CVEbaza.pl › Słownik CWE › CWE-1357

Common Weakness Enumeration

CWE-1357

Reliance on Insufficiently Trustworthy Component

Kategoria: ClassCVE: 4

Opis

Produkt zbudowany jest z wielu oddzielnych komponentów, ale wykorzystuje komponent, który nie jest wystarczająco zaufany, aby spełnić oczekiwania dotyczące bezpieczeństwa, niezawodności, możliwości aktualizacji i łatwości utrzymania. Może to prowadzić do podatności bezpieczeństwa i problemów z niezawodnością całego systemu.

Description (EN)

The product is built from multiple separate components, but it uses a component that is not sufficiently trusted to meet expectations for security, reliability, updateability, and maintainability.

Podatności CVE z CWE-1357 (4)

8.6

CVSS

HIGH

CVE-2024-26024

SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in Substation Server.

pub. 2024-05-28

8.6

CVSS

HIGH

CVE-2024-28042

SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in PowerSYSTEM Center.

pub. 2024-05-15

8.6

CVSS

HIGH

CVE-2024-3313

SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in PowerSYSTEM Server 2021 and Substation Server 2021.

pub. 2024-04-09

7.2

CVSS

HIGH

CVE-2025-32800

Conda-build contains commands and tools to build conda packages. Prior to version 25.3.0, the pyproject.toml lists conda-index as a Python dependency. This package is not published in PyPI. An attacker could claim this namespace and upload arbitrary (malicious) code to the package, and then exploit pip install commands by injecting the malicious dependency in the solve. This issue has been fixed in version 25.3.0. A workaround involves using --no-deps for pip install-ing the project from the repository.

pub. 2025-06-16

Informacje

ID: CWE-1357

Typ: Class

Podatności: 4

MITRE CWE ↗

← Słownik CWE