CWE-668: Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- d-link dir-868lw firmwareSeveral web interfaces in D-Link DIR-868LW 1.12b have no authentication requirements for access,...5.3 Medium
- apple ipados, ios and ipados, iphone os +2 moreThe issue was addressed with improved permissions logic. This issue is fixed in iOS 15 and iPadOS...2.4 Low
- vmware spring data restExposure of Resource to Wrong Sphere in Spring Data REST5.3 Medium
- vmware spring cloud openfeignExposure of Resource to Wrong Sphere in Spring Cloud OpenFeign7.5 High
- huawei harmonyosA component of the HarmonyOS has a External Control of System or Configuration Setting...5.5 Medium
- huawei harmonyosA component of the HarmonyOS has a Exposure of Sensitive Information to an Unauthorized Actor...3.3 Low
- huawei emui, magic ui +1 moreThere is an Unauthorized file access vulnerability in Huawei Smartphone.Successful exploitation...7.5 High
- cisco firepower threat defense software, firepower management center virtual appliance, secure firewall threat defense +1 more +3 moreCisco Firepower Threat Defense Software CLI Arbitrary File Write Vulnerability4.4 Medium
- gradle enterpriseIn Gradle Enterprise through 2021.3, probing of the server-side network environment can occur via...5.3 Medium
- anaconda daskWorkers for local Dask clusters mistakenly listened on public interfaces9.8 Critical
- emerson wirelesshart gateway, wireless 1410 gateway firmware, wireless 1410d gateway firmware +1 more +3 moreEmerson WirelessHART Gateway8.0 High
- vmware vrealize operations tenantReleases prior to VMware vRealize Operations Tenant App 8.6 contain an Information Disclosure...7.5 High
- ibm flashsystem 900, flashsystem 9100 family, flashsystem v9000 +17 more +19 moreIBM Flash System 900 could allow an authenticated attacker to obtain sensitive information and...8.8 High
- alfresco content servicesAn issue was discovered in Hyland org.alfresco:alfresco-content-services through 7.0.1.2. Script...8.8 High
- atlassian jira, jira server, jira data center +1 more +3 moreAffected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to...5.3 Medium
- qualcomm, inc. snapdragon auto, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking, qualcomm apq8009 firmware, apq8053 firmware +89 more +91 moreAccepting AMSDU frames with mismatched destination and source address can lead to information...8.6 High
- discourse discourse-reactions, reactions +1 moreReactions leak for secure category topics and private messages5.3 Medium
- netapp clustered data ontapClustered Data ONTAP versions 9.x prior to 9.5P18, 9.6P16, 9.7P16, 9.8P7 and 9.9.1P2 are...5.5 Medium
- apple ipados, ios and ipados, iphone os +2 moreA lock screen issue allowed access to contacts on a locked device. This issue was addressed with...2.4 Low
- apple macos, mac os x +1 moreThis issue was addressed with improved checks. This issue is fixed in Security Update 2021-005...5.5 Medium
- apple macos, tvos, mac os x +2 moreAn access issue was addressed with improved access restrictions. This issue is fixed in Security...5.5 Medium
- abomonation project abomonationAbomonation transmutes &T to and from &[u8] without sufficient constraints7.5 High
- draytek vigorconnectA local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download...7.5 High
- draytek vigorconnectA local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download...7.5 High
- inbody, inbody japan inc. app for ios versions prior to 2.3.30 and inbody app for android versions prior to 2.2.90(510) +1 moreInBody App for iOS versions prior to 2.3.30 and InBody App for Android versions prior to 2.2.90...5.3 Medium
- electronSandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API6.8 Medium
- arubanetworks aruba instant, siemens scalance w1750d firmware +1 moreA remote unauthorized read access to files vulnerability was discovered in Aruba Instant version...6.5 Medium
- sap netweaver abap, netweaver application server abap, sap se netweaver as abap and abap platform +2 moreSAP Internet Communication framework (ICM) - versions 700, 701, 702, 730, 731, 740, 750, 751, 752...4.3 Medium
- sap businessobjects analysis, sap se businessobjects analysis, (edition for olap) +1 moreSAP BusinessObjects Analysis (edition for OLAP) - versions 420, 430, allows an attacker to...5.3 Medium
- wuzhicmsArbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via coreframe\app...7.5 High
- google chrome, debian linux, fedoraproject fedora +2 moreInappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54...4.3 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreInappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54...4.3 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreInappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54...4.3 Medium
- zammadAn issue was discovered in Zammad before 4.1.1. An admin can discover the application secret via...4.9 Medium
- waimai super cms project super cmswaimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form...7.5 High
- gitlabA business logic error in the project deletion process in GitLab 13.6 and later allows persistent...5.4 Medium
- gitlabIn all versions of GitLab EE since version 8.13, an endpoint discloses names of private groups...4.3 Medium
- wire, wireapp wire-ios +1 moreMandatory encryption at rest can be bypassed (UI) in Wire app4.2 Medium
- gitlabInformation disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL...2.0 Low
- 3xlogic infinias access controlAn issue was discovered in 3xLogic Infinias Access Control through 6.7.10708.0, affecting...8.8 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, qualcomm aqt1000 firmware, ar8031 firmware +60 more +62 moreImproper validation of kernel buffer address while copying information back to user buffer can...6.2 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, qualcomm aqt1000 firmware, ar8031 firmware +60 more +62 moreImproper validation of kernel buffer address while copying information back to user buffer can...6.2 Medium
- datalust seqDatalust Seq before 2021.2.6259 allows users (with view filters applied to their accounts) to see...6.5 Medium
- github enterprise serverImproper access control in GitHub Enterprise Server allows self-hosted runners to execute outside their control group9.8 Critical
- apache druidApache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-26920)6.5 Medium
- elv elvishRemote code execution via the web UI backend of Elvish8.0 High
- vmware vcenter server, cloud foundation +1 moreThe vCenter Server contains an information disclosure vulnerability due to an unauthenticated...7.5 High
- vmware vcenter server, cloud foundation +1 moreThe vCenter Server contains multiple denial-of-service vulnerabilities in VAPI (vCenter API)...7.5 High
- vmware vcenter server, cloud foundation +1 moreThe vCenter Server contains an information disclosure vulnerability in VAPI (vCenter API) service...7.5 High
- vmware vcenter server, cloud foundation +1 moreThe vCenter Server contains a local information disclosure vulnerability in the Analytics service...5.5 Medium
- Show moreLoading…