCOS Single Package firmware (1.25.xx feature level): Update to 1.25.3 or higher version"
        }
      ],
      "source": {
        "advisory": "ICSA-22-174-03",
        "discovery": "EXTERNAL"
      },
      "title": "Secheron SEPCOS Control and Protection Relay",
      "workarounds": [
        {
          "lang": "en",
          "value": "Additional workarounds are suggested to help reduce the risk:\n\nConfigure the network such that PLC communications are strictly limited to only the devices required to perform its functions.\nLimit remote access and close Ports 80 and 443 at the switch level.\nOnly use approved devices to connect to the PLCs. Do not connect personal peripherals (USB sticks, hotspots) to approved devices.\nCheck device logs during periodic maintenance for unauthorized changes or access."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "DATE_PUBLIC": "2022-06-23T17:01:00.000Z",
          "ID": "CVE-2022-2102",
          "STATE": "PUBLIC",
          "TITLE": "Secheron SEPCOS Control and Protection Relay"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SEPCOS Control and Protection Relay firmware package",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "All versions",
                            "version_value": "1.23.21"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "All versions",
                            "version_value": "1.24.8"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "All versions",
                            "version_value": "1.25.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Secheron"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Anthony Candarini of AECOM, Clark Bradley of Elliott Davis, Mike Curnow of AECOM, and Balakrishna Subramoney of SAM Analytic Solutions reported these vulnerabilities to CISA."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the initial file upload page response and modify the associated code. This modified code can be forwarded and used by a script loaded later in the sequence, allowing for arbitrary file upload into a location where PHP scripts may be executed."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-841  IMPROPER ENFORCEMENT OF BEHAVIORAL WORKFLOW"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03",
              "refsource": "MISC",
              "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Secheron recommends updating its software to the latest version:\n\nSEPCOS Single Package firmware (1.23.xx feature level): Update to 1.23.22 or higher version\nSEPCOS Single Package firmware (1.24.xx feature level): Update to 1.24.8 or higher version\nSEPCOS Single Package firmware (1.25.xx feature level): Update to 1.25.3 or higher version"
          }
        ],
        "source": {
          "advisory": "ICSA-22-174-03",
          "discovery": "EXTERNAL"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "Additional workarounds are suggested to help reduce the risk:\n\nConfigure the network such that PLC communications are strictly limited to only the devices required to perform its functions.\nLimit remote access and close Ports 80 and 443 at the switch level.\nOnly use approved devices to connect to the PLCs. Do not connect personal peripherals (USB sticks, hotspots) to approved devices.\nCheck device logs during periodic maintenance for unauthorized changes or access."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2022-2102",
    "datePublished": "2022-06-24T15:00:33.724Z",
    "dateReserved": "2022-06-16T00:00:00.000Z",
    "dateUpdated": "2025-04-16T16:16:00.619Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:10:03.859Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-1667",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-16T15:55:24.323966Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-16T16:16:23.607Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SEPCOS Control and Protection Relay firmware package",
          "vendor": "Secheron",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.24.8",
                  "status": "unaffected"
                },
                {
                  "at": "1.25.3",
                  "status": "unaffected"
                }
              ],
              "lessThan": "1.23.21",
              "status": "affected",
              "version": "All versions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Anthony Candarini of AECOM, Clark Bradley of Elliott Davis, Mike Curnow of AECOM, and Balakrishna Subramoney of SAM Analytic Solutions reported these vulnerabilities to CISA."
