CWE-610: Externally Controlled Reference to a Resource in Another Sphere
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- jenkins project compuware source code download for endevor, pds, and ispw plugin, jenkins compuware source code download for endevor\, pds\, and ispw +1 moreAgent-to-controller security bypass vulnerability in Jenkins BMC Compuware Source Code Download for Endevor, PDS, and ISPW Plugin5.3 Medium
- perfact openvpn-clientPerFact OpenVPN-Client8.8 High
- onedev project onedevCI/CD Docker Escape in OneDev9.9 Critical
- qnap photo stationDeadBolt Ransomware10.0 Critical
- connekthq ajax load more, dcooney ajax load more – infinite scroll, load more, & lazy load +1 moreWordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Authenticated (Admin+) Arbitrary File Read4.9 Medium
- plugins360 all-in-one video galleryThe All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and...7.5 High
- codename065 download managerDownload Manager <= 3.2.50 - Authenticated (Contributor+) Arbitrary File Deletion8.1 High
- mozilla thunderbirdWhen receiving an HTML email that contained an <code>iframe</code> element, which used a <code...6.5 Medium
- atlasgondal export all urlsExport All URLs < 4.4 - Admin+ Arbitrary System File Removal6.5 Medium
- wwbn avideoAn information disclosure vulnerability exists in the aVideoEncoderReceiveImage functionality of...6.5 Medium
- wwbn avideoAn information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6...6.5 Medium
- google androidIn DreamServices, there is a possible way to launch arbitrary protected activities due to a...7.8 High
- google android'remap_pfn_range' here may map out of size kernel memory (for example, may map the kernel area),...9.8 Critical
- mb.miniaudioplayer project mb.miniaudioplayerWordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple...7.5 High
- devolutions server, filezilla-project filezilla server +1 moreFileZilla Server PORT confused deputy4.3 Medium
- honeywell alerton compassHoneywell Alerton Compass Software 1.6.5 allows unauthenticated configuration changes from remote...6.5 Medium
- google androidIn assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible way to...7.8 High
- ruby-mysql project ruby-mysqlRuby-MySQL Gem Client File Read6.5 Medium
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +30 more +32 moreMicrosoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability7.8 High
- aceware aceweb online portalACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name...7.5 High
- fortinet forticlient, forticlientwindows +1 moreA external control of file name or path in Fortinet FortiClientWindows version 7.0.2 and below,...8.4 High
- cisco unified communications managerCisco Unified Communications Products Arbitrary File Write Vulnerability4.9 Medium
- metabaseDatabase bypassing any permissions in Metabase via SQlite attach8.0 High
- google androidIn SystemUI, there is a possible arbitrary Activity launch due to a confused deputy. This could...7.8 High
- google androidIn Gallery, there is a possible permission bypass due to a confused deputy. This could lead to...5.5 Medium
- google androidIn onReceive of AppRestrictionsFragment.java, there is a possible way to start a phone call...7.8 High
- google androidIn updateState of UsbDeviceManager.java, there is a possible unauthorized access of files due to...7.8 High
- thimpress learnpressLearnPress < 4.1.5 - Arbitrary Image Renaming4.3 Medium
- google androidIn onActivityViewReady of DetailDialog.kt, there is a possible Intent Redirect due to a confused...7.8 High
- google androidIn openFileAndEnforcePathPermissionsHelper of MediaProvider.java, there is a possible bypass of a...7.8 High
- google androidIn setLaunchIntent of BluetoothDevicePickerPreferenceController.java, there is a possible way to...7.8 High
- netristv netristv/ws-scrcpy, ws scrcpy project scrcpy +1 moreExternal Control of File Name or Path in netristv/ws-scrcpy7.5 High
- huawei harmonyosHisuite module has a External Control of System or Configuration Setting vulnerability.Successful...5.3 Medium
- huawei harmonyosPassword vault has a External Control of System or Configuration Setting vulnerability.Successful...7.5 High
- google androidIn onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due...7.8 High
- msedgeredirect project msedgeredirectExternally Controlled Reference to a Resource in Another Sphere in MSEdgeRedirect8.8 High
- uipath assistantUiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path...9.8 Critical
- fortinet fortiwebA unintended proxy or intermediary ('confused deputy') in Fortinet FortiWeb version 6.4.1 and...5.5 Medium
- sonicwall sma 200 firmware, sma 210 firmware, sma 400 firmware +3 more +5 moreAn unauthenticated remote attacker can use SMA 100 as an unintended proxy or intermediary...9.8 Critical
- discourseAnonymous user cache poisoning via development-mode header in Discourse5.3 Medium
- libretime hvlibretime hv3.0.0-alpha.10 is affected by a path manipulation vulnerability in /blob/master...9.8 Critical
- google androidIn adjustStreamVolume of AudioService.java, there is a possible way for unprivileged app to...7.8 High
- grafanaCross organization admin control in Grafana9.1 Critical
- google androidIn runDumpHeap of ActivityManagerShellCommand.java, there is a possible deletion of system files...7.8 High
- kubernetesHoles in EndpointSlice Validation Enable Host Network Hijack3.1 Low
- kubernetesWebhook redirect in kube-apiserver4.1 Medium
- maccmsAn arbitrary file deletion vulnerability exists within Maccms10.6.5 Medium
- nim-langA vulnerability in all versions of Nim-lang allows unauthenticated attackers to write files to...5.5 Medium
- acronis true imageAcronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to...7.8 High
- acronis true imageAcronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to...7.8 High
- Show moreLoading…