CWE-668: Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- acymailing, acymailing.com acymailing enterprise component for joomla +1 moreExtension - acymailing.com - Exposure of Sensitive Information in AcyMailing Enterprise component for Joomla 6.7.0-8.6.35.3 Medium
- dell replay manager for vmware, storage integration tools for vmware, storage vsphere client plugin +1 more +3 moreDell Storage Integration Tools for VMware (DSITV) 06.01.00.016 contain an information disclosure...7.8 High
- infinitewp client, revmakx infinitewp client +1 moreInfiniteWP Client <= 1.11.1 - Authenticated (Subscriber+) Sensitive Information Exposure7.5 High
- huawei emui, harmonyos +1 moreVulnerability of input parameters being not strictly verified in the AMS module. Successful...7.5 High
- phpjabbers yacht listing scriptAn information leak in PHPJabbers Yacht Listing Script v1.0 allows attackers to export clients'...7.5 High
- zoom, zoom video communications, inc. sdk's, zoom meeting software development kit +1 more +3 moreExposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated...7.6 High
- zkteco bioaccess ivsZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information...7.5 High
- assaabloy control id idsecureSome API routes exists in Control ID IDSecure 4.7.26.0 and prior, exfiltrating sensitive...6.5 Medium
- codesys development system, scripting +1 moreCodesys: Vulnerability in CODESYS Development System and CODESYS Scripting7.3 High
- jenkins chef identity, jenkins project chef identity plugin +1 moreSecret displayed without masking by Chef Identity Plugin5.3 Medium
- gitlabInsertion of Sensitive Information Into Sent Data in GitLab5.0 Medium
- apache inlongApache InLong: General user can delete and update process6.5 Medium
- vocera report server, voice server +1 moreAn issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is an...7.5 High
- eyoucmseyoucms v1.6.3 was discovered to contain an information disclosure vulnerability via the...5.3 Medium
- hashicorp nomad, nomad enterprise +1 moreNomad Caller ACL Token's Secret ID is Exposed to Sentinel3.4 Low
- archerirm archerAn issue in Archer Platform before v.6.13 fixed in v.6.12.0.6 and v.6.13.0 allows an...7.7 High
- archerirm archerAn issue in Archer Platform before v.6.13 and fixed in 6.12.0.6 and 6.13.0 allows an...7.5 High
- issabel pbxAn issue in issabel-pbx v.4.0.0-6 allows a remote attacker to obtain sensitive information via...7.5 High
- zoom rooms, zoom video communications inc rooms for windows +1 moreInsecure temporary file in the installer for Zoom Rooms before version 5.15.0 may allow an...8.2 High
- marukyu lineAn issue found in Marukyu Line v.13.4.1 allows a remote attacker to gain access to sensitive...7.5 High
- palantir foundry job-tracker, com.palantir.foundry.jobtracker:job-tracker +1 moreInsecure Direct Object Reference (IDOR) in Foundry job-tracker4.3 Medium
- sick ag icr890-4, sick icr890-4 firmware +1 moreUnauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to...7.5 High
- sick ag icr890-4, sick icr890-4 firmware +1 moreExposure of Sensitive Information to an Unauthorized Actor in the SICK ICR890-4 could allow an...8.6 High
- huawei emui, harmonyos +1 moreVulnerability of kernel raw address leakage in the hang detector module. Successful exploitation...5.3 Medium
- huawei emui, harmonyos +1 moreKey management vulnerability on system. Successful exploitation of this vulnerability may affect...9.1 Critical
- wavlink wl-wn531ax2 firmware, wavlink technology ltd. wl-wn531ax2 +1 moreExposure of resource to wrong sphere issue exists in WL-WN531AX2 firmware versions prior to...8.1 High
- apple ipados, macos, tvos +3 more +5 moreThe issue was addressed with improved checks. This issue is fixed in iOS 16.5 and iPadOS 16.5,...2.4 Low
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform may show email addresses in clear in REST results7.5 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform may retrieve email addresses of all users7.5 High
- proofpoint threat response auto pullAn information disclosure vulnerability in the?faye endpoint in Proofpoint Threat Response /...6.1 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +14 more +16 moreWindows Kernel Information Disclosure Vulnerability4.7 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +26 more +28 moreWindows Installer Information Disclosure Vulnerability5.5 Medium
- microsoft windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 +6 more +8 moreDHCP Server Service Information Disclosure Vulnerability5.3 Medium
- discourseDiscourse vulnerable to exposure of number of topics recently created in private categories4.8 Medium
- servicenow, servicenow now platform +1 moreACL bypass in Reporting functionality9.9 Critical
- zoom, zoom video communications, inc. for macos client, for windows client +2 moreExposure of resource to wrong sphere in Zoom for Windows and Zoom for MacOS clients before 5.14...7.4 High
- go standard library runtime, golang go, fedoraproject fedora +2 moreUnsafe behavior in setuid/setgid binaries in runtime7.8 High
- jeecg p3 biz chat project p3 biz chatJeecg P3 Biz Chat allows remote attackers to read arbitrary files7.5 High
- gitlabInsertion of Sensitive Information Into Sent Data in GitLab3.1 Low
- canonical landscapeLandscape's Apache server-status is accessible by default9.3 Critical
- qualcomm csr8811 firmware, ipq6000 firmware, ipq6005 firmware +29 more +31 moreInformation Exposure in Linux Networking Firmware7.1 High
- qualcomm 9205 lte modem firmware, aqt1000 firmware, ar8031 firmware +183 more +185 moreInformation exposure in Kernel7.1 High
- emoncmsemoncms v11 and later was discovered to contain an information disclosure vulnerability which...5.3 Medium
- mitsubishi electric corporation ethernet/ip configuration tool for fx5-enet/ip sw1dnn-eipctfx5-bd, ethernet/ip configuration tool for rj71eip91 sw1dnn-eipct-bd, mitsubishielectric fx5-enet\/ip firmware +3 more +5 moreInformation Disclosure vulnerability in EtherNet/IP Configuration tools6.2 Medium
- faronics insightAn issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console...7.1 High
- finex media competition management systemInformation Disclosure in Finex Media's Competition Management System7.5 High
- apache inlongApache InLong: Attackers can change the immutable name and type of cluster7.5 High
- apache inlongApache InLong: Attackers can change the immutable name and type of nodes7.5 High
- kaiostech kaiosAn issue was discovered in KaiOS 3.0 and 3.1. The binary /system/kaios/api-daemon exposes a local...5.3 Medium
- johnson controls openblue enterprise manager data collectorExposure of Sensitive Information in OpenBlue Enterprise Manager Data Collector5.0 Medium
- Show moreLoading…