CWE-668: Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- netty, netapp active iq unified manager, oncommand workflow automation +2 more +4 moreLocal Information Disclosure Vulnerability in io.netty:netty-codec-http5.5 Medium
- schedmd slurm, debian linux, fedoraproject fedora +2 moreSchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Information...8.8 High
- fortinet fortiosAn improper access control vulnerability [CWE-284] in FortiOS versions 6.4.8 and prior and 7.0.3...6.3 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, qualcomm apq8053 firmware, apq8096au firmware +81 more +83 moreProcessing DCB/AVB algorithm with an invalid queue index from IOCTL request could lead to...6.7 Medium
- ping identity pingid desktopPingID Desktop encryption libraries misconfiguration can lead to sensitive data exposure8.0 High
- piano led visualizer project led visualizer, onlaj piano-led-visualizer +1 moreAbsolute Path Traversal due to incorrect use of `send_file` call in Piano LED Visualizer9.9 Critical
- xwiki, xwiki xwiki-commons +1 moreArbitrary filesystem write access from Velocity7.5 High
- zoom on-premise meeting connector controller, on-premise meeting connector mmr +1 moreProcess memory exposure in Zoom on-premise Meeting services6.5 Medium
- jetbrains pycharmIn JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was...3.0 Low
- samba cifs-utils, debian linux, fedoraproject fedora +2 morecifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains...5.3 Medium
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM 7.3, 7.4, and 7.5 allows for users to access information across tenant and domain...4.3 Medium
- zammadAn access control issue in Zammad v5.0.3 allows attackers to write entries to the CTI caller log...9.1 Critical
- zammadAn access control issue in Zammad v5.0.3 broadcasts administrative configuration changes to all...4.3 Medium
- google chromeInappropriate implementation in iframe in Google Chrome prior to 101.0.4951.41 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in HTML Parser in Google Chrome prior to 101.0.4951.41 allowed a...4.3 Medium
- google chromeInappropriate implementation in Extensions API in Google Chrome prior to 101.0.4951.41 allowed an...4.3 Medium
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow an authenticated user to view report...4.3 Medium
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow a remote attacker to obtain...4.6 Medium
- mattermost, mattermost server +1 moreInvitation Email is resent as a Reminder after invalidating pending email invites3.7 Low
- d2l brightspaceAn Access Control vulnerability exists in Desire2Learn/D2L Learning Management System (LMS) 20.21...6.5 Medium
- zohocorp manageengine remote access plusZoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view domain...5.3 Medium
- zohocorp manageengine remote access plusZoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view license details.5.3 Medium
- microsoft windows server 2016, windows server 2016 (server core installation), windows server 2019 +3 more +5 moreWindows DNS Server Information Disclosure Vulnerability6.5 Medium
- hubzillaA PHP Local File Inclusion vulneraility in the default Redbasic theme for Hubzilla before version...7.5 High
- waycrate swhkdExposure of Resource to Wrong Sphere in Simple-Wayland-HotKey-Daemon4.4 Medium
- waycrate swhkdExposure of Resource to Wrong Sphere in Simple-Wayland-HotKey-Daemon3.3 Low
- amazon aws client vpnAn issue was discovered in Amazon AWS VPN Client 2.0.0. A TOCTOU race condition exists during the...7.0 High
- vmware identity manager, vrealize automation, workspace one access +2 more +4 moreVMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information...5.3 Medium
- dell powerscale onefs, emc powerscale onefs +1 moreDell PowerScale OneFS 8.2.2 and above contain an elevation of privilege vulnerability. A local...7.8 High
- dell powerscale onefs, emc powerscale onefs +1 moreDell PowerScale OneFS, 8.2,x, 9.1.0.x, 9.2.1.x, and 9.3.0.x contain a denial of service...4.7 Medium
- blueplanet-works appguardBeyondTrust AppGuard Enterprise through 6.6.20.2 creates a Temporary File in a Directory with...7.8 High
- siemens scalance x302-7 eec (230v), scalance x302-7 eec (230v, coated), scalance x302-7 eec (24v) +72 more +74 moreA vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V,...7.5 High
- mendix, siemens mendix applications using mendix 7, mendix applications using mendix 8 +2 more +4 moreA vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23...6.5 Medium
- google android, samsung mobile devices +1 moreInformation exposure vulnerability in ril property setting prior to SMR April-2022 Release 1...6.6 Medium
- google android, samsung mobile devices +1 moreInformation exposure vulnerability in Samsung DeX Home prior to SMR April-2022 Release 1 allows...3.3 Low
- google android, samsung mobile devices +1 moreInformation exposure vulnerability in One UI Home prior to SMR April-2022 Release 1 allows to...3.3 Low
- samsung mobile samsungcontacts, google android +1 moreImproper access control vulnerability in SamsungContacts prior to SMR Apr-2022 Release 1 allows...5.3 Medium
- reprisesoftware reprise license managerReprise License Manager 14.2 is affected by an Information Disclosure vulnerability via a GET...5.3 Medium
- apple macos, mac os x, fedoraproject fedora +2 moreA cookie management issue was addressed with improved state management. This issue is fixed in...6.5 Medium
- codesys control for beaglebone sl, control for beckhoff cx9020 sl, control for empc-a/imx6 sl +22 more +24 moreA component of the CODESYS Control runtime system allows read and write access to configuration files8.1 High
- waycrate swhkdInsecure temporary file usage in SWHKD9.1 Critical
- apache nifiInsufficiently protected credentials4.3 Medium
- gitlabA business logic error in Project Import in GitLab CE/EE versions 14.9 prior to 14.9.2, 14.8...2.4 Low
- verizon lvskihp firmwareVerizon LVSKIHP 5G outside devices through 2022-02-15 allow anyone (knowing the device's serial...8.1 High
- google chromeInappropriate implementation in Resource Timing in Google Chrome prior to 100.0.4896.60 allowed a...6.5 Medium
- google chromeInappropriate implementation in Background Fetch API in Google Chrome prior to 100.0.4896.60...6.5 Medium
- google chromeInappropriate implementation in Web Cursor in Google Chrome prior to 100.0.4896.60 allowed a...6.5 Medium
- google chromeInappropriate implementation in Extensions in Google Chrome prior to 100.0.4896.60 allowed an...6.5 Medium
- google chromeInappropriate implementation in Web Share API in Google Chrome on Windows prior to 100.0.4896.60...6.5 Medium
- ibm partner engagement manager, sterlingpartner engagement manager +1 moreIBM SterlingPartner Engagement Manager 6.2.0 could allow a remote authenticated attacker to...5.4 Medium
- Show moreLoading…