        }
      ],
      "datePublic": "2022-06-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Client-side JavaScript controls may be bypassed by directly running a JS function to reboot the PLC (e.g., from the browser console) or by loading the corresponding, browser accessible PHP script"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-841",
              "description": "CWE-841  IMPROPER ENFORCEMENT OF BEHAVIORAL WORKFLOW",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-06-24T15:00:30.000Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Secheron recommends updating its software to the latest version:\n\nSEPCOS Single Package firmware (1.23.xx feature level): Update to 1.23.22 or higher version\nSEPCOS Single Package firmware (1.24.xx feature level): Update to 1.24.8 or higher version\nSEPCOS Single Package firmware (1.25.xx feature level): Update to 1.25.3 or higher version"
        }
      ],
      "source": {
        "advisory": "ICSA-22-174-03",
        "discovery": "EXTERNAL"
      },
      "title": "Secheron SEPCOS Control and Protection Relay",
      "workarounds": [
        {
          "lang": "en",
          "value": "Additional workarounds are suggested to help reduce the risk:\n\nConfigure the network such that PLC communications are strictly limited to only the devices required to perform its functions.\nLimit remote access and close Ports 80 and 443 at the switch level.\nOnly use approved devices to connect to the PLCs. Do not connect personal peripherals (USB sticks, hotspots) to approved devices.\nCheck device logs during periodic maintenance for unauthorized changes or access."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "DATE_PUBLIC": "2022-06-23T17:01:00.000Z",
          "ID": "CVE-2022-1667",
          "STATE": "PUBLIC",
          "TITLE": "Secheron SEPCOS Control and Protection Relay"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SEPCOS Control and Protection Relay firmware package",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "All versions",
                            "version_value": "1.23.21"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "All versions",
                            "version_value": "1.24.8"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "All versions",
                            "version_value": "1.25.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Secheron"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Anthony Candarini of AECOM, Clark Bradley of Elliott Davis, Mike Curnow of AECOM, and Balakrishna Subramoney of SAM Analytic Solutions reported these vulnerabilities to CISA."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Client-side JavaScript controls may be bypassed by directly running a JS function to reboot the PLC (e.g., from the browser console) or by loading the corresponding, browser accessible PHP script"
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-841  IMPROPER ENFORCEMENT OF BEHAVIORAL WORKFLOW"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03",
              "refsource": "MISC",
              "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Secheron recommends updating its software to the latest version:\n\nSEPCOS Single Package firmware (1.23.xx feature level): Update to 1.23.22 or higher version\nSEPCOS Single Package firmware (1.24.xx feature level): Update to 1.24.8 or higher version\nSEPCOS Single Package firmware (1.25.xx feature level): Update to 1.25.3 or higher version"
          }
        ],
        "source": {
          "advisory": "ICSA-22-174-03",
          "discovery": "EXTERNAL"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "Additional workarounds are suggested to help reduce the risk:\n\nConfigure the network such that PLC communications are strictly limited to only the devices required to perform its functions.\nLimit remote access and close Ports 80 and 443 at the switch level.\nOnly use approved devices to connect to the PLCs. Do not connect personal peripherals (USB sticks, hotspots) to approved devices.\nCheck device logs during periodic maintenance for unauthorized changes or access."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2022-1667",
    "datePublished": "2022-06-24T15:00:30.365Z",
    "dateReserved": "2022-05-10T00:00:00.000Z",
    "dateUpdated": "2025-04-16T16:16:23.607Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-0410"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-841"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-22T00:15:51Z",
    "severity": "HIGH"
  },
  "details": "An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. A developer could bypass CODEOWNERS approvals by creating a merge conflict.",
  "id": "GHSA-27r2-6rqh-xrg8",
  "modified": "2024-02-22T00:31:03Z",
  "published": "2024-02-22T00:31:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0410"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/2296778"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/437988"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "gun"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-43974"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-841"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-29T15:45:59Z",
