CWE-668: Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- cisco firepower threat defense software, ios, secure firewall management center +1 more +3 moreMultiple Cisco Products Snort HTTP Detection Engine File Policy Bypass Vulnerability5.8 Medium
- silver peak systems, inc. 1. unity edgeconnect, nx, vx 2. unity orchestrator, 3. edgeconnect in aws, azure, gcp, silver-peak nx-1000 firmware, nx-10k firmware +22 more +24 moreIPSec UDP key material can be retrieved from EdgeConnect by a user with admin credentials4.8 Medium
- f5 big-ip access policy manager, big-ip advanced firewall manager, big-ip analytics +10 more +12 moreOn versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, BIG-IP Virtual Edition (VE)...9.1 Critical
- canonical pulseaudio, ubuntu linux +1 moreUbuntu modifications to pulseaudio to provide snap security enforcement could be unloaded3.3 Low
- google chrome, debian linux, fedoraproject fedora +2 more +4 moreInappropriate implementation in cache in Google Chrome prior to 81.0.4044.92 allowed a remote...4.3 Medium
- cross domain local storage project domain local storagexdlocalstorage does not verify request origin8.8 High
- pulsesecure pulse connect secure, pulse policy secure +1 moreAn issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet...8.8 High
- apple ios, ipados, tvos +2 more +4 moreThis issue was addressed with a new entitlement. This issue is fixed in iOS 13.4 and iPadOS 13.4,...5.5 Medium
- apple ios, ipad os, iphone os +2 moreThe issue was addressed with improved deletion. This issue is fixed in iOS 13.4 and iPadOS 13.4....5.3 Medium
- avast antivirusAn issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx...9.8 Critical
- joomla joomla\!An issue was discovered in Joomla! before 3.9.16. Various actions in com_templates lack the...7.5 High
- palo alto networks pan-osPAN-OS: Predictable temporary filename vulnerability allows local privilege escalation7.0 High
- red hat ansible, debian linux, fedoraproject fedora +3 more +5 moreAnsible vulnerable to Exposure of Resource to Wrong Sphere and Insecure Temporary File5.0 Medium
- wago e!cockpit, e\!cockpit +1 moreAn exploitable improper input validation vulnerability exists in the firmware update...7.8 High
- citrix gateway firmwareCitrix Gateway 11.1, 12.0, and 12.1 allows Information Exposure Through Caching.5.3 Medium
- sideralis valib.jsExposure of Resource to Wrong Sphere in valib7.5 High
- totaljs total.js cmscontrollers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a...7.5 High
- taffydb taffyTaffyDB can allow access to any data items in the DB7.5 High
- squid-cache squid, canonical ubuntu linux, debian linux +2 more +4 moreAn issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret...7.5 High
- hackerone nextcloud server, nextcloud server +1 moreA bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by...8.1 High
- jetbrains youtrackIn JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups.5.3 Medium
- ibm security secret serverIBM Security Secret Server 10.7 could allow an attacker to obtain sensitive information due to an...3.1 Low
- red hat ansible, redhat ansible engine, fedoraproject fedora +6 more +8 moreExternally Controlled Reference to a Resource in Another Sphere, Improper Input Validation, and External Control of File Name or Path in Ansible7.3 High
- schema-inspectorValidation Bypass in schema-inspector9.8 Critical
- suse caas platform, caas platform 3.0 +1 moreInsecure API port exposed to all Master Node guest containers8.4 High
- kind-of project kind-ofValidation Bypass in kind-of7.5 High
- apache openoffice, libreoffice, debian linux +1 more +3 moreLibreOffice and OpenOffice automatically open embedded content6.5 Medium
- apple ios, ipados, iphone os +2 moreA logic issue applied the incorrect restrictions. This issue was addressed by updating the logic...10.0 Critical
- pen project pen, debian linux, opensuse +2 morePen 0.18.0 has Insecure Temporary File Creation vulnerabilities4.4 Medium
- siemens ag desigo px automation controllers pxc00-e.d, pxc50-e.d, pxc100-e.d, pxc200-e.d with desigo px web modules pxa40-w0, pxa40-w1, pxa40-w2, desigo px automation controllers pxc00-u, pxc64-u, pxc128-u with desigo px web modules pxa30-w0, pxa30-w1, pxa30-w2, desigo px automation controllers pxc22.1-e.d, pxc36-e.d, pxc36.1-e.d with activated web server +16 more +18 moreA vulnerability has been identified in Desigo PX automation controllers PXC00-E.D, PXC50-E.D,...5.3 Medium
- monkeyMonkey HTTP Daemon has local security bypass7.1 High
- openshift haproxy cartridge haproxy cartridge, redhat openshift +1 moreOpenShift haproxy cartridge: predictable /tmp in set-proxy connection hook which could facilitate...5.5 Medium
- kaspersky secure connection, kaspersky internet security, kaspersky total security, kaspersky security cloud, internet security, secure connection +2 more +4 moreKaspersky Secure Connection, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky...6.7 Medium
- titanhq webtitanAn issue was discovered in TitanHQ WebTitan before 5.18. The proxy service (which is typically...9.8 Critical
- pega platformPEGA Platform 8.3.0 is vulnerable to a direct prweb/sso/random_token/!STANDARD?pyActivity=Data...8.1 High
- alcatelmobile cingular flip 2 firmwareOn TCL Alcatel Cingular Flip 2 B9HUAH1 devices, PIN authentication can be bypassed by creating a...6.8 Medium
- jenkins jira, jenkins project jira plugin +1 moreJenkins JIRA Plugin allows users to select and use credentials with System scope9.9 Critical
- openshiftOpenShift: Install script has temporary file creation vulnerability which can result in arbitrary...7.8 High
- tecno-mobile tecno\/h622\/tecno-id5b\The Tecno Camon Android device with a build fingerprint of TECNO/H622/TECNO-ID5b:8.1.0/O11019/G...7.8 High
- tecno-mobile tecno\/h612\/tecno-id5a\The Tecno Camon Android device with a build fingerprint of TECNO/H612/TECNO-ID5a:8.1.0/O11019/F...7.8 High
- tecno-mobile camon iclick 2 firmwareThe Tecno Camon iClick 2 Android device with a build fingerprint of TECNO/H622/TECNO-ID6:8.1.0...7.8 High
- tecno-mobile camon iclick firmwareThe Tecno Camon iClick Android device with a build fingerprint of TECNO/H633/TECNO-IN6:8.1.0...7.8 High
- tecno-mobile camon iair 2\+ firmwareThe Tecno Camon iAir 2 Plus Android device with a build fingerprint of TECNO/H622/TECNO-ID3k:8.1...7.8 High
- netease pomeloPomelo allows external control of critical state data5.3 Medium
- gri project gri, debian linux +1 moregri before 2.12.18 generates temporary files in an insecure way.9.8 Critical
- mandriva mondoMondo 2.24 has insecure handling of temporary files.9.1 Critical
- redhat rhq mongo db drift server, rhq mongo db drift server mongo db drift server, redhat jboss operations network +2 moreAn insecurity temporary file vulnerability exists in RHQ Mongo DB Drift Server through 2013-09-25...7.1 High
- [unknown] vdsm, redhat enterprise virtualization, storage +1 more +3 moreInsecure temporary file vulnerability in RedHat vsdm 4.9.6.5.5 Medium
- mutt, debian linux +1 moreMutt before 1.5.20 patch 7 allows an attacker to cause a denial of service via a series of...5.5 Medium
- python-docutils project python-docutils, debian linux +1 morepython-docutils allows insecure usage of temporary files9.1 Critical
- Show moreLoading…