CWE-668: Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- sick ftmg-esd15axx firmware, ftmg-esd20axx firmware, ftmg-esd25axx firmware +11 more +13 moreInclusion of Sensitive Information in Source Code in SICK FTMg AIR FLOW SENSOR with Partnumbers...5.3 Medium
- webroot secureanywhereAn issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before...5.5 Medium
- intel core i3-1000g1 firmware, core i3-1000g4 firmware, core i3-1005g1 firmware +464 more +466 moreExposure of resource to wrong sphere in BIOS firmware for some Intel(R) Processors may allow a...4.1 Medium
- intel data center managerExposure of data element to wrong session in the Intel DCM software before version 5.0.1 may...6.8 Medium
- n8nn8n Information Disclosure vulnerability7.5 High
- gitlabAn issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8,...6.4 Medium
- gitlabAn issue has been discovered in GitLab affecting all versions starting from 13.11 before 15.8.5,...6.5 Medium
- hyundai gen5w l firmwareAn issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR...7.8 High
- checkmk gmbh appliance, tribe29 checkmk appliance, checkmk appliance firmware +2 moreSite-Passwords in GET parameters5.5 Medium
- schneider electric ecostruxure control expertA CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause remote...8.8 High
- mediawikiAn issue was discovered in the VisualEditor extension in MediaWiki before 1.31.13, and 1.32.x...4.3 Medium
- kyocera mobile print, kyocera document solutions, ta triumph-adler gmbh, and olivetti spa mobile print, utax/ta mobileprint, and olivetti mobile print +1 moreKYOCERA Mobile Print' v3.2.0.230119 and earlier, 'UTAX/TA MobilePrint' v3.2.0.230119 and earlier,...5.5 Medium
- xwiki, xwiki xwiki-platform +1 moreUnauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm3.7 Low
- xwiki, xwiki xwiki-platform +1 moreData leak through deleted documents7.5 High
- mozilla firefox, firefox for android, focus +2 more +4 moreUnder specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI...4.3 Medium
- sap landscape managementInformation Disclosure vulnerability in SAP Landscape Management6.8 Medium
- buffalo bs-gs2008 firmware, bs-gs2008p firmware, bs-gs2016 firmware +14 more +16 moreUse of hard-coded credentials vulnerability in Buffalo network devices allows an attacker to...7.5 High
- aten pe8108 firmwareAten PE8108 2.4.232 is vulnerable to Incorrect Access Control. Restricted users have access to...8.1 High
- silverwaregames, mesosoi silverwaregames-io-issue-tracker +1 moreSilverwareGames.io users with access to the game upload panel are able to edit download links for games uploaded by other developers2.7 Low
- google android, unisoc (shanghai) technologies co., ltd. sc9863a/sc9832e/sc7731e/t610/t310/t606/t760/t610/t618/t606/t612/t616/t760/t770/t820/s8000 +1 moreIn telecom service, there is a missing permission check. This could lead to local denial of...7.1 High
- mattermost, mattermost server +1 moreInformation disclosure in linked message previews6.5 Medium
- mattermost, mattermost server +1 moreUnsanitized events sent over Websocket to regular users in a High Availability environment4.3 Medium
- codesys control for beaglebone sl, control for empc-a/imx6 sl, control for iot2000 sl +21 more +23 moreCODESYS: Exposure of Resource to Wrong Sphere in CODESYS V38.8 High
- moodle, fedoraproject fedora +1 moreMoodle: teacher can access names of users they do not have permission to access4.3 Medium
- moodleMoodle: course participation report shows roles the user should not see4.3 Medium
- minioMinio Privilege Escalation on Windows via Path separator manipulation8.8 High
- mattermostFull name revealed via /plugins/focalboard/api/v2/users3.5 Low
- smartconrtactgames project smartconrtactgamesAn issue found in DepositGame v.1.0 allows an attacker to gain sensitive information via the...9.1 Critical
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +22 more +24 moreMicrosoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability6.5 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +22 more +24 moreMicrosoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability6.5 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +22 more +24 moreMicrosoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability6.5 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +22 more +24 moreMicrosoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability6.5 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +28 more +30 moreClient Server Run-Time Subsystem (CSRSS) Information Disclosure Vulnerability5.5 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +28 more +30 moreClient Server Run-Time Subsystem (CSRSS) Information Disclosure Vulnerability5.5 Medium
- mozilla firefoxUnder certain circumstances, a ServiceWorker's offline cache may have leaked to the file system...4.3 Medium
- hap-wi roxy-wiRoxy-WI has Path Traversal vulnerability7.5 High
- smartbear zephyr enterpriseThere exists an information disclosure vulnerability in SmartBear Zephyr Enterprise through 7.15...7.5 High
- github enterprise serverInformation disclosure in GitHub Enterprise Server leading to unauthorized viewing of private repository names4.3 Medium
- cisco unified intelligence center, packaged contact center enterprise, unified contact center enterprise +1 more +3 moreCisco Unified Intelligence Center Vulnerabilities6.5 Medium
- dell powerscale onefsDell PowerScale OneFS 9.4.0.x contains exposure of sensitive information to an unauthorized actor...6.7 Medium
- dell networker, nve, emc networker +1 moreDell NetWorker versions 19.5 and earlier contain 'Apache Tomcat' version disclosure vulnerability...7.5 High
- dell networker, nve, emc networker +1 moreDell NetWorker versions 19.5 and earlier contain 'RabbitMQ' version disclosure vulnerability. A...7.5 High
- arubanetworks arubaos, sd-wan, hewlett packard enterprise aruba mobility conductor (formerly mobility master); aruba mobility controllers; wlan gateways and sd-wan gateways managed by aruba central +2 moreAuthenticated Information Disclosure in ArubaOS Web-based Management Interface4.9 Medium
- arubanetworks arubaos, sd-wan, hewlett packard enterprise aruba mobility conductor (formerly mobility master); aruba mobility controllers; wlan gateways and sd-wan gateways managed by aruba central +2 moreAuthenticated Sensitive Information Disclosure in ArubaOS Command Line Interface6.5 Medium
- nextcloud talk, kiteworks security-advisories +1 moreNextcloud Talk messages can still be seen on conversation after expiring when cron is misconfigured2.6 Low
- mattermost, mattermost server +1 moreDisclosure of team owner email address when regenerating Invite ID2.7 Low
- apple macosThe issue was addressed with improved memory handling This issue is fixed in macOS Ventura 13.2....5.5 Medium
- apple macosThis issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.6...5.5 Medium
- quarkusRestEasy Reactive implementation of Quarkus allows Creation of Temporary File With Insecure Permissions3.3 Low
- ecdh project ecdhecdh vulnerable to Exposure of Resource to Wrong Sphere7.5 High
- Show moreLoading…