CWE-668: Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- netgain systems enterprise managerThis vulnerability allows remote attackers to overwrite arbitrary files on vulnerable...6.5 Medium
- netgain systems enterprise managerThis vulnerability allows remote attackers to overwrite files on vulnerable installations of...6.5 Medium
- netgain systems enterprise managerThis vulnerability allows remote attackers to delete arbitrary files on vulnerable installations...6.5 Medium
- netgain systems enterprise managerThis vulnerability allows remote attackers to execute code by overwriting arbitrary files on...8.8 High
- netgain systems enterprise managerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations...9.8 Critical
- netgain systems enterprise managerThis vulnerability allows remote attackers to delete arbitrary files on vulnerable installations...6.5 Medium
- vim, canonical ubuntu linux, debian linux +2 morefileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary...5.5 Medium
- cisco webex meetings serverA vulnerability in Cisco WebEx Meeting Server could allow an unauthenticated, remote attacker to...5.3 Medium
- cisco nx-osA vulnerability in the guest shell feature of Cisco NX-OS System Software could allow an...5.7 Medium
- cisco nx-osA vulnerability in the Open Agent Container (OAC) feature of Cisco Nexus Series Switches could...6.8 Medium
- huawei technologies co., ltd. me906s-158, huawei me906s-158 firmware +1 moreME906s-158 earlier than ME906S_Installer_13.1805.10.3 versions has a privilege elevation...7.8 High
- huawei technologies co., ltd. vicky-al00a, huawei p10 plus firmware +1 moreHuawei smart phones with software earlier than Vicky-AL00AC00B172D versions have a Factory Reset...4.6 Medium
- huawei eva-l09EVA-L09 smartphones with software Earlier than EVA-L09C25B150CUSTC25D003 versions,Earlier than...4.6 Medium
- cactiCacti 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks...7.2 High
- google chrome, debian linux +1 moreInsufficient Policy Enforcement in Devtools remote debugging in Google Chrome prior to 62.0.3202...8.8 High
- xenAn issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to cause a denial of...8.8 High
- cisco meeting serverA vulnerability in the Traversal Using Relay NAT (TURN) server included with Cisco Meeting Server...9.1 Critical
- siemens ozw672 firmware, ozw772 firmware +1 moreA vulnerability was discovered in Siemens OZW672 (all versions) and OZW772 (all versions) that...6.5 Medium
- trend micro deep discovery email inspectorDenial of Service vulnerability in Trend Micro Deep Discovery Email Inspector 2.5.1 allows remote...7.5 High
- microsoft windows 10, windows server 2016, microsoft corporation windows +2 moreMicrosoft Windows 10 1607 and Windows Server 2016 allow an attacker to exploit a security feature...5.3 Medium
- moodleMoodle Unauthorized searching of arbitrary blogs by typing full url5.3 Medium
- rubocop project rubocopRuboCop gem Insecure use of /tmp3.3 Low
- apache tomcatExposure of Resource to Wrong Sphere in Apache Tomcat9.1 Critical
- tcpdf project tcpdftcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP.7.5 High
- norwegian-air norwegian air kioskThe Norwegian Air Shuttle (aka norwegian.com) airline kiosk allows physically proximate attackers...6.6 Medium
- vmware identity manager, vrealize automation +1 moreVMware Identity Manager 2.x before 2.7.1 and vRealize Automation 7.x before 7.2.0 allow remote...5.3 Medium
- ge cimplicityGeneral Electric (GE) Digital Proficy HMI/SCADA - CIMPLICITY before 8.2 SIM 27 mishandles service...6.3 Medium
- redhat satellite, network satellite, satellite with embedded oracle +2 more +4 moreRed Hat Satellite 5.6 and earlier does not disable the web interface that is used to create the...7.5 High
- google chromeGoogle Chrome 17.0.963.66 and earlier allows remote attackers to bypass the sandbox protection...10.0 High
- microsoft internet explorerMicrosoft Internet Explorer 6 through 9 does not properly implement JavaScript event handlers,...4.3 Medium
- microsoft internet explorerMicrosoft Internet Explorer 6 through 8 does not properly restrict web script, which allows user...4.3 Medium
- opera browserOpera 7.54 and earlier does not properly limit an applet's access to internal Java packages from...2.6 Low
- acme mini httpdAcme mini_httpd before 1.16 allows remote attackers to view sensitive files under the document...5.0 Medium
- acme thttpdAcme Thttpd Secure Webserver before 2.22, with the chroot option enabled, allows remote attackers...5.0 Medium