cve.bz

CWE-840: Business Logic Errors, page 3

Filter

Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.

What the weakness is: CWE-840 at MITRE. All weaknesses

Ask an AI about CWE-840

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-840: Business Logic Errors and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/840.html and https://cve.bz/cve/cwe/840?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2021-4111EPSS 0.6%

    yetiforcecrm is vulnerable to Business Logic Errors

  2. 6.5CVE-2021-36012EPSS 1.9%

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can leverage this vulnerability to altar the…

  3. 7.5CVE-2021-22926EPSS 15%

    libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use the macOS native TLS library S…

  4. 6.5CVE-2021-22922EPSS 4.3%

    When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of differ…

  5. 5.3CVE-2021-22897EPSS 4.3%

    curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a singl…

  6. 5.3CVE-2020-8228EPSS 1.9%

    A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times.

  7. 4.3CVE-2020-8181EPSS 0.8%

    A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars.

  8. 5.9CVE-2019-15608EPSS 1.8%

    The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack.

  9. 8.8CVE-2019-3787EPSS 1.1%

    Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads …

  10. 6.5CVE-2019-3789EPSS 0.8%

    Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platform. A user with space developer permissions can create a private domain that shad…