CWE-668: Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- google androidIn getEndItemSliceAction of MediaOutputSlice.java, there is a possible permission bypass due to...5.5 Medium
- google androidIn updateNotification of BeamTransferManager.java, there is a missing permission check. This...5.5 Medium
- vmware spring framework, netapp hci, management services for element software +29 more +31 moreImproper Privilege Management in Spring Framework7.8 High
- linux kernelMounting /proc filesystem via chroot command silently mounts it in read-write mode. The user...5.5 Medium
- pleaseedit project pleaseeditPermissions bypass in pleaser7.8 High
- please project pleaseFile exposure in pleaser3.3 Low
- versa-networks versa operating systemIn VOS and overly permissive "umask" may allow for authorized users of the server to gain...8.8 High
- haxx curl, netapp cloud backup, h300e firmware +22 more +24 morecurl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a...5.3 Medium
- codesys v2 web server, wago 750-8202 firmware, 750-8203 firmware +25 more +27 moreCODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control.9.8 Critical
- weidmueller iot-gw30-4g-eu firmware, iot-gw30 firmware, uc20-wl2000-ac firmware +5 more +7 moreWEIDMUELLER: Accidentally open network port in u-controls and IoT-Gateways9.4 Critical
- jetbrains teamcityInformation disclosure in the TeamCity plugin for IntelliJ before 2020.2.2.85899 was possible...3.3 Low
- openapi-generator openapi generator, openapitools openapi-generator +1 moreCreation of Temporary File in Directory with Insecure Permissions in auto-generated Java, Scala code6.2 Medium
- openapi-generator openapi generator, openapitools openapi-generator +1 moreCreation of Temporary File in Directory with Insecure Permissions in the OpenAPI-Generator online generator9.3 Critical
- cisco wide area application services (waas), wide area application services +1 moreCisco Wide Area Application Services Software Information Disclosure Vulnerability5.5 Medium
- eximExim 4 before 4.94.2 allows Exposure of File Descriptor to Unintended Control Sphere because...7.8 High
- google androidIn createPendingIntent of SnoozeHelper.java, there is a possible broadcast intent containing a...5.5 Medium
- google androidIn startIpClient of ClientModeImpl.java, there is a possible identifier which could be used to...7.5 High
- google chrome, debian linux, fedoraproject fedora +2 moreInappropriate implementation in Network in Google Chrome prior to 90.0.4430.72 allowed a remote...6.5 Medium
- codegearthemes designerProject sources exposure in Vaadin Designer8.6 High
- juniper paragon active assurance control center, juniper networks paragon active assurance, fedoraproject fedora +2 moreParagon Active Assurance: Authentication bypass vulnerability in Control Center7.4 High
- eclipse jersey, the eclipse foundation eclipse jersey, oracle communications cloud native core policy +1 more +3 moreLocal information disclosure via system temporary directory6.2 Medium
- mediawikiAn issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. Its...4.3 Medium
- mediawikiAn issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. A MediaWiki...6.5 Medium
- mediawikiAn issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It incorrectly...5.4 Medium
- mediawikiAn issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It improperly...5.4 Medium
- flow flow-server, vaadin flow, vaadin +2 morePotential sensitive data exposure in applications using Vaadin 153.1 Low
- flow flow-server, vaadin flow, vaadin +2 moreServer classes and resources exposure in OSGi applications using Vaadin 12-14 and 198.6 High
- mozilla firefoxA compromised content process could have performed session history manipulations it should not...4.3 Medium
- google bazel, google llc vscode-bazel +1 moreCode execution in VSCode-bazel via malicious Bazel config files8.2 High
- github.com/robbert229/jwt, json web token project web token +1 moreTiming side-channel in github.com/robbert229/jwt7.5 High
shopware/corePackagist,shopware/platformPackagist +1 moreAfter order payment process manipulation in shopware/platform and shopware/coreNo scoreshopware/corePackagist,shopware/platformPackagist +1 moreLeak of information via Store-API aggregations in shopware/platform and shopware/coreNo score- google android, samsung mobile devices +1 moreA pendingIntent hijacking vulnerability in Secure Folder prior to SMR APR-2021 Release 1 allows...4.0 Medium
- google android, samsung mobile devices +1 moreA pendingIntent hijacking vulnerability in Create Movie prior to SMR APR-2021 Release 1 in...5.6 Medium
- facebook whatsapp business for android, whatsapp for android, whatsapp +1 more +3 moreA cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for...7.5 High
- apache druidApache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems.8.8 High
- red hat resteasy, netapp oncommand insight, oracle communications cloud native core console +1 more +3 moreExposure of class information in RESTEasy5.3 Medium
- invigo automatic device managementMultiple session validity check issues in several administration functionalities of Invigo...7.5 High
- samsung bixby voiceUsing PendingIntent with implicit intent in Bixby Voice prior to version 3.0.52.14 allows...5.5 Medium
- mozilla firefoxIf an attacker is able to alter specific about:config values (for example malware running on the...6.5 Medium
- cisco aironet access point software, catalyst 9800 firmware, wireless lan controller software +2 moreCisco Aironet Access Points Arbitrary File Overwrite Vulnerability4.4 Medium
- suse hawk2, linux enterprise high availability 12-sp3, linux enterprise high availability 12-sp5 +1 more +3 morehawk: Insecure file permissions7.8 High
- containerd, fedoraproject fedora +1 moreenvironment variable leak6.3 Medium
- joomla joomla\!, joomla! project cms +1 more[20210307] - Core - ACL violation within com_content frontend editing5.3 Medium
- owncloud serverownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim,...6.8 Medium
- mutare voiceAn issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. getfile.asp allows...9.8 Critical
- netty, debian linux, netapp active iq unified manager +10 more +12 moreLocal Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files6.2 Medium
- netgear r7450, ac2100 firmware, ac2400 firmware +17 more +19 moreThis vulnerability allows network-adjacent attackers to bypass authentication on affected...8.8 High
- keycloakIncorrect Authorization in keycloak5.4 Medium
- electronElectron vulnerable to ID collision when routing IPC messages to renderers containing OOPIFs5.4 Medium
- Show moreLoading…