CWE-668: Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- ibm security guardium big data intelligenceIBM Security Guardium Big Data Intelligence (SonarG) 4.0 specifies permissions for a security...6.5 Medium
- philips intellispace perinatalIn IntelliSpace Perinatal, Versions K and prior, a vulnerability within the IntelliSpace...6.8 Medium
- cisco ios xe, ios xe software 3.2.11asg +1 moreCisco IOS XE Software ASIC Register Write Vulnerability5.5 Medium
- vandyvape swell kit mod firmwareAn issue was discovered on Swell Kit Mod devices that use the Vandy Vape platform. An attacker...4.3 Medium
- html-pdf project html-pdfArbitrary File Read in html-pdf7.5 High
- usabilitydynamics wp-invoiceThe wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over...5.3 Medium
- usabilitydynamics wp-invoiceThe wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa...5.3 Medium
- usabilitydynamics wp-invoiceThe wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal...5.3 Medium
- usabilitydynamics wp-invoiceThe wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id...5.3 Medium
- usabilitydynamics wp-invoiceThe wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init...5.3 Medium
- cpanelcPanel before 68.0.27 allows certain file-write operations via the telnetcrt script (SEC-356).5.5 Medium
- cpanelcPanel before 11.54.0.4 allows arbitrary code execution during locale duplication (SEC-72).8.8 High
- google kubernetes engine, jenkins project google kubernetes engine plugin +1 moreJenkins Google Kubernetes Engine Plugin vulnerable to Exposure of Resource to Wrong Sphere4.3 Medium
- comodo antivirusComodo Antivirus versions up to 12.0.0.6810 are vulnerable to Arbitrary File Write due to Cavwp...5.5 Medium
- mozilla firefox, opensuse leap +1 moreThe HTTP Alternative Services header, Alt-Svc, can be used by a malicious site to scan all TCP...4.7 Medium
- avtech room alert 3e firmwareOn AVTECH Room Alert 3E devices before 2.2.5, an attacker with access to the device's web...8.8 High
- jetbrains intellij ideaIn several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default...9.8 Critical
- facebook hhvmHHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior...7.5 High
- qemuThe QMP guest_exec command in QEMU 4.0.0 and earlier is prone to OS command injection, which...9.8 Critical
- qemuThe QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection,...9.8 Critical
- cisco digital network architecture center (dna center), digital network architecture center +1 moreCisco DNA Center Authentication Bypass Vulnerability9.3 Critical
- gnupg libgcrypt, opensuse leap, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 moreIn Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel...5.9 Medium
- alpinelinux abuildAlpine Linux abuild through 3.4.0 allows an unprivileged member of the abuild group to add an...6.5 Medium
- suse rancherRancher Privilege Escalation Vulnerability8.8 High
- gog galaxy, gog.com gog galaxy +1 moreAn exploitable local privilege elevation vulnerability exists in the file system permissions of...9.3 Critical
- schneider-electric modicon m340 firmware, modicon m580 firmware, modicon premium firmware +1 more +3 moreA CWE-501: Trust Boundary Violation vulnerability on connection to the Controller exists in all...9.8 Critical
- suse rancherAccess Control Bypass8.8 High
- raspberrypi raspberry pi 3 model b\+ firmwareThe ARM-based hardware debugging feature on Raspberry Pi 3 module B+ and possibly other devices...9.8 Critical
- qemu, opensuse leap +1 morehw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares...3.3 Low
- atlassian confluence server, confluence data center +1 moreAtlassian Confluence Server and Data Center before version 6.13.1 allows an authenticated user to...6.5 Medium
- flatpak, debian linux, redhat enterprise linux desktop +5 more +7 moreFlatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script...8.2 High
- ibm websphere application serverIBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to gain elevated...6.0 Medium
- ivanti workspace controlAn issue was discovered in Ivanti Workspace Control before 10.3.10.0 and RES One Workspace. A...7.8 High
- apache traffic server, debian linux +1 morePages that are rendered using the ESI plugin can have access to the cookie header when the plugin...5.3 Medium
- planex cs-qr20 firmwareAn issue was discovered on the PLANEX CS-QR20 1.30. A hidden and undocumented management page...7.2 High
- hewlett packard enterprise hpe moonshot provisioning manager, hp moonshot provisioning manager, canonical ubuntu linux +2 moreA local arbitrary file modification vulnerability was identified in HPE Moonshot Provisioning...5.5 Medium
- hewlett packard enterprise hpe moonshot provisioning manager, hp moonshot provisioning manager +1 moreA remote bypass of security restrictions vulnerability was identified in HPE Moonshot...9.8 Critical
- philips brilliance ct big bore firmware, brilliance ct scanners, brilliance firmware 64 +2 more +4 moreVulnerabilities within the Philips Brilliance CT kiosk environment (Brilliance 64 version 2.6.2...8.7 High
- kde ktexteditorAn issue was discovered in KTextEditor 5.34.0 through 5.45.0. Insecure handling of temporary...7.8 High
- mediawiki, debian linux +1 moreHaving LocalisationCache directory default to system tmp directory is insecure8.8 High
- qualcomm mdm9206 firmware, mdm9607 firmware, msm8996 firmware +3 more +5 moreIn Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile and...9.8 Critical
- qualcomm mdm9206 firmware, mdm9607 firmware, mdm9650 firmware +7 more +9 moreIn Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon...7.5 High
- yzmcmsYzmCMS 3.6 allows remote attackers to discover the full path via a direct request to application...5.3 Medium
- dedecmsDedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include...7.5 High
- phome empirecmsEmpireCMS 6.6 through 7.2 allows remote attackers to discover the full path via an array value...5.3 Medium
- netgain systems enterprise managerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations...9.8 Critical
- netgain systems enterprise managerThis vulnerability allows remote attackers to execute code by creating arbitrary files on...8.8 High
- netgain systems enterprise managerThis vulnerability allows remote attackers to overwrite arbitrary files on vulnerable...6.5 Medium
- netgain systems enterprise managerThis vulnerability allows remote attackers to overwrite arbitrary files on vulnerable...6.5 Medium
- netgain systems enterprise managerThis vulnerability allows remote attackers to execute code by creating arbitrary files on...8.8 High
- Show moreLoading…