CWE-402
Allowed-with-ReviewTransmission of Private Resources into a New Sphere ('Resource Leak')
Abstraction: Class · Status: Draft
The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product.
44 vulnerabilities reference this CWE, most recent first.
GHSA-MR85-G3H9-44R6
Vulnerability from github – Published: 2025-08-04 21:30 – Updated: 2025-11-05 00:31The YouDao plugin for StarDict, as used in stardict 3.0.7+git20220909+dfsg-6 in Debian trixie and elsewhere, sends an X11 selection to the dict.youdao.com and dict.cn servers via cleartext HTTP.
{
"affected": [],
"aliases": [
"CVE-2025-55014"
],
"database_specific": {
"cwe_ids": [
"CWE-402"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-04T20:15:31Z",
"severity": "MODERATE"
},
"details": "The YouDao plugin for StarDict, as used in stardict 3.0.7+git20220909+dfsg-6 in Debian trixie and elsewhere, sends an X11 selection to the dict.youdao.com and dict.cn servers via cleartext HTTP.",
"id": "GHSA-mr85-g3h9-44r6",
"modified": "2025-11-05T00:31:24Z",
"published": "2025-08-04T21:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55014"
},
{
"type": "WEB",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1110370"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-user/2025/08/msg00076.html"
},
{
"type": "WEB",
"url": "https://lwn.net/SubscriberLink/1032732/3334850da49689e1"
},
{
"type": "WEB",
"url": "https://news.ycombinator.com/item?id=44872313"
},
{
"type": "WEB",
"url": "https://packages.debian.org/trixie/stardict"
},
{
"type": "WEB",
"url": "https://packages.debian.org/trixie/stardict-gtk"
},
{
"type": "WEB",
"url": "https://stardict-4.sourceforge.net/index_en.php"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2025/08/04/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/08/08/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PW4Q-8MRR-P3WW
Vulnerability from github – Published: 2025-07-02 06:30 – Updated: 2025-07-02 06:30In One Identity OneLogin Active Directory Connector before 6.1.5, encryption of the DirectoryToken was mishandled, aka ST-812.
{
"affected": [],
"aliases": [
"CVE-2025-52925"
],
"database_specific": {
"cwe_ids": [
"CWE-402"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-02T04:15:55Z",
"severity": "MODERATE"
},
"details": "In One Identity OneLogin Active Directory Connector before 6.1.5, encryption of the DirectoryToken was mishandled, aka ST-812.",
"id": "GHSA-pw4q-8mrr-p3ww",
"modified": "2025-07-02T06:30:30Z",
"published": "2025-07-02T06:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52925"
},
{
"type": "WEB",
"url": "https://oneidentity.com"
},
{
"type": "WEB",
"url": "https://onelogin.service-now.com/support?id=kb_article\u0026sys_id=b69c9c6c8762e210f7b8a7dd3fbb356e\u0026kb_category=f91821b0db185340d5505eea4b9619f9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RQH4-X2V7-J34G
Vulnerability from github – Published: 2024-01-12 00:30 – Updated: 2024-05-20 12:30A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem. When a cgroup is being destroyed, cgroup_rstat_flush() is only called at css_release_work_fn(), which is called when the blkcg reference count reaches 0. This circular dependency will prevent blkcg and some blkgs from being freed after they are made offline. This issue may allow an attacker with a local access to cause system instability, such as an out of memory error.
{
"affected": [],
"aliases": [
"CVE-2024-0443"
],
"database_specific": {
"cwe_ids": [
"CWE-402",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-12T00:15:45Z",
"severity": "MODERATE"
},
"details": "A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem. When a cgroup is being destroyed, cgroup_rstat_flush() is only called at css_release_work_fn(), which is called when the blkcg reference count reaches 0. This circular dependency will prevent blkcg and some blkgs from being freed after they are made offline. This issue may allow an attacker with a local access to cause system instability, such as an out of memory error.",
"id": "GHSA-rqh4-x2v7-j34g",
"modified": "2024-05-20T12:30:27Z",
"published": "2024-01-12T00:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0443"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:6583"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7077"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7370"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-0443"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2257968"
},
{
"type": "WEB",
"url": "https://lore.kernel.org/linux-block/20221215033132.230023-3-longman@redhat.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WJRH-HJ83-3WH7
Vulnerability from github – Published: 2025-05-27 18:03 – Updated: 2025-05-27 18:03Impact
Instances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and ModelSelect2Widget can secret access tokens across requests. This can allow users to access restricted querysets and restricted data.
Patches
The problem has been patched in version 8.4.1 and all following versions.
Workarounds
This vulnerability is limited use cases where instances of widget classes are created during app loading (not during a request).
Example of affected code:
class MyForm(forms.ModelForm):
class Meta:
widgets = {"my_select_field": Select2ModelWidget()}
Django allows you to pass just the widget class (not the instance). This can be used to mitigate the session request leak.
Example of affected code:
class MyForm(forms.ModelForm):
class Meta:
widgets = {"my_select_field": Select2ModelWidget}
References
Thanks to @neartik for reporting this issue. I will address it later. I had to delete your issue, to avoid exploitation of this security issue.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "django-select2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.4.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-48383"
],
"database_specific": {
"cwe_ids": [
"CWE-402",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2025-05-27T18:03:19Z",
"nvd_published_at": "2025-05-27T15:15:35Z",
"severity": "HIGH"
},
"details": "### Impact\n\nInstances of `HeavySelect2Mixin` subclasses like the `ModelSelect2MultipleWidget` and `ModelSelect2Widget` can secret access tokens across requests. This can allow users to access restricted querysets and restricted data.\n\n### Patches\n\nThe problem has been patched in version 8.4.1 and all following versions.\n\n### Workarounds\n\nThis vulnerability is limited use cases where instances of widget classes are created during app loading (not during a request).\n\nExample of affected code:\n```python\nclass MyForm(forms.ModelForm):\n class Meta:\n widgets = {\"my_select_field\": Select2ModelWidget()}\n```\n\nDjango allows you to pass just the widget class (not the instance). This can be used to mitigate the session request leak.\n\nExample of affected code:\n```python\nclass MyForm(forms.ModelForm):\n class Meta:\n widgets = {\"my_select_field\": Select2ModelWidget}\n```\n\n\n\n### References\n\nThanks to @neartik for reporting this issue. I will address it later. I had to delete your issue, to avoid exploitation of this security issue.",
"id": "GHSA-wjrh-hj83-3wh7",
"modified": "2025-05-27T18:03:19Z",
"published": "2025-05-27T18:03:19Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/codingjoe/django-select2/security/advisories/GHSA-wjrh-hj83-3wh7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48383"
},
{
"type": "WEB",
"url": "https://github.com/codingjoe/django-select2/commit/e5f41e6edba004d35f94915ff5e2559f44853412"
},
{
"type": "PACKAGE",
"url": "https://github.com/codingjoe/django-select2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.