    "nvd_published_at": "2026-06-08T15:16:46Z",
    "severity": "HIGH"
  },
  "details": "Unexpected Status Code or Return Value vulnerability in ninenines gun (gun_http module) allows a malicious HTTP server to force the client into raw protocol mode via an unsolicited 101 Switching Protocols response.\n\nIn gun_http:handle_inform/8, when a 101 Switching Protocols response is received over HTTP/1.1, the function verifies only that the Upgrade header is syntactically valid and that the stream reference is a plain reference(). It does not check whether the client ever sent an Upgrade or Connection: upgrade header on the corresponding request. Because this check is absent, any 101 response (solicited or not) causes gun to dispatch a gun_upgrade message to the caller and transition the entire connection to raw protocol mode.\n\nA malicious or compromised HTTP server can send an unsolicited 101 response to any HTTP/1.1 request, causing the gun client to abandon HTTP framing for that connection. Once in raw mode, gun_raw applies no flow control (flow=infinity) and re-arms socket active mode after every received packet, so the server can flood the client with arbitrary bytes. These are forwarded as unbounded gun_data messages to the owner process, exhausting its mailbox and BEAM memory, ultimately crashing the VM.\n\nThis issue affects gun: from 2.0.0 before 2.4.0.",
  "id": "GHSA-2j82-37xg-f9wp",
  "modified": "2026-07-29T15:45:59Z",
  "published": "2026-06-08T15:33:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43974"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ninenines/gun/commit/5b48068c29ce5e112cb149b5857c7d4dc319a81b"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-43974.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ninenines/gun"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-43974"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "gun has an Unexpected Status Code or Return Value vulnerability"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-46307"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-841"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-09T17:15:19Z",
    "severity": "HIGH"
  },
  "details": "A loop hole in the payment logic of Sparkshop v1.16 allows attackers to arbitrarily modify the number of products.",
  "id": "GHSA-3j3r-8qhc-763h",
  "modified": "2024-10-12T00:30:47Z",
  "published": "2024-10-09T18:31:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46307"
    },
    {
      "type": "WEB",
      "url": "https://gitee.com/sparkshop/sparkshop"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Yllxx03/CVE/tree/main/CVE-2024-46307"
    },
    {
      "type": "WEB",
      "url": "http://sparkshop.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-30574"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-841"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-27T17:16:28Z",
    "severity": "HIGH"
  },
  "details": "A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-sales.php file. The application fails to verify if the requested sales quantity (txtqty) exceeds the available stock level. An attacker can manipulate the request to purchase a quantity that is significantly higher than the actual available stock.",
  "id": "GHSA-3wqr-83x4-348r",
  "modified": "2026-03-27T21:31:35Z",
  "published": "2026-03-27T18:31:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30574"
    },
    {
      "type": "WEB",
      "url": "https://github.com/meifukun/Web-Security-PoCs/blob/main/Pharmacy-Product-Management-System/Logic-AddSales-Overselling.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-36333"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-841"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-30T21:16:29Z",
    "severity": "MODERATE"
  },
  "details": "IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to perform unauthorized actions due to the improper enforcement of behavioral workflow.",
  "id": "GHSA-4h2c-c5g9-52gg",
  "modified": "2026-06-30T21:31:45Z",
  "published": "2026-06-30T21:31:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36333"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7277801"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-3130"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-841"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-03T22:16:29Z",
    "severity": "CRITICAL"
  },
  "details": "Improper Enforcement of Behavioral Controls in\u00a0Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is currently checked out by selecting it alongside at least one non-checked-out account and performing a bulk deletion.",
  "id": "GHSA-52vv-5wf4-fghj",
  "modified": "2026-03-04T15:30:34Z",
  "published": "2026-03-04T00:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3130"
    },
    {
      "type": "WEB",
