CWE-1104
AllowedUse of Unmaintained Third Party Components
Abstraction: Base · Status: Incomplete
The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.
65 vulnerabilities reference this CWE, most recent first.
GHSA-FG22-JF8J-5MRR
Vulnerability from github – Published: 2025-10-23 06:30 – Updated: 2025-11-07 21:31Outdated and Vulnerable UI Dependencies might potentially lead to exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
{
"affected": [],
"aliases": [
"CVE-2025-12104"
],
"database_specific": {
"cwe_ids": [
"CWE-1104"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-23T04:15:52Z",
"severity": "CRITICAL"
},
"details": "Outdated and Vulnerable UI Dependencies might potentially lead to exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.",
"id": "GHSA-fg22-jf8j-5mrr",
"modified": "2025-11-07T21:31:20Z",
"published": "2025-10-23T06:30:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12104"
},
{
"type": "WEB",
"url": "https://azure-access.com/security-advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-G2WP-R2JM-2M5F
Vulnerability from github – Published: 2024-10-02 15:30 – Updated: 2024-10-02 15:30A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 and older allows writing of arbitrary files.
{
"affected": [],
"aliases": [
"CVE-2024-8885"
],
"database_specific": {
"cwe_ids": [
"CWE-1104"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-02T13:15:12Z",
"severity": "HIGH"
},
"details": "A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 and older allows writing of arbitrary files.",
"id": "GHSA-g2wp-r2jm-2m5f",
"modified": "2024-10-02T15:30:38Z",
"published": "2024-10-02T15:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8885"
},
{
"type": "WEB",
"url": "https://www.sophos.com/en-us/security-advisories/sophos-sa-20241002-cde-lpe"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HR7V-GV37-XPX2
Vulnerability from github – Published: 2026-07-24 12:30 – Updated: 2026-07-27 18:31TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99.
The tomlc99 library is no longer maintained, and has an uncontrolled recursion vulnerability publicly reported in the issue tracker.
Any caller that passes untrusted TOML to from_toml risks a stack overflow from a deeply-nested document.
TOML::XS version 0.06 or later uses the successor tomlc17 library.
{
"affected": [],
"aliases": [
"CVE-2026-16634"
],
"database_specific": {
"cwe_ids": [
"CWE-1104"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-24T10:16:31Z",
"severity": "CRITICAL"
},
"details": "TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99.\n\nThe tomlc99 library is no longer maintained, and has an uncontrolled recursion vulnerability publicly reported in the issue tracker.\n\nAny caller that passes untrusted TOML to from_toml risks a stack overflow from a deeply-nested document.\n\nTOML::XS version 0.06 or later uses the successor tomlc17 library.",
"id": "GHSA-hr7v-gv37-xpx2",
"modified": "2026-07-27T18:31:42Z",
"published": "2026-07-24T12:30:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16634"
},
{
"type": "WEB",
"url": "https://github.com/cktan/tomlc99/issues/97"
},
{
"type": "WEB",
"url": "https://github.com/cktan/tomlc17"
},
{
"type": "WEB",
"url": "https://metacpan.org/release/FELIPE/TOML-XS-0.06/changes"
},
{
"type": "WEB",
"url": "https://raw.githubusercontent.com/cktan/tomlc99/29076dfd095bbbbd50a3c1b2760d29f4b83e74ac/README.md"
},
{
"type": "WEB",
"url": "https://toml.io/en/v1.0.0"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/07/24/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HRPP-F84W-XHFG
Vulnerability from github – Published: 2020-09-04 16:55 – Updated: 2021-10-04 19:13Versions of vue-moment prior to 4.1.0 contain an Outdated Static Dependency. The package depends on moment and has it loaded statically instead of as a dependency that can be updated. It has moment@2.19.1 that contains a Regular Expression Denial of Service vulnerability.
