CWE-610: Externally Controlled Reference to a Resource in Another Sphere
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- rockwell automation thinmanagerRockwell Automation ThinManager® Server-Side Request Forgery Vulnerability8.6 High
- jinher oaJinher OA XML Type xml external entity reference6.9 Medium
- jinher oaJinher OA XML Type xml external entity reference6.9 Medium
- acronis cyber protect cloud agentLocal privilege escalation due to improper soft link handling. The following products are...7.3 High
- global interactive design media software inc. content management system (cms), sitecore experience platform (xp) +1 moreSitecore XP < 8.0 and CMS < 7.2 and < 7.5 File Read via Known Path6.9 Medium
- jinher oaJinher OA XmlHttp.aspx xml external entity reference6.9 Medium
- jinher oaJinher OA ProjectScheduleDelete.aspx xml external entity reference6.9 Medium
- jinher oaJinher OA DelTemp.aspx xml external entity reference6.9 Medium
- brainstormforce sureforms, sureforms – drag and drop form builder for wordpress +1 moreSureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion8.1 High
- fengoffice feng officeFengoffice Feng Office Document Upload ApplicationDataObject.class.php xml external entity reference5.3 Medium
- schneider electric modicon controllers m241 / m251, modicon controllers m258 / lmc058 +1 moreCWE-610: Externally Controlled Reference to a Resource in Another Sphere vulnerability exists...8.7 High
- microsoft defender for endpoint, defender for endpoint for linux +1 moreMicrosoft Defender Elevation of Privilege Vulnerability6.7 Medium
- netskope clientSymlink Following in Netskope Client Postinstall Script5.2 Medium
- zhangyanbo2007 youkefuzhangyanbo2007 youkefu XML Document CallCenterRouterController.java xml external entity reference5.3 Medium
- google androidIn generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media...5.5 Medium
- google androidIn showAvatarPicker of EditUserPhotoController.java, there is a possible cross user image leak...5.5 Medium
- No product listedcrmeb_java WeChatMessageController.java webHook xml external entity reference5.3 Medium
- esri arcgis serverLocal file inclusion (LFI) vulnerability in ArcGIS Server7.5 High
- google androidIn checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user...4.0 Medium
- google androidIn multiple functions of StatusHint.java and TelecomServiceImpl.java, there is a possible way to...5.5 Medium
- palo alto networks cloud ngfw, pan-os, prisma access +2 morePAN-OS: Authenticated File Read Vulnerability in the Management Web Interface7.1 High
- r1bbit yimioaywoa WXCallBack Interface XMLParse.java extract xml external entity reference5.3 Medium
- fortinet fortimanager, fortiadc, fortianalyzer +15 more +17 moreA externally controlled reference to a resource in another sphere in Fortinet FortiManager before...4.1 Medium
- namelessmc namelessAccount Takeover in NamelessMC9.0 Critical
- hcl software dryice myxalyticsHCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability8.9 High
- ldapaccountmanager lamArbitrary config values override in lam6.5 Medium
- postgresqlPostgreSQL PL/Perl environment variable changes execute arbitrary code8.8 High
- gaizhenbiao chuanhuchatgpt, gaizhenbiao/chuanhuchatgpt +1 moreFile Overwrite Vulnerability in gaizhenbiao/chuanhuchatgpt6.5 Medium
- discourseAnonymous cache poisoning via XHR requests in Discourse8.2 High
- rockwell automation thinmanagerThinManager® Code Execution Vulnerability8.5 High
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreMongoDB Server binaries may load potentially insecure shared libraries from specific relative paths6.4 Medium
- oretnom23 simple online bidding systemSourceCodester Simple Online Bidding System index.php file inclusion5.3 Medium
- hashicorp nomad, nomad enterprise +1 moreNomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking5.8 Medium
- rockwell automation emulate3d™, rockwellautomation emulate3d +1 moreDLL Hijacking Vulnerability Exists in Rockwell Automation Emulate3D™5.4 Medium
- dell alienware update, update, command update +1 more +3 moreDell Command | Update, Dell Update, and Alienware Update UWP, versions prior to 5.4, contain an...6.5 Medium
- hashicorp nomad, nomad enterprise +1 moreNomad Vulnerable to Allocation Directory Path Escape Through Archive Unpacking7.7 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +31 more +33 moreWindows Distributed Transaction Coordinator Remote Code Execution Vulnerability6.6 Medium
github.com/cometbft/cometbftGoCometBFT is unstability during blocksync when syncing from malicious peerNo score- google androidIn updateNotificationChannelFromPrivilegedListener of NotificationManagerService.java, there is a...7.8 High
- checkmkUnrestricted upload and download paths in check_sftp8.8 High
- fermyon spinSpin contains a potential network sandbox escape for specifically configured Spin applications9.1 Critical
- avg antivirus free, bitdefender antivirus, antivirus plus +2 more +4 moreLocal privilege escalation in Bitdefender Total Security (VA-11168)7.8 High
- canonical snapdsnapd will follow archived symlinks when unpacking a filesystem4.8 Medium
- espocrmEspoCRM weakness in "Forgot password"5.9 Medium
- dompdf php-svg-libphp-svg-lib lacks path validation on font through SVG inline styles6.8 Medium
- micronaut-projects micronaut-core, objectcomputing micronaut +1 moremicronaut-core management endpoints vulnerable to drive-by localhost attack5.1 Medium
- hashicorp nomad, nomad enterprise +1 moreNomad Vulnerable to Arbitrary Write Through Symlink Attack7.7 High
- mailcow mailcow-dockerized, mailcow\ +1 moreMailcow Docker Container Exposure to Local Network8.8 High
- cloudlinux cagefsCloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail...4.4 Medium
- foru cmsForU CMS channel.php file inclusion4.7 Medium
- Show moreLoading…