CWE-668: Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- suse rancher, rancher desktop +1 morerancher desktop: Dashboard API is network accessible8.3 High
- google androidIn l2cble_process_sig_cmd of l2c_ble.cc, there is a possible out of bounds read due to a missing...6.5 Medium
- vmware spring bootTemporary Directory Hijacking to Local Privilege Escalation Vulnerability in org.springframework.boot:spring-boot7.8 High
- google androidIn Telephony, there is a possible way to determine whether an app is installed, without query...5.5 Medium
- google androidIn PermissionController, there is a possible permission bypass due to an unsafe PendingIntent....5.5 Medium
- google llc data-transfer-project, google data transfer project +1 moreData-transfer-project information disclosure via tmp directory5.5 Medium
- jenkins tests selector, jenkins project tests selector plugin +1 moreArbitrary file read vulnerability in Jenkins Tests Selector Plugin6.5 Medium
- gradle enterpriseGradle Enterprise before 2022.1 allows remote code execution if the installation process did not...9.8 Critical
- horovod, horovod horovod/horovod +1 moreInsecure Temporary File in horovod/horovod8.2 High
- open-emr openemrOpenEMR v6.0.0 was discovered to contain an incorrect access control issue.4.3 Medium
- ge ur family, multilin b30 firmware, multilin b90 firmware +17 more +19 moreGE UR family exposure of sensitive information to an unauthorized actor5.3 Medium
- [unknown] openstack-tripleo-heat-templates, redhat openstack, openstack tripleo heat templates +2 moreExposure of Sensitive Information to an Unauthorized Actor in OpenStack tripleo-heat-templates4.3 Medium
- electronRenderers can obtain access to random bluetooth device without permission in Electron3.4 Low
- bigantsoft bigant serverBigAnt Software BigAnt Server v5.6.06 was discovered to contain incorrect access control.7.5 High
- thinkphpExposure of Resource to Wrong Sphere in ThinkPHP Framework7.5 High
- piwigoPiwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin...7.5 High
- apple ipados, ios and ipados, iphone os +2 moreThe GSMA authentication panel could be presented on the lock screen. The issue was resolved by...6.1 Medium
- apple ipados, ios and ipados, iphone os +2 moreThis issue was addressed with improved checks. This issue is fixed in iOS 15.4 and iPadOS 15.4. A...4.6 Medium
- apple ipados, ios and ipados, iphone os +2 moreAn issue with app access to camera metadata was addressed with improved logic. This issue is...3.3 Low
- apple macos, mac os x +1 moreA permissions issue was addressed with improved validation. This issue is fixed in Security...5.5 Medium
- apple ipados, macos, tvos +3 more +5 moreAn information disclosure issue was addressed with improved state management. This issue is fixed...7.8 High
- naver whale browser, navercorp whale +1 moreWhale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any...9.8 Critical
- atlassian crucible, fisheye +1 moreThe /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed...4.3 Medium
- ibm engineering workflow management, rational team concert +1 moreIBM Engineering Workflow Management 7.0, 7.0.1, and 7.0.2 and IBM Rational Team Concert 6.0.6 and...4.3 Medium
- syliusExposure of Sensitive Information Due to Incompatible Policies in Sylius5.0 Medium
- amd a10-9600p firmware, a10-9630p firmware, a12-9700p firmware +124 more +126 moreSome AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially...6.5 Medium
- mcafee webadvisorMcAfee WebAdvisor - Extension Fingerprinting vulnerability6.5 Medium
- runzero platform, shopware +1 moreHTTP caching is marking private HTTP headers as public6.3 Medium
- microsoft skype extension for chrome, skype extension +1 moreSkype Extension for Chrome Information Disclosure Vulnerability6.5 Medium
- microsoft remote desktop client for windows desktop, remote desktop client, windows 10 version 1507 +27 more +29 moreRemote Desktop Protocol Client Information Disclosure Vulnerability5.4 Medium
- citrix federated authentication service (fas), federated authentication service +1 moreCitrix Federated Authentication Service (FAS)4.4 Medium
- ericsson network managerEricsson Network Manager 20.2 has Insecure Permissions.6.5 Medium
- mendix, siemens mendix applications using mendix 7 +1 moreA vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23...6.5 Medium
- mendix, siemens mendix runtime v7, mendix runtime v8 +1 more +3 moreA vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23...6.8 Medium
- huawei emui, harmonyos, magic ui +2 moreThere is an unauthorized access vulnerability in system components. Successful exploitation of...7.5 High
- google chromeData leak in Canvas in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who...6.5 Medium
- stepmaniaThe component /rootfs in RageFile of Stepmania v5.1b2 and below allows attackers access to the...9.1 Critical
- fortinet fortiosA improper input validation in Fortinet FortiGate version 6.4.3 and below, version 6.2.5 and...2.6 Low
- zohocorp manageengine key manager plusAn issue was discovered in Zoho ManageEngine Key Manager Plus 6.1.6. A user, with the level...4.3 Medium
- google androidIn __show_regs of process.c, there is a possible leak of kernel memory and addresses due to log...4.4 Medium
- ametysThe auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to...5.3 Medium
- microweber, microweber microweber/microweber +1 moreIncorrect Authorization in microweber/microweber5.5 Medium
- kde kcronKDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename...7.8 High
- jetbrains teamcityIn JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via...5.3 Medium
- visual voice mail project voice mail** DISPUTED ** The Visual Voice Mail (VVM) application through 2022-02-24 for Android allows...8.1 High
- lfprojects mlflow, mlflow mlflow/mlflow +1 moreInsecure Temporary File in mlflow/mlflow8.2 High
- seatd project seatdseatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when...9.8 Critical
- debian linux, linux kernel +1 moreAn issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10...5.5 Medium
- ibexa ez platform kernelExposure of Resource to Wrong Sphere in ezsystems/ezplatform-kernel5.3 Medium
- cerebrate-project cerebrateAn issue was discovered in Cerebrate through 1.4. An incorrect sharing group ACL allowed an...4.3 Medium
- Show moreLoading…