Recommendation
Upgrade to version 4.1.0 or later.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "vue-moment"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1104"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:58:51Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "Versions of `vue-moment` prior to 4.1.0 contain an Outdated Static Dependency. The package depends on `moment` and has it loaded statically instead of as a dependency that can be updated. It has `moment@2.19.1` that contains a Regular Expression Denial of Service vulnerability.\n\n\n## Recommendation\n\nUpgrade to version 4.1.0 or later.",
"id": "GHSA-hrpp-f84w-xhfg",
"modified": "2021-10-04T19:13:23Z",
"published": "2020-09-04T16:55:06Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/brockpetrie/vue-moment/commit/a265e54660a7181a6795a12a97cebac5b305746e"
},
{
"type": "PACKAGE",
"url": "https://github.com/brockpetrie/vue-moment"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-VUEMOMENT-538934"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1425"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/532"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "Outdated Static Dependency in vue-moment"
}
GHSA-J2MF-X92X-CPM8
Vulnerability from github – Published: 2025-11-11 18:30 – Updated: 2025-11-11 18:30Use of unmaintained third party components for some Intel(R) Processor Identification Utility before version 8.0.43 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
{
"affected": [],
"aliases": [
"CVE-2025-20010"
],
"database_specific": {
"cwe_ids": [
"CWE-1104"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-11T17:15:39Z",
"severity": "HIGH"
},
"details": "Use of unmaintained third party components for some Intel(R) Processor Identification Utility before version 8.0.43 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.",
"id": "GHSA-j2mf-x92x-cpm8",
"modified": "2025-11-11T18:30:17Z",
"published": "2025-11-11T18:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20010"
},
{
"type": "WEB",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01334.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-P2FW-WCCQ-9QH3
Vulnerability from github – Published: 2026-09-28 15:31 – Updated: 2026-09-28 15:31mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware. This exposes the device to publicly known vulnerabilities that will not receive security patches. An attacker could exploit these known flaws to execute arbitrary code, access sensitive data, or cause a denial of service on the device. Vulnerable components were updated or hardened, if update was not possible in version 3.0.30
{
"affected": [],
"aliases": [
"CVE-2026-82935"
],
"database_specific": {
"cwe_ids": [
"CWE-1104"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-28T13:17:23Z",
"severity": "MODERATE"
},
"details": "mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware. This exposes the device to publicly known vulnerabilities that will not receive security patches. An attacker could exploit these known flaws to execute arbitrary code, access sensitive data, or cause a denial of service on the device.\nVulnerable components were updated or hardened, if update was not possible in version\u00a03.0.30",
"id": "GHSA-p2fw-wccq-9qh3",
"modified": "2026-09-28T15:31:52Z",
"published": "2026-09-28T15:31:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82935"
},
{
"type": "WEB",
"url": "https://cert.pl/posts/2026/09/CVE-2026-82928"
},
{
"type": "WEB",
"url": "https://www.fif.com.pl/pl/strona-glowna/1367-mh-developer.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PF92-76H5-2R52
Vulnerability from github – Published: 2024-12-17 09:31 – Updated: 2024-12-17 09:31CWE-1104: Use of Unmaintained Third-Party Components vulnerability exists that could cause complete control of the device when an authenticated user installs malicious code into HMI product.
{
"affected": [],
"aliases": [
"CVE-2024-11999"
],
"database_specific": {
"cwe_ids": [
"CWE-1104"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-17T07:15:06Z",
"severity": "HIGH"
},
"details": "CWE-1104: Use of Unmaintained Third-Party Components vulnerability exists that could cause complete\ncontrol of the device when an authenticated user installs malicious code into HMI product.",
"id": "GHSA-pf92-76h5-2r52",
"modified": "2024-12-17T09:31:05Z",
"published": "2024-12-17T09:31:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11999"
},
{
"type": "WEB",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-345-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-345-02.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PP8R-VV2J-9J5V
Vulnerability from github – Published: 2022-09-16 17:12 – Updated: 2022-09-16 17:12Crate traitobject has not had a release for over five years.
In addition there is an existing security advisory that has not been addressed:
Possible Alternative(s)
The below list has not been vetted in any way and may or may not contain alternatives;
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "traitobject"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1104"
],
"github_reviewed": true,
"github_reviewed_at": "2022-09-16T17:12:59Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "Crate `traitobject` has not had a release for over five years.\n\nIn addition there is an existing security advisory that has not been addressed:\n\n - [RUSTSEC-2020-0027](https://rustsec.org/advisories/RUSTSEC-2020-0027)\n\n## Possible Alternative(s)\n\n The below list has not been vetted in any way and may or may not contain alternatives;\n\n - [destructure_traitobject]\n\n[destructure_traitobject]: https://crates.io/crates/destructure_traitobject\n",
"id": "GHSA-pp8r-vv2j-9j5v",
"modified": "2022-09-16T17:12:59Z",
"published": "2022-09-16T17:12:59Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/reem/rust-traitobject/issues/7"
},
{
"type": "PACKAGE",
"url": "https://github.com/reem/rust-traitobject"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2021-0144.html"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "traitobject is Unmaintained"
}
GHSA-Q56R-WGJ6-2G29
Vulnerability from github – Published: 2025-07-09 09:31 – Updated: 2025-07-09 09:31The Linux distribution underlying the Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) is obsolete and reached end of life (EOL) on June 30, 2024. Thus, any unmitigated vulnerability could be exploited to affect this product.
{
"affected": [],
"aliases": [
"CVE-2025-3497"
],
"database_specific": {
"cwe_ids": [
"CWE-1104"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-09T09:15:27Z",
"severity": "HIGH"
},
"details": "The Linux distribution underlying the Radiflow iSAP Smart Collector \n(CentOS 7 - VSAP 1.20) is obsolete and \nreached end of life (EOL) on\nJune 30, 2024. Thus, any \nunmitigated vulnerability could be exploited to affect this product.",
"id": "GHSA-q56r-wgj6-2g29",
"modified": "2025-07-09T09:31:12Z",
"published": "2025-07-09T09:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3497"
},
{
"type": "WEB",
"url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2025-3497"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-R33R-4V49-3HRG
Vulnerability from github – Published: 2026-08-25 12:31 – Updated: 2026-08-25 12:31HCL Hive is affected by weak software supply chain governance, which could lead to the inclusion of vulnerable, unmaintained, or malicious third-party dependencies within the application environment.
{
"affected": [],
"aliases": [
"CVE-2026-21753"
],
"database_specific": {
"cwe_ids": [
"CWE-1104"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-25T11:16:51Z",
"severity": "MODERATE"
},
"details": "HCL Hive is affected by weak software supply chain governance, which could lead to the inclusion of vulnerable, unmaintained, or malicious third-party dependencies within the application environment.",
"id": "GHSA-r33r-4v49-3hrg",
"modified": "2026-08-25T12:31:22Z",
"published": "2026-08-25T12:31:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21753"
},
{
"type": "WEB",
"url": "https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0133342"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.