CWE-610: Externally Controlled Reference to a Resource in Another Sphere
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- stirling-tools stirling-pdf Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass 5.3 Medium
- hcl software bigfix aex HCL BigFix AEX is affected by multiple security vulnerabilities. 4.2 Medium
- google cloud application integration Confused Deputy in Application Integration allows Internal File Read 8.3 High
- google chrome Externally controlled reference in DevTools in Google Chrome prior to 154.0.8037.57 allowed an... 8.0 High
- fasterxml jackson-databind jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path 5.3 Medium
- hclsoftware bigfix quantum risk analyzer HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and downloading code without integrity checking 4.4 Medium
- google chrome Externally controlled reference in WebView in Google Chrome on on Android prior to 152.0.7977.65... 8.3 High
- google chrome Externally controlled reference in QUIC in Google Chrome prior to 152.0.7977.65 allowed a remote... 4.3 Medium
- git-for-windows git Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows 7.4 High
- pkp pkp-lib pkp pkp-lib XSLTransformer.php _transformPHP xml external entity reference 5.1 Medium
- red hat enterprise linux 10, enterprise linux 9 +1 more Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure via leapp report tampering 6.2 Medium
- koxudaxi datamodel-code-generator datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs` 7.5 High
- koxudaxi datamodel-code-generator Arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate 7.5 High
- grafana mcp server SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header 8.6 High
- google apigee Cross-Tenant Data Exfiltration in Apigee via BigQuery Confused Deputy 5.9 Medium
- citrix netscaler gateway, netscaler adc, gateway +1 more +3 more Arbitrary File Read (Unauthenticated) 7.1 High
- jenkins project owasp zap plugin, jenkins official owasp zap +1 more Jenkins OWASP ZAP Plugin: Builds executed on the Jenkins controller can lead to RCE 8.8 High
- zhilink 智互联(深圳)科技有限公司 adp application developer platform 应用开发者平台 zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 XML Parser import xml external entity reference 5.3 Medium
- microsoft azure stack edge Azure Stack Edge Remote Code Execution Vulnerability 9.8 Critical
- netgear cbr750, cbr750 firmware, ex6120 +67 more +69 more Certain NETGEAR devices allow administrators to tamper with system 4.3 Medium
- apache software foundation camel k Apache Camel K: Camel K Cross-Namespace Build Deputy Attack 8.1 High
- tenable terrascan Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via external URL... 9.3 Critical
- tenable terrascan Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the... 9.3 Critical
- zoom communications workplace vdi plugin, zoom workplace virtual desktop infrastructure +1 more External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal... 7.8 High
- microsoft sql server 2016 service pack 3 (gdr), sql server 2016 service pack 3 azure connect feature pack, sql server 2017 (cu 31) +12 more +14 more SQL Server Remote Code Execution Vulnerability 8.8 High
- microsoft edge (chromium-based), edge chromium +1 more Microsoft Edge (Chromium-based) Information Disclosure Vulnerability 7.4 High
- microsoft azure monitor, azure monitor agent +1 more Azure Monitor Agent Elevation of Privilege Vulnerability 7.8 High
- microsoft partner center Microsoft Partner Center Spoofing Vulnerability 8.2 High
- openclaw OpenClaw < 2026.4.22 - Connector Endpoint Host Override via Workspace dotenv Files 4.1 Medium
- tp-link systems inc. ax53 v1.0, tp-link archer ax53 firmware +1 more Arbitrary File Reading Vulnerability in dnsmasq Module in TP-Link AX53 6.8 Medium
- tp-link systems inc. ax53 v1.0, tp-link archer ax53 firmware +1 more Arbitrary File Reading Vulnerability in OpenVPN Module in TP-Link AX53 6.8 Medium
- vertigis fm Local File Inclusion in the File Upload/Download Process 7.4 High
- zoom communications workplace, zoom workplace desktop, workplace virtual desktop infrastructure +2 more External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6... 9.6 Critical
- acronis cyber protect 17, cyber protect +1 more Local privilege escalation due to improper soft link handling. The following products are... 7.3 High
- acronis cyber protect 17, cyber protect +1 more Local privilege escalation due to improper soft link handling. The following products are... 7.3 High
- openclaw OpenClaw < 2026.2.21 - Arbitrary Local File Read via Browser Navigation Guard 7.1 High
- google android In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a... 7.8 High
- jeesite thinkgem JeeSite Endpoint CasOutHandler.java xml external entity reference 2.3 Low
- opencc jflow opencc JFlow Workflow WF_Admin_AttrFlow.java Imp_Done xml external entity reference 5.3 Medium
- zoneland o2oa O2OA HTTP POST Request check xml external entity reference 5.3 Medium
- bjskzy zhiyou erp Bjskzy Zhiyou ERP com.artery.richclient.RichClientService RichClientService.class initRCForm xml external entity reference 5.3 Medium
- beecue fastbee beecue FastBee SIP Message ReqAbstractHandler.java getRootElement xml external entity reference 6.3 Medium
- langflow Langflow Vulnerable to External Control of File Name or Path 7.1 High
- google android In multiple locations, there is a possible way to alter the primary user's face unlock settings... 6.6 Medium
- bestfeng oa git free bestfeng oa_git_free WorkflowPredefineController.java updateWriteBack xml external entity reference 5.3 Medium
- jinher oa Jinher OA type xml external entity reference 6.9 Medium
- bjskzy zhiyou erp Bjskzy Zhiyou ERP com.artery.richclient.RichClientService openForm xml external entity reference 6.9 Medium
- jinher oa Jinher OA text xml external entity reference 5.3 Medium
- jinher oa Jinher OA XML text xml external entity reference 6.9 Medium
- patika global technologies humansuite IDOR in Patika Global Technologies' HumanSuite 6.5 Medium
- Show olderLoading…