CWE-668: Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- mozilla firefoxThe browser could have been confused into transferring a screen sharing state into another tab,...6.5 Medium
- webank federated ai technology enablerAn issue was discovered in function sync_tree in hetero_decision_tree_guest.py in WeBank FATE ...7.5 High
- dell cpg bios, inspiron 5675 firmware +1 moreDell Inspiron 5675 BIOS versions prior to 1.4.1 contain a UEFI BIOS RuntimeServices overwrite...6.8 Medium
- 1e clientThe MSI installer in 1E Client 4.1.0.267 and 5.0.0.745 allows remote authenticated users and...8.8 High
- odoo, odoo community, enterprise +2 moreImproper access control in mail module (followers) in Odoo Community 13.0 and earlier and Odoo...6.5 Medium
- odoo, odoo community, enterprise +2 moreImproper access control in mail module (notifications) in Odoo Community 14.0 and earlier and...6.5 Medium
- xen, debian linux, fedoraproject fedora +2 moreAn issue was discovered in Xen through 4.14.x. Access rights of Xenstore nodes are per domid....8.8 High
- jupyterhub systemdspawneruser-readable api tokens in systemd units7.9 High
- totolink a850r-v1 firmware, f1-v2 firmware, f2-v1 firmware +5 more +7 moreAn issue was discovered on TOTOLINK A850R-V1 through 1.0.1-B20150707.1612 and F1-V2 through 1.1...7.5 High
- apple ipados, macos, tvos +3 more +5 moreA memory initialization issue was addressed with improved memory handling. This issue is fixed in...6.5 Medium
- debian linux, fedoraproject fedora, intel microcode +14 more +16 moreImproper isolation of shared resources in some Intel(R) Processors may allow an authenticated...5.5 Medium
- cisco telepresence collaboration endpoint, telepresence endpoint software (tc/ce) +1 moreCisco TelePresence Collaboration Endpoint Software Information Disclosure Vulnerability4.3 Medium
- cisco edge fog fabricCisco Edge Fog Fabric Resource Exposure Vulnerability6.5 Medium
- winstonprivacy winston firmwareWinston 1.5.4 devices have a CORS configuration that trusts arbitrary origins. This allows...9.1 Critical
- atomx atomxcmsAtomXCMS 2.0 is affected by Arbitrary File Read via admin/dump.php5.3 Medium
- bigbluebuttonIn BigBlueButton before 2.2.7, lockSettingsProps.disablePrivateChat does not apply to already...3.5 Low
- chocolatey boxstarterPrivilege Escalation in Boxstarter8.0 High
- arc informatique pcvueARC Informatique PcVue Access to Critical Private Variable via Public Method7.5 High
- google androidAn issue was discovered in EthernetNetwork on Samsung mobile devices with O(8.1), P(9.0), Q(10.0)...7.5 High
- gitlabAn issue has been discovered in GitLab affecting all versions starting from 11.2. Unauthorized...7.5 High
- electronContext isolation bypass in Electron5.6 Medium
- cloud foundry bosh system metrics serverUAA password may appear in BOSH System Metrics Server process arguments6.5 Medium
- philips clinical collaboration platformPhilips Clinical Collaboration Platform Configuration6.8 Medium
- sylabs singularity, opensuse leap +1 moreInsecure permissions on build temporary rootfs in Singularity8.8 High
- sylabs singularity, opensuse leap +1 moreInsecure permissions on user namespace / fakeroot temporary rootfs in Singularity8.1 High
- drupal core, drupal +1 moreExposure of Resource to Wrong Sphere in Drupal Core7.5 High
- philips patient information center ix (picix), patient information center ix +1 morePhilips Patient Monitoring Devices Exposure of Resource to Wrong Sphere6.8 Medium
- dell elastic cloud storage, emc elastic cloud storage +1 moreDell EMC ECS, versions prior to 3.5, contains an Exposure of Resource vulnerability. A remote...8.1 High
- debian freedomboxFreedomBox through 20.13 allows remote attackers to obtain sensitive information from the /server...5.3 Medium
- apache cassandra, netapp oncommand insight +1 moreMan-in-the-middle attack in Apache Cassandra5.9 Medium
- gigadevice gd32f103 firmwareThe flash memory readout protection in Gigadevice GD32F103 devices allows physical attackers to...4.6 Medium
- gigadevice gd32f103 firmware, gd32f130 firmware +1 moreGigadevice GD32F103 and GD32F130 devices allow physical attackers to extract data via the probing...4.6 Medium
- gigadevice gd32vf103 firmwareThe flash memory readout protection in Gigadevice GD32VF103 devices allows physical attackers to...4.6 Medium
- ibm security key lifecycle managerIBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses a protection mechanism that relies on the...6.5 Medium
- librenmsExposure of Resource to Wrong Sphere in LibreNMS8.8 High
- westerndigital wd discoveryIn Western Digital WD Discovery before 4.0.251.0, a malicious application running with standard...8.8 High
- icewarp mail serverIceWarp Email Server 12.3.0.1 has Incorrect Access Control for user accounts.6.5 Medium
- canonical snapd, ubuntu linux +1 moreSandbox escape vulnerability via snapctl user-open (xdg-open)5.9 Medium
- baxter em1200 firmware, em2400 firmware +1 moreBaxter ExactaMix EM 2400 Versions 1.10, 1.11, and 1.13 and ExactaMix EM1200 Versions 1.1, 1.2,...6.1 Medium
- mobile industrial robots a/s mir100, aliasrobotics mir1000 firmware, mir100 firmware +8 more +10 moreRVD#2555: MiR ROS computational graph is exposed to all network interfaces, including poorly secured wireless networks and open wired ones10.0 Critical
- mattermost packagesAn issue was discovered in Mattermost Packages before 5.16.3. A Droplet could allow Internet...9.8 Critical
- plex media server, plex, inc. plex media server +1 moreImproper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute...8.8 High
- fortinet forticlient, forticlient for windows +1 moreAn Insecure Temporary File vulnerability in FortiClient for Windows 6.2.1 and below may allow a...6.3 Medium
- bosch recording station, recording station firmware +1 moreKiosk Mode Breakout in Bosch Recording Station9.3 Critical
- google chrome, debian linux, fedoraproject fedora +2 more +4 moreInsufficient data validation in loader in Google Chrome prior to 83.0.4103.61 allowed a remote...4.3 Medium
- dolibarr erp\/crmDolibarr Stored Cross-site Scripting5.4 Medium
- red hat ansible, redhat ansible tower +1 moreExposure of Resource to Wrong Sphere and Insecure Temporary File in Ansible5.0 Medium
- apache ant, canonical ubuntu linux, fedoraproject fedora +47 more +49 moreSensitive Data Exposure in Apache Ant6.3 Medium
- red hat ansible, redhat ansible engine, ansible tower +4 more +6 moreExposure of Resource to Wrong Sphere and Insecure Temporary File in Ansible5.0 Medium
- serpico project serpicoAn issue was discovered in Serpico before 1.3.3. The /admin/attacments_backup endpoint can be...6.5 Medium
- Show moreLoading…