CWE-668: Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- splashtopSplashtop Remote Client (Personal Edition) through 3.4.6.1 creates a Temporary File in a...7.8 High
- splashtopSplashtop Remote Client (Business Edition) through 3.4.8.3 creates a Temporary File in a...7.8 High
- splashtop streamerSplashtop Streamer through 3.4.8.3 creates a Temporary File in a Directory with Insecure...7.8 High
- helpsystems cobalt strikeCobaltStrike <=4.5 HTTP(S) listener does not determine whether the request URL begins with "/",...7.5 High
- libexpat project libexpat, debian linux, oracle http server +5 more +7 morexmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator...9.8 Critical
- emerson dixell xweb-500 firmware** UNSUPPORTED WHEN ASSIGNED ** Emerson Dixell XWEB-500 products are affected by arbitrary file...9.8 Critical
- emerson dixell xweb-500 firmware** UNSUPPORTED WHEN ASSIGNED ** Emerson Dixell XWEB-500 products are affected by information...7.5 High
- schneider-electric 140cpu65150 firmware, 140noc77101 firmware, 140noc78x00 firmware +11 more +13 moreA CWE-200: Information Exposure vulnerability exists that could cause sensitive information of...7.5 High
- linux kernelThe check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did...5.5 Medium
- git-scm gitThe --mirror documentation for Git through 2.35.1 does not mention the availability of deleted...7.5 High
- stormshield network securityIn Stormshield 1.1.0, and 2.1.0 through 2.9.0, an attacker can block a client from accessing the...6.1 Medium
- intel 82599eb firmware, 82599en firmware, 82599es firmware +2 moreImproper isolation of shared resources in network on chip for the Intel(R) 82599 Ethernet...5.5 Medium
- microsoft powerbi-client js sdkMicrosoft Power BI Information Disclosure Vulnerability4.9 Medium
- microsoft office, 365 apps, 365 apps for enterprise +5 more +7 moreMicrosoft Office Information Disclosure Vulnerability5.5 Medium
- microsoft excel, 365 apps, 365 apps for enterprise +13 more +15 moreMicrosoft Excel Information Disclosure Vulnerability5.5 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +28 more +30 moreWindows Common Log File System Driver Information Disclosure Vulnerability5.5 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +20 more +22 moreWindows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability7.5 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +28 more +30 moreWindows Remote Access Connection Manager Information Disclosure Vulnerability5.5 Medium
- cybelesoft thinfinity virtualuiThinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an...7.5 High
- dataeaseIn DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information...8.8 High
- google chromeInappropriate implementation in Paint in Google Chrome prior to 98.0.4758.80 allowed a remote...4.3 Medium
- google chromePolicy bypass in COOP in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to bypass...6.5 Medium
- google tensorflowInsecure temporary file in Tensorflow7.1 High
- microfocus voltage securemailA potential Information leakage vulnerability has been identified in versions of Micro Focus...6.5 Medium
- zammadIn Zammad 5.0.2, agents can configure "out of office" periods and substitute persons. If the...5.3 Medium
- google chromeInappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71...6.5 Medium
- printerlogic web stackPrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct...7.5 High
- printerlogic web stackPrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct...9.1 Critical
- nvidia omniverse launcherNVIDIA Omniverse Launcher contains a Cross-Origin Resource Sharing (CORS) vulnerability which can...9.3 Critical
- postgresql jdbc driver, debian linux, fedoraproject fedora +1 more +3 moreUnchecked Class Instantiation when providing Plugin Classes7.0 High
- nec univerge dt800 data maintenance tool, univerge dt820 firmware, univerge dt830 firmware +3 more +5 moreUNIVERGE DT 820 V3.2.7.0 and prior, UNIVERGE DT 830 V5.2.7.0 and prior, UNIVERGE DT 930 V2.4.0.0...5.3 Medium
- bplugins document embedderDocument Embedder < 1.7.9 - Subscriber+ Arbitrary Private/Draft Post Title Disclosure4.3 Medium
- bplugins document embedderDocument Embedder < 1.7.5 - Unauthenticated Arbitrary Private/Draft Post Title Disclosure5.3 Medium
- google androidIn clear_data_dlg_text of strings.xml, there is a possible situation when "Clear storage"...5.5 Medium
- adenza axiomsl controllerviewAdenza AxiomSL ControllerView through 10.8.1 is vulnerable to user enumeration. An attacker can...5.3 Medium
- zip-local project zip-localArbitrary File Write via Archive Extraction (Zip Slip)9.8 Critical
- moodleInsufficient user authorization in Moodle4.3 Medium
- saviynt enterprise identity cloudAn issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. An attacker can...5.3 Medium
- deltarm delta rmAn issue was discovered in Delta RM 1.2. It is possible for an unprivileged user to access the...4.3 Medium
- juniper junos, juniper networks junos os +1 moreJunos Fusion: A Satellite Device can be controlled by rewiring it to a foreign AD causing a DoS6.8 Medium
- deltarm delta rmAn issue was discovered in Delta RM 1.2. Using the /risque/risque/ajax-details endpoint, with a...4.3 Medium
- gitlabIn all versions of GitLab CE/EE since version 12.0, a lower privileged user can import users from...4.3 Medium
- cyberark endpoint privilege managerCyberArk Endpoint Privilege Manager (EPM) through 11.5.3.328 before 2021-12-20 allows a local...7.8 High
- sap se netweaver as for abap and abap platform, sap netweaver abap, netweaver application server abap +2 moreIn SAP NetWeaver AS for ABAP and ABAP Platform - versions 701, 702, 711, 730, 731, 740, 750, 751,...4.3 Medium
- google androidThe broadcast that DevicePickerFragment sends when a new device is paired doesn't have any...5.3 Medium
- google chrome, fedoraproject fedora +1 morePolicy bypass in Blink in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak...6.5 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon wearables, qualcomm qca6390 firmware, qca6391 firmware +72 more +74 moreLack of validation for third party application accessing the service can lead to information...6.2 Medium
- jenkins debian package builder, jenkins project debian package builder plugin +1 moreAgent-to-controller security bypass in Jenkins Debian Package Builder Plugin8.8 High
- jenkins ssh agent, jenkins project ssh agent plugin +1 moreMissing permission checks in SSH Agent Plugin allow enumerating credentials IDs4.3 Medium
- microsoft windows 10 version 1607, windows 10 +1 moreRemote Desktop Licensing Diagnoser Information Disclosure Vulnerability5.5 Medium
- Show moreLoading…