CWE-668: Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- ibm spectrum protect plusVersions of IBM Spectrum Protect Plus prior to 10.1.12 (excluding 10.1.12) include the private...5.9 Medium
- tauriTauri Filesystem Scope can be Partially Bypassed2.6 Low
- debian linux, linux kernel, fedoraproject fedora +1 more +3 moredrivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive...5.5 Medium
- ibm maximo asset management, maximo application suite +1 moreIBM Maximo Asset Management 7.6.1.1 and 7.6.1.2 could allow a remote attacker to obtain sensitive...5.3 Medium
- transtek mojodat fixed asset managementThe mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote...5.3 Medium
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to an...6.5 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +24 more +26 moreWindows Graphics Component Information Disclosure Vulnerability6.5 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +21 more +23 moreSPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability8.1 High
- avdor cis crystal qualityAvdor CIS - crystal quality Credentials Management Errors4.9 Medium
- amandaIn Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An...3.3 Low
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +24 more +26 moreWindows Graphics Component Information Disclosure Vulnerability6.5 Medium
- samsung galaxy watch plugin, samsung mobile com.samsung.android.waterplugin +1 moreImproper restriction of broadcasting Intent in SaWebViewRelayActivity of?Waterplugin prior to...6.6 Medium
- dlink dir-819 firmwareA local file inclusion (LFI) vulnerability in D-Link DIR 819 v1.06 allows attackers to cause a...8.1 High
- ibm planning analytics workspaceIBM Planning Analytics Local 2.0 allows web pages to be stored locally which can be read by...4.0 Medium
- cisco sd-wan vmanage, catalyst sd-wan manager +1 moreCisco SD-WAN vManage Software Unauthenticated Access to Messaging Services Vulnerability7.5 High
- synck mailform pro cgiMailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user...5.9 Medium
- plextracThe PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response...5.3 Medium
- arubanetworks aos-cxA vulnerability in the web-based management interface of AOS-CX could allow a remote...5.3 Medium
- wp libre form project libre form, libreform wp libre form 2 (wordpress plugin) +1 moreWordPress WP Libre Form 2 plugin <= 2.0.8 - Unauthenticated Sensitive Information Disclosure vulnerability7.3 High
- redhat openshiftA credentials leak was found in the OpenShift Container Platform. The private key for the...6.5 Medium
- redhat advanced cluster securityA flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were...8.8 High
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a local attacker to obtain...6.2 Medium
- micro focus arcsight loggerPotential vulnerability has been identified in Micro Focus ArcSight Logger. The vulnerability could be remotely exploited resulting in Information Disclosure.6.5 Medium
- convert2rhel project convert2rhel, redhat enterprise linux +1 moreThere is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription...5.5 Medium
- siteservercms project siteservercmsSiteServerCMS 5.X has a Remote-download-Getshell-vulnerability via /SiteServer/Ajax...7.2 High
- lexmark b2236 firmware, b2338 firmware, b2442 firmware +114 more +116 moreVarious Lexmark products through 2022-04-27 allow External Control of a System or Configuration...8.1 High
- xplodedthemes wpide – file manager & code editor (wordpress plugin), wpide - file manager \& code editor +1 moreWordPress WPide plugin <= 2.6 - Authenticated Arbitrary File Read vulnerability4.9 Medium
- dell powerscale onefs, emc powerscale onefs +1 moreDell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0...4.7 Medium
- tabitTabit - Excessive data exposure6.3 Medium
- emerson electric proficy machine edition, emerson electric\'s proficy +1 moreEmerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-284...6.6 Medium
- cybozu office, cybozu, inc. cybozu office +1 moreBrowse restriction bypass vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.5 allows a...4.3 Medium
- amperecomputing ampere altra firmware, ampere altra max firmware +1 moreAmpere Altra before SRP 1.08b and Altra Max? before SRP 2.05 allow information disclosure of...7.5 High
- splunk, splunk enterprise, cloud platform +2 moreInformation disclosure via the dashboard drilldown in Splunk Enterprise2.6 Low
- esri portal for arcgisThere is an improper access control vulnerability in Portal for ArcGIS versions 10.8.17.5 High
github.com/crypto-org-chain/cronosGoCronos vulnerable to DoS through unintended Contract Selfdestruct8.2 High- google androidIn Content, there is a possible way to learn gmail account name on the device due to a...5.5 Medium
- google androidIn USB Manager, there is a possible way to determine whether an app is installed, without query...5.5 Medium
- google androidIn Settings, there is a possible way to determine whether an app is installed without query...5.5 Medium
- vmware vrealize operationsVMware vRealize Operations contains an information disclosure vulnerability. A low-privileged...8.8 High
- google chrome, fedoraproject fedora +1 moreInsufficient policy enforcement in Background Fetch in Google Chrome prior to 104.0.5112.79...6.5 Medium
- samsung mobile charm by samsung, samsung charm firmware +1 morePendingIntent hijacking vulnerability in cancelAlarmManager in Charm by Samsung prior to version...6.2 Medium
- samsung mobile charm by samsung, samsung charm firmware +1 morePendingIntent hijacking vulnerability in releaseAlarm in Charm by Samsung prior to version 1.2.3...6.2 Medium
- evmos ethermint, crypto cronos, evmos +1 more +3 moreEthermint DoS through Unintended Contract Selfdestruct8.2 High
- unknown yaysmtpYaySMTP < 2.2.1 - Subscriber+ SMTP Credentials Leak6.5 Medium
- ibm robotic process automationIBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user to access...4.2 Medium
- ibm urbancode deployIBM UrbanCode Deploy (UCD) 6.2.0.0 through 6.2.7.16, 7.0.0.0 through 7.0.5.11, 7.1.0.0 through 7...5.3 Medium
- jenkins http request, jenkins project http request plugin +1 moreJenkins HTTP Request Plugin stores HTTP Request passwords unencrypted6.5 Medium
- ibm security verify information queueIBM Security Verify Information Queue 10.0.2 could allow a user to obtain sensitive information...5.3 Medium
- google chromeInsufficient validation of untrusted input in File in Google Chrome on Android prior to 103.0...4.3 Medium
- givewp, givewp (wordpress plugin) +1 moreWordPress GiveWP plugin <= 2.20.2 - Authenticated Arbitrary File Read via Export function vulnerability5.5 Medium
- Show moreLoading…