CWE-610: Externally Controlled Reference to a Resource in Another Sphere
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- huawei harmonyosA component of the HarmonyOS has a External Control of System or Configuration Setting...7.8 High
- google androidIn sendDevicePickedIntent of DevicePickerFragment.java, there is a possible way to invoke a...7.8 High
- google androidIn sendReplyIntentToReceiver of BluetoothPermissionActivity.java, there is a possible way to...7.3 High
- projectcontour contourAuthorization bypass in Contour8.5 High
- racketConfused deputy attack in sandbox module resolution6.1 Medium
- apache druidApache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended6.5 Medium
- google androidIn scheduleTimeoutLocked of NotificationRecord.java, there is a possible disclosure of a...5.5 Medium
- mozilla firefoxA malicious website that causes an HTTP Authentication dialog to be spawned could trick the built...5.3 Medium
- google androidIn handleAppLaunch of AppLaunchActivity.java, there is a possible arbitrary activity launch due...7.8 High
- google androidIn onLoadFailed of AnnotateActivity.java, there is a possible way to gain WRITE_EXTERNAL_STORAGE...7.8 High
- google androidIn dropFile of WiFiInstaller, there is a way to delete files accessible to CertInstaller due to a...7.8 High
- cisco identity services engine, prime infrastructure, identity services engine software +1 more +3 moreCisco ADE-OS Local File Inclusion Vulnerability4.4 Medium
- synology antivirus essentialExternally controlled reference to a resource in another sphere in quarantine functionality in...9.0 Critical
- apache openofficeCode execution in Apache OpenOffice via non-http(s) schemes in Hyperlinks8.8 High
- altn mdaemonAn issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to...7.2 High
- advantech webaccess\/scadaThe WADashboard component of WebAccess/SCADA Versions 9.0 and prior may allow an attacker to...8.8 High
- redwood report2webA frame-injection issue in the online help in Redwood Report2Web 4.3.4.5 allows remote attackers...5.3 Medium
- f2fs-tools project f2fs-toolsAn exploitable code execution vulnerability exists in the multiple devices functionality of F2fs...8.2 High
- google androidIn DocumentsUI, there is a possible permission bypass due to a confused deputy. This could lead...7.8 High
- google androidIn AccountManager, there is a possible bypass of a permissions check due to a confused deputy....5.0 Medium
- google androidIn MediaProvider, there is a possible bypass of a permissions check due to a confused deputy....5.5 Medium
- google androidIn WindowManager, there is a possible launch of an unexpected app due to a confused deputy. This...7.8 High
- opensuse open build serviceobs-service-download_files allows downloading from localhost or intranet hosts6.5 Medium
- phpbbphpBB Server-Side Request Forgery Vulnerability5.8 Medium
- spring by vmware cloud netflix, vmware spring cloud netflix +1 moreHystrix Dashboard Proxy In spring-cloud-netflix-hystrix-dashboard6.5 Medium
- kubernetes ingress-nginxKubernetes ingress-nginx Compromise of auth via subset/superset namespace names5.9 Medium
- monstaftp monsta ftpMonsta FTP 2.10.1 or below allows external control of paths used in filesystem operations. This...9.8 Critical
- google androidIn removeSharedAccountAsUser of AccountManager.java, there is a possible permissions bypass to a...7.8 High
- octobercms octoberArbitrary File Deletion vulnerability in OctoberCMS6.2 Medium
- octobercms octoberUpload whitelisted files to any directory in OctoberCMS3.4 Low
- palo alto networks pan-osPAN-OS: Panorama SD WAN arbitrary file creation7.2 High
- naver cloud explorerNaver Cloud Explorer before 2.2.2.11 allows the attacker can move a local file in any path on the...9.8 Critical
- red hat ansible, redhat ansible engine, fedoraproject fedora +6 more +8 moreExternally Controlled Reference to a Resource in Another Sphere, Improper Input Validation, and External Control of File Name or Path in Ansible7.3 High
- apple shortcutsAn access issue was addressed with additional sandbox restrictions. This issue is fixed in...10.0 Critical
- elog, fedoraproject fedora +1 moreELOG 3.1.4-57bea22 and below can be used as an HTTP GET request proxy when unauthenticated remote...6.5 Medium
- qnap photo stationThis external control of file name or path vulnerability allows remote attackers to access or...9.8 Critical
- qnap photo stationThis external control of file name or path vulnerability allows remote attackers to access or...9.8 Critical
- sony xperia touch firmwareThe Sony Xperia Touch Android device with a build fingerprint of Sony/blanc_windy/blanc_windy:7.0...5.5 Medium
- mi a3 firmwareThe Xiaomi Mi A3 Android device with a build fingerprint of xiaomi/onc_eea/onc:9/PKQ1.181021.001...5.5 Medium
- mi cepheus firmwareThe Xiaomi Cepheus Android device with a build fingerprint of Xiaomi/cepheus/cepheus:9/PKQ1...5.5 Medium
- mi a2 lite firmwareThe Xiaomi Mi A2 Lite Android device with a build fingerprint of xiaomi/jasmine/jasmine_sprout:9...5.5 Medium
- mi a2 lite firmwareThe Xiaomi Mi A2 Lite Android device with a build fingerprint of xiaomi/daisy/daisy_sprout:9/PKQ1...5.5 Medium
- mi a2 lite firmwareThe Xiaomi Mi A2 Lite Android device with a build fingerprint of xiaomi/daisy/daisy_sprout:9/PKQ1...5.5 Medium
- mi mix 2s firmwareThe Xiaomi Mi Mix 2S Android device with a build fingerprint of Xiaomi/polaris/polaris:8.0.0/OPR1...3.3 Low
- mi redmi 6 pro firmwareThe Xiaomi Redmi 6 Pro Android device with a build fingerprint of xiaomi/sakura_india...3.3 Low
- panasonic eluga i9 firmwareThe Panasonic ELUGA_I9 Android device with a build fingerprint of Panasonic/ELUGA_I9/ELUGA_I9:7.0...7.8 High
- mi note 2 firmwareThe Xiaomi Mi Note 2 Android device with a build fingerprint of Xiaomi/scorpio/scorpio:6.0.1...3.3 Low
- mi mix firmwareThe Xiaomi Mi Mix Android device with a build fingerprint of Xiaomi/lithium/lithium:6.0.1/MXB48T...3.3 Low
- mi 5s plus firmwareThe Xiaomi 5S Plus Android device with a build fingerprint of Xiaomi/natrium/natrium:6.0.1/MXB48T...3.3 Low
- katadigital m4s firmwareThe Kata M4s Android device with a build fingerprint of alps/full_hct6750_66_n/hct6750_66_n:7.0...3.3 Low
- Show moreLoading…