      "url": "https://devolutions.net/security/advisories/DEVO-2026-0005"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "sylius/sylius"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.0.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "sylius/sylius"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.1.0"
            },
            {
              "fixed": "2.1.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "sylius/sylius"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.2.0"
            },
            {
              "fixed": "2.2.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53637"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-672",
      "CWE-841"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-09T21:03:41Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\nA user opens the cart page in the browser. In the background, the order gets completed, e.g. an admin changes the status, or the user finalizes payment in another tab. The browser still displays the old cart: the LiveComponent is unaware the underlying order state has changed.\n\nIf the user then:\n\n- **clears the cart** \u2192 `clearCart()` calls `manager-\u003eremove()` on the\n  completed order: the order is permanently **deleted** from the database;\n- **removes a product** \u2192 `removeItem()` mutates an item on the completed\n  order;\n- **changes quantity** \u2192 `saveCart()` overwrites data on the completed order.\n\nIn all cases, the customer\u0027s order data is irreversibly corrupted or lost, even though the order has already been placed and paid for. The same vector can be triggered deliberately by an authenticated customer (keep the cart page open, complete checkout in another tab, then modify the \"cart\" to add quantity beyond what was paid for).\n\n### Patches\nThe issue is fixed in versions: 2.0.18, 2.1.15, 2.2.6 and above.\n\n### Workarounds\nIf users cannot update Sylius immediately, they should create a patched copy of the affected class in their application\u0027s `src/` directory and override the Sylius service definition to use it.\n\n#### Step 1. Create `src/Twig/Component/Cart/FormComponent.php`\n\n```php\n\u003c?php\n\ndeclare(strict_types=1);\n\nnamespace App\\Twig\\Component\\Cart;\n\nuse Doctrine\\Persistence\\ObjectManager;\nuse Sylius\\Bundle\\UiBundle\\Twig\\Component\\ResourceFormComponentTrait;\nuse Sylius\\Bundle\\UiBundle\\Twig\\Component\\TemplatePropTrait;\nuse Sylius\\Component\\Core\\Model\\OrderInterface;\nuse Sylius\\Component\\Core\\OrderCheckoutStates;\nuse Sylius\\Component\\Core\\Repository\\OrderRepositoryInterface;\nuse Sylius\\Component\\Order\\SyliusCartEvents;\nuse Sylius\\Resource\\Model\\ResourceInterface;\nuse Symfony\\Component\\EventDispatcher\\EventDispatcherInterface;\nuse Symfony\\Component\\EventDispatcher\\GenericEvent;\nuse Symfony\\Component\\Form\\FormFactoryInterface;\nuse Symfony\\UX\\LiveComponent\\Attribute\\LiveAction;\nuse Symfony\\UX\\LiveComponent\\Attribute\\LiveArg;\nuse Symfony\\UX\\LiveComponent\\Attribute\\PreReRender;\nuse Symfony\\UX\\LiveComponent\\ComponentToolsTrait;\n\nclass FormComponent\n{\n    use ComponentToolsTrait;\n\n    /** @use ResourceFormComponentTrait\u003cOrderInterface\u003e */\n    use ResourceFormComponentTrait;\n\n    use TemplatePropTrait;\n\n    public const SYLIUS_SHOP_CART_CHANGED = \u0027sylius:shop:cart_changed\u0027;\n\n    public const SYLIUS_SHOP_CART_CLEARED = \u0027sylius:shop:cart_cleared\u0027;\n\n    public bool $shouldSaveCart = true;\n\n    /** @param OrderRepositoryInterface\u003cOrderInterface\u003e $orderRepository */\n    public function __construct(\n        OrderRepositoryInterface $orderRepository,\n        FormFactoryInterface $formFactory,\n        string $resourceClass,\n        string $formClass,\n        protected readonly ObjectManager $manager,\n        protected readonly EventDispatcherInterface $eventDispatcher,\n    ) {\n        $this-\u003einitialize($orderRepository, $formFactory, $resourceClass, $formClass);\n    }\n\n    public function hydrateResource(mixed $value): ?ResourceInterface\n    {\n        if (empty($value)) {\n            return $this-\u003ecreateResource();\n        }\n\n        /** @var OrderInterface|null $order */\n        $order = $this-\u003erepository-\u003efind($value);\n\n        if (\n            !$order instanceof OrderInterface\n            || $order-\u003egetCheckoutState() === OrderCheckoutStates::STATE_COMPLETED\n        ) {\n            return $this-\u003ecreateResource();\n        }\n\n        return $order;\n    }\n\n    #[PreReRender(priority: -100)]\n    public function saveCart(): void\n    {\n        if ($this-\u003eshouldSaveCart \u0026\u0026 $this-\u003eresource?-\u003egetId() !== null) {\n            $form = $this-\u003egetForm();\n            if ($form-\u003eisValid()) {\n                $this-\u003eeventDispatcher-\u003edispatch(new GenericEvent($form-\u003egetData()), SyliusCartEvents::CART_CHANGE);\n                $this-\u003emanager-\u003eflush();\n                $this-\u003eemit(self::SYLIUS_SHOP_CART_CHANGED, [\u0027cartId\u0027 =\u003e $this-\u003eresource-\u003egetId()]);\n            }\n        }\n    }\n\n    #[LiveAction]\n    public function removeItem(#[LiveArg] int $index): void\n    {\n        if ($this-\u003eresource?