CWE-668: Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- huawei harmonyosA component of the HarmonyOS has a External Control of System or Configuration Setting...7.8 High
- huawei emui, magic ui +1 moreThere is an Information Disclosure Vulnerability in Huawei Smartphone.Successful exploitation of...7.5 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, qualcomm apq8009 firmware, apq8009w firmware +173 more +175 moreChild process can leak information from parent process due to numeric pids are getting compared...6.2 Medium
- prosodymuc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive...7.5 High
- discoursePost creator of a whisper post can be revealed to non-staff users in Discourse4.3 Medium
- elastic elasticsearchAll versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by...7.5 High
- containerd, fedoraproject fedora +1 moreArchive package allows chmod of file outside of unpack target directory5.0 Medium
- ibm security verify access docker, security verify access +1 moreIBM Security Verify Access Docker 10.0.0 could reveal highly sensitive information to a local...4.4 Medium
- solarwinds serv-u, serv-u managed file transfer server and serv-u secured ftp +1 moreServ-U Remote Memory Escape Vulnerability9.0 Critical
- sap netweaver abap, netweaver application server abap, sap se netweaver as abap and abap platform +2 moreSAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 702, 730, 731, 804, 740, 750, 784,...6.5 Medium
- ruby-lang ruby, debian linux, oracle jd edwards enterpriseone tools +2 moreAn issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A...5.8 Medium
- pbootcmsIncorrect Access Control vulnerability in PbootCMS 2.0.6 via the list parameter in the update...6.5 Medium
- samsung membersInformation exposure vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8...3.3 Low
- ibm guardium data encryptionIBM Guardium Data Encryption (GDE) 3.0.0.3 and 4.0.0.4 could allow a remote attacker to obtain...3.7 Low
- mediawiki, debian linux, fedoraproject fedora +2 moreIn MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots...7.5 High
- xwiki, xwiki xwiki-platform +1 moreThe reset password form reveal users email address5.3 Medium
- akkadianlabs akkadian provisioning managerAn issue exists within Akkadian Provisioning Manager 4.50.02 which allows attackers to view...7.5 High
- google androidIn processInboundMessage of MceStateMachine.java, there is a possible SMS disclosure due to a...5.5 Medium
- artica pandora fmsIn Artica Pandora FMS <=754 in the File Manager component, there is sensitive information exposed...5.9 Medium
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 10.0 and 11.1 is susceptible to a weakness in the implementation of the...4.3 Medium
- google tensorflow** DISPUTED ** TensorFlow through 2.5.0 allows attackers to overwrite arbitrary files via a...9.1 Critical
- istioIstio before 1.9.6 and 1.10.x before 1.10.2 has Incorrect Access Control.8.8 High
- zammadIncorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive...7.5 High
- zammadIncorrect Access Control in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive...5.3 Medium
- zammadIncorrect Access Control for linked Tickets in Zammad 1.0.x up to 4.0.0 allows remote attackers...5.3 Medium
- adobe premiere, premiere elements +1 moreAdobe Premiere Elements Privilege Escalation Vulnerability6.2 Medium
- adobe photoshop elementsAdobe Photoshop Elements Privilege Escalation Vulnerability - symbolic link6.2 Medium
- nvidia geforce experience, geforce experience software +1 moreNVIDIA GeForce Experience, all versions prior to 3.23, contains a vulnerability where, if a user...8.3 High
- autodesk advance steel, autocad, autocad architecture +8 more +10 moreAn Arbitrary Address Write issue in the Autodesk DWG application can allow a malicious user to...7.8 High
- mozilla firefox, firefox for ios +1 moreWhen a download was initiated, the client did not check whether it was in normal or private...4.3 Medium
- flow flow-server, vaadin flow, vaadin +2 morePossible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-195.3 Medium
- hewlett packard enterprise hpe oneview global dashboard, hpe oneview global dashboard +1 moreA potential vulnerability has been identified in HPE OneView Global Dashboard release 2.31 which...5.5 Medium
- avaya aura appliance virtualization platform, aura appliance virtualization platform utilities +1 moreAvaya Aura Appliance Virtualization Platform Utilities Sensitive Information Disclosure Vulnerability4.9 Medium
- 5none nonecmsInformation Disclosure in NoneCMS v1.3 allows remote attackers to obtain sensitive information...7.5 High
- 5none nonecmsInformation Disclosure in NoneCMS v1.3 allows remote attackers to obtain sensitive information...7.5 High
- automattic jetpack, jetpack – wp security, backup, speed, & growth +1 moreJetpack < 9.8 - Carousel Module Non-Published Page/Post Attachment Comment Leak5.3 Medium
- ibm security identity managerIBM Security Identity Manager 6.0.2 could allow an authenticated malicious user to change the...7.5 High
- wire restundUnsafe loopback forwarding interface in Restund8.6 High
- google androidIn /proc/net of the kernel filesystem, there is a possible information leak due to a permissions...5.5 Medium
- cubecoders ampAn issue was discovered in CubeCoders AMP before 2.1.1.8. A lack of validation of the Java...7.2 High
- sap mobile sdk certificate providerUnder certain conditions, SAP Mobile SDK Certificate Provider allows a local unprivileged attacker to exploit an insecure temporary file storage. For a successful exploitation user interaction from an…7.8 High
- sap enable now, sap se enable now (sap workforce performance builder - manager) +1 moreUnder certain conditions SAP Enable Now (SAP Workforce Performance Builder - Manager), versions -...5.9 Medium
- sap netweaver application server for java, sap se netweaver as for java (useradmin) +1 moreInformation Disclosure vulnerability in UserAdmin application in SAP NetWeaver Application Server...5.5 Medium
- amd all supported processors, arm cortex-a72, broadcom bcm2711 +6 more +8 moreAMD Speculative execution with Floating-Point Value Injection5.5 Medium
- amd all supported processors, arm cortex-a72, broadcom bcm2711 +6 more +8 moreAMD Speculative Code Store Bypass5.5 Medium
- gitlabAn information disclosure vulnerability in GitLab EE versions 13.11 and later allowed a project...7.5 High
- google asyloEnclave memory overwrite/overread vulnerability in Asylo UntrustedCacheMalloc::GetBuffer6.5 Medium
- google asyloArbitrary enclave memory overwrite vulnerability in Asylo TrustedPrimitives::UntrustedCall6.5 Medium
- debian linux, intel microcode, netapp fas\/aff bios +2 more +4 moreImproper isolation of shared resources in some Intel(R) Processors may allow an authenticated...6.5 Medium
- calipso project calipsoArbitrary File Write via Archive Extraction (Zip Slip)7.3 High
- Show moreLoading…