CWE-668: Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- cisco ios xe, ios xe software +1 moreCisco IOS XE SD-WAN Software Arbitrary File Overwrite Vulnerability6.7 Medium
- line corporation client for ios, linecorp line +1 moreLINE client for iOS before 11.15.0 might expose authentication information for a certain service...7.5 High
- google chrome, fedoraproject fedora +1 moreInappropriate implementation in Blink in Google Chrome prior to 93.0.4577.82 allowed a remote...4.3 Medium
- jscom revoworks browserImproper control of program execution vulnerability in RevoWorks Browser 2.1.230 and earlier...9.6 Critical
- mi xiaomiSome js interfaces in the Xiaomi community were exposed, causing sensitive functions to be...5.3 Medium
- jflyfox jfinal cmsImproper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via ...7.5 High
- hashicorp terraform enterpriseHashiCorp Terraform Enterprise up to v202108-1 contained an API endpoint that erroneously...8.8 High
- jflyfox jfinal cmsImproper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain...8.8 High
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +9 more +11 moreOn BIG-IP version 16.x before 16.1.0 and 15.1.x before 15.1.3.1, when a DNS profile using a DNS...7.5 High
- canonical apportApport file permission bypass through emacs byte compilation errors6.5 Medium
- imagemagickIssue when Configuring the ImageMagick Security Policy4.4 Medium
- adobe genuine service, gocart +1 moreAdobe Genuine Services insecure file permission could lead to privilege escalation5.8 Medium
- apple macos, mac os x +1 moreThis issue was addressed with improved entitlements. This issue is fixed in macOS Big Sur 11.3,...4.4 Medium
- apple ipados, watchos, ios and ipados +1 more +3 moreA validation issue was addressed with improved input sanitization. This issue is fixed in iOS 14...5.5 Medium
- apple ipados, tvos, watchos +2 more +4 moreA logic issue was addressed with improved restrictions. This issue is fixed in iOS 14.5 and...5.5 Medium
- apple ipados, ios and ipados, iphone os +2 moreAn access issue was addressed with improved memory management. This issue is fixed in iOS 14.5...5.5 Medium
- apple macosAn issue existed in determining cache occupancy. The issue was addressed through improved logic....4.3 Medium
- apple ipados, macos, ios and ipados +2 more +4 moreThis issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.4,...5.5 Medium
- apple macos, mac os x +1 moreAn access issue was addressed with improved access restrictions. This issue is fixed in macOS Big...5.5 Medium
- apple ios, macos, watchos +1 more +3 moreA logic issue was addressed with improved state management. This issue is fixed in iOS 14.7,...7.5 High
- apple macosA permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur...3.3 Low
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon wearables, qualcomm apq8096au firmware, aqt1000 firmware +91 more +93 moreLack of strict validation of bootmode can lead to information disclosure in Snapdragon Auto,...6.2 Medium
- saltstack salt, debian linux, fedoraproject fedora +2 moreExposure of Resource to Wrong Sphere in salt7.5 High
- fedoraproject fedora, microsoft edge, edge chromium +1 more +3 moreInappropriate implementation in Navigation in Google Chrome prior to 93.0.4577.63 allowed a...6.5 Medium
- microfocus access managerThis release addresses a potential information leakage vulnerability in NetIQ Access Manager...5.5 Medium
- eclipse theia, the eclipse foundation eclipse theia +1 moreRemote code execution in Eclipse Theia8.8 High
- adobe captivateAdobe Captivate Installer Creation of Temporary File In Directory With Incorrect Permissions Could Lead To Privilege Escalation5.0 Medium
- solarwinds orion platformExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability6.0 Medium
- ibm api connectIBM API Connect 5.0.0.0 through 5.0.8.11 could alllow a remote user to obtain sensitive...6.5 Medium
- podofo project podofoExposure of Sensitive Information to an Unauthorized Actor in PoDoFo v0.9.6 allows attackers to...5.5 Medium
- primekey ejbcaAn issue was discovered in PrimeKey EJBCA before 7.6.0. As part of the configuration of the...2.2 Low
- apple ipados, ios and ipados, iphone os +2 moreA logic issue was addressed with improved state management. This issue is fixed in iOS 14.5 and iPadOS 14.5. A user's password may be visible onscreen.5.5 Medium
- adobe creative cloud desktop application, creative cloud (desktop component) +1 moreAdobe Creative Cloud Installer Arbitrary File Write6.1 Medium
- gitlabA confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7...6.5 Medium
- arm mbed tls, debian linux +1 moreAn issue was discovered in Mbed TLS before 2.24.0 (and before 2.16.8 LTS and before 2.7.17 LTS)....7.5 High
- tp-link tl-wr840n firmwareIn TP-Link Wireless N Router WR840N an ARP poisoning attack can cause buffer overflow6.4 Medium
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreOperational restrictions bypass vulnerability in Portal of Cybozu Garoon 4.0.0 to 5.0.2 allows a...4.3 Medium
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreViewing restrictions bypass vulnerability in Address of Cybozu Garoon 4.0.0 to 5.0.2 allows a...4.3 Medium
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreViewing restrictions bypass vulnerability in Portal of Cybozu Garoon 4.0.0 to 5.0.2 allows a...4.3 Medium
- onenavOneNav 0.9.12 allows Information Disclosure of the onenav.db3 contents. NOTE: the vendor's...7.5 High
- netsarang xshellNetSarang Xshell 7 before Build 0077 includes unintended code strings in paste operations.5.3 Medium
- routes project routesCSRF token exposure in TYPO3 extension7.5 High
- dcce mac1100 plc firmwareAn information disclosure vulnerability exists within Dut Computer Control Engineering Co.'s PLC...7.5 High
- dated news project newsThe dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows Information Disclosure...5.3 Medium
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM 7.4.3 GA - 7.4.3 Fix Pack 1 when using domains or multi-tenancy could be...5.3 Medium
- phpfastcacheExposed phpinfo() in PhpFastCache5.4 Medium
- cpanelIn cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC...7.5 High
- huawei emui, magic ui +1 moreA component of the Huawei smartphone has a External Control of System or Configuration Setting...7.8 High
- popojicmsAn information disclosure vulnerability in upload.php of PopojiCMS 1.2 leads to physical path...5.3 Medium
- liferay portal, digital experience platform +1 moreExposure of Resource to Wrong Sphere in Liferay Portal4.3 Medium
- Show moreLoading…