-\u003egetId() === null) {\n            return;\n        }\n\n        $data = $this-\u003eformValues[\u0027items\u0027];\n        unset($data[$index]);\n        $this-\u003eformValues[\u0027items\u0027] = array_values($data);\n\n        $orderItem = $this-\u003eresource-\u003egetItems()-\u003eget($index);\n        $this-\u003eeventDispatcher-\u003edispatch(new GenericEvent($orderItem), SyliusCartEvents::CART_ITEM_REMOVE);\n\n        $this-\u003emanager-\u003epersist($this-\u003eresource);\n        $this-\u003emanager-\u003eflush();\n        $this-\u003emanager-\u003erefresh($this-\u003eresource);\n\n        $this-\u003eshouldSaveCart = false;\n        $this-\u003esubmitForm();\n        $this-\u003eemit(self::SYLIUS_SHOP_CART_CHANGED, [\u0027cartId\u0027 =\u003e $this-\u003eresource-\u003egetId()]);\n    }\n\n    #[LiveAction]\n    public function clearCart(): void\n    {\n        if ($this-\u003eresource?-\u003egetId() === null) {\n            return;\n        }\n\n        $this-\u003eformValues[\u0027items\u0027] = [];\n        $this-\u003eeventDispatcher-\u003edispatch(new GenericEvent($this-\u003eresource), SyliusCartEvents::CART_CLEAR);\n        $this-\u003emanager-\u003eremove($this-\u003eresource);\n        $this-\u003emanager-\u003eflush();\n\n        $this-\u003eresource = $this-\u003ecreateResource();\n        $this-\u003eresetForm();\n        $this-\u003eisValidated = false;\n        $this-\u003evalidatedFields = [];\n\n        $this-\u003eshouldSaveCart = false;\n        $this-\u003esubmitForm();\n        $this-\u003eemit(self::SYLIUS_SHOP_CART_CLEARED);\n    }\n\n    #[LiveAction]\n    public function removeCoupon(): void\n    {\n        $this-\u003eformValues[\u0027promotionCoupon\u0027] = \u0027\u0027;\n\n        $this-\u003esubmitForm();\n    }\n\n    private function getDataModelValue(): string\n    {\n        return \u0027debounce(500)|*\u0027;\n    }\n}\n```\n\n#### Step 2. Override the Sylius service in `config/services.yaml`\n\nAppend to the application\u0027s `config/services.yaml` (or a dedicated file loaded by the kernel, e.g. `config/packages/sylius_security_cart.yaml`):\n\n```yaml\nservices:\n    sylius_shop.twig.component.cart.form:\n        class: App\\Twig\\Component\\Cart\\FormComponent\n        arguments:\n            - \u0027@sylius.repository.order\u0027\n            - \u0027@form.factory\u0027\n            - \u0027%sylius.model.order.class%\u0027\n            - \u0027Sylius\\Bundle\\ShopBundle\\Form\\Type\\CartType\u0027\n            - \u0027@doctrine.orm.entity_manager\u0027\n            - \u0027@event_dispatcher\u0027\n        calls:\n            - [setLiveResponder, [\u0027@ux.live_component.live_responder\u0027]]\n        tags:\n            - { name: sylius.live_component.shop, key: \u0027sylius_shop:cart:form\u0027 }\n```\n\nThis redeclares the existing Sylius service id `sylius_shop.twig.component.cart.form` so it instantiates the patched class from `App\\` while preserving every argument, call and tag from the original Sylius XML definition. The cart twig hook keeps resolving to the same Live Component key (`sylius_shop:cart:form`).\n\n#### Step 3. Clear the cache\n\n```bash\nbin/console cache:clear\n```\n\n### Reporters\n\nWe would like to extend our gratitude to the following individuals for their detailed reporting and responsible disclosure of this vulnerability:\n- K\u00e9vin Gonella (@kgonella)\n- Sam V.\n\n### For more information\n\nIf there are any questions or comments about this advisory:\n\n- Open an issue in [Sylius issues](https://github.com/Sylius/Sylius/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen)\n- Send an email to [security@sylius.com](mailto:security@sylius.com)",
  "id": "GHSA-5597-7rmh-97q5",
  "modified": "2026-07-09T21:03:41Z",
  "published": "2026-07-09T21:03:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Sylius/Sylius/security/advisories/GHSA-5597-7rmh-97q5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Sylius/Sylius"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Sylius: Cart FormComponent allows modification or deletion of an already-completed order"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-13223"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-841"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-25T15:16:34Z",
    "severity": "MODERATE"
  },
  "details": "Our payment integration with Computop-based payment methods did not \nproperly validate payment status responses. An attacker could use a \nsuccessful payment status response from one payment and supply it to the\n system for a different payment, gaining access to multiple valid \ntickets with only one payment.",
  "id": "GHSA-5qw6-59g4-vvqw",
  "modified": "2026-06-25T15:32:02Z",
  "published": "2026-06-25T15:32:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13223"
    },
    {
      "type": "WEB",
      "url": "https://pretix.eu/about/en/blog/20260625-release-2026-5-2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}