CWE-668: Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- gnome epiphany, fedoraproject fedora +1 moreIn Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating...7.5 High
- fortinet fortinacA external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5,...9.8 Critical
- ami megarac sp-xAMI MegaRAC SPX devices allow User Enumeration through Redfish. The fixed versions are SPx12...5.3 Medium
- microsoft 365 apps, 365 apps for enterprise, office ltsc 2021 +1 more +3 moreMicrosoft Office Information Disclosure Vulnerability5.5 Medium
- microsoft windows 11 version 21h2, windows 11 version 22h2, windows server 2022 +2 more +4 moreHTTP.sys Information Disclosure Vulnerability5.5 Medium
- sap host agent, host agent service +1 moreAn attacker authenticated as a non-admin user with local access to a server port assigned to the...8.8 High
- dell supportassist, supportassist for business pcs, supportassist for home pcs +2 moreDell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs ...6.4 Medium
- dell bsafe ssl-jDell BSAFE SSL-J when used in debug mode can reveal unnecessary information. An attacker could...4.4 Medium
- codenameone codename oneCodenameOne implicit intent for sensitive communication5.0 Medium
- dell powerpath management appliancePowerPath Management Appliance with versions 3.3, 3.2*, 3.1 & 3.0* contains sensitive information...2.7 Low
- samsung cloudImproper access control vulnerabilities in Samsung Cloud prior to version 5.3.0.32 allows local...4.0 Medium
- samsung android, samsung mobile the patch adds proper access control to use explicit intent. +1 moreImproper access control vulnerability in MyFiles prior to versions 12.2.09 in Android R(11), 13.1...5.5 Medium
- samsung android, samsung mobile devices +1 moreImproper logic in HomeScreen prior to SMR Feb-2023 Release 1 allows physical attacker to access...2.1 Low
- dell vxrail hci, vxrail manager +1 moreDell VxRail, versions prior to 7.0.410, contain a Container Escape Vulnerability. A local high...8.2 High
- lastyard last yardLast Yard 22.09.8-1 is vulnerable to Cross-origin resource sharing (CORS).7.5 High
- schneider electric ecostruxure power commissionA CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause all remote...3.9 Low
- totolink a830r firmwareAn information disclosure vulnerability in Totolink A830R V4.1.2cu.5182 allows attackers to...5.5 Medium
- qlik qlikviewQlik QlikView through 12.60.20100.0 creates a Temporary File in a Directory with Insecure...7.8 High
- qlik nprinting designerQlik NPrinting Designer through 21.14.3.0 creates a Temporary File in a Directory with Insecure...7.8 High
- dell cpg drivers, realtek high definition audio driver +1 moreAn improper access control vulnerability was identified in the Realtek audio driver. A local...7.3 High
- micro focus netiq identity manager, netiq identity manager +1 moreFile existence disclosue vulnerability in IDM plugin1.8 Low
- mediawikiAn issue was discovered in the CheckUser extension for MediaWiki through 1.39.x. Various...5.3 Medium
- dell command\|configure, command configure (dcc) +1 moreDell command configuration, version 4.8 and prior, contains improper folder permission when...7.3 High
- adobe acrobat, acrobat reader, acrobat dc +1 more +3 moreAdobe Acrobat Reader Creation of Temporary File in Directory with Incorrect Permissions Privilege escalation7.8 High
- apache supersetApache Superset: Dashboard metadata information leak5.3 Medium
- netdataNetdata is vulnerable to improper authentication6.5 Medium
- java-merge-sort project java-merge-sortJava Merge-sort Insecure Temporary File vulnerability5.5 Medium
- amd 3rd gen epyc, epyc 7003 firmware, epyc 72f3 firmware +22 more +24 moreInsufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software...5.5 Medium
- microsoft windows 10 version 1809, windows 10 version 20h2, windows 10 version 21h2 +12 more +14 moreEvent Tracing for Windows Information Disclosure Vulnerability4.7 Medium
- devent globalpom-utilsdevent globalpom-utils FileResourceManagerProvider.java createTmpDir temp file6.3 Medium
- apache james, apache software foundation james server +1 moreApache James server: Temporary File Information Disclosure5.5 Medium
- ntpd driver project driverThe ntpd_driver component before 1.3.0 and 2.x before 2.2.0 for Robot Operating System (ROS)...9.8 Critical
- linuxcontainers lxclxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer...3.3 Low
- centic9 jgit-cookbookcentic9 jgit-cookbook temp file3.1 Low
- pilz pmcIn Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), an attacker...5.3 Medium
- planetestream planet estreamPlanet eStream before 6.72.10.07 discloses sensitive information, related to the ON cookie ...6.5 Medium
- zkteco zem500 firmware, zem510 firmware, zem560 firmware +7 more +9 moreCertain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive...7.5 High
- mozilla firefox, firefox mobile +1 moreA website that had permission to access the microphone could record audio without the audio...4.3 Medium
- vmware vrealize operationsvRealize Operations (vROps) contains a broken access control vulnerability. VMware has evaluated...4.9 Medium
- apple ipados, macos, tvos +2 more +4 moreThis issue was addressed with improved data protection. This issue is fixed in iOS 16.2 and...5.5 Medium
- apple ios, iphone os, macos +1 more +3 moreAn issue existed with the file paths used to store website data. The issue was resolved by...5.3 Medium
- fp newsletter project newsletter"Newsletter subscriber management" (fp_newsletter) TYPO3 extension leaks subscriber data9.1 Critical
- fp newsletter project newsletter"Newsletter subscriber management" (fp_newsletter) TYPO3 extension leaks subscriber data9.1 Critical
- sap business objects business intelligence platform, business objects platform (monitoring db) +1 moreUnder certain conditions, an attacker authenticated as a CMS administrator and with high...6.0 Medium
- netgear ax2400 firmwareA network misconfiguration is present in versions prior to 1.0.9.90 of the NETGEAR RAX30 AX2400...10.0 Critical
- daloradius, lirantal lirantal/daloradius +1 moreMissing Authorization in lirantal/daloradius5.3 Medium
- goteleport teleportTeleport v3.2.2, Teleport v3.5.6-rc6, and Teleport v3.6.3-b2 was discovered to contain an...6.5 Medium
- mozilla thunderbirdIf a Thunderbird user quoted from an HTML email, for example by replying to the email, and the...8.1 High
- google android, unisoc (shanghai) technologies co., ltd. sc9863a/sc9832e/sc7731e/t610/t310/t606/t760/t610/t618/t606/t612/t616/t760/t770/t820/s8007 +1 moreIn wlan driver, there is a possible missing permission check, This could lead to local...5.5 Medium
- google android, unisoc (shanghai) technologies co., ltd. sc9863a/sc9832e/sc7731e/t610/t310/t606/t760/t610/t618/t606/t612/t616/t760/t770/t820/s8011 +1 moreIn wlan driver, there is a possible missing permission check, This could lead to local...5.5 Medium
- Show moreLoading…