CWE-749: Exposed Dangerous Method or Function
The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- signalwire freeswitch FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands 9.8 Critical
- sharpemu SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process execution 8.3 High
- tata motors ira 2.0, ira.ev +1 more Insecure Configuration Vulnerability in Tata Motors iRA and iRA.ev mobile application 7.1 High
- enspirit elo Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fields 7.4 High
- temporal technologies, inc. server Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service host 8.7 High
- apereo foundation openequella Unrestricted Command Execution via system.execute 9.4 Critical
- alpine ilx-f511 Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability 8.8 High
- alpine ilx-f511 Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability 7.8 High
- autodesk fusion Dynamic Library Loading Process Control in Autodesk Fusion Desktop 7.8 High
- getgrav grav Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives 8.7 High
- storybookjs storybook Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites 8.6 High
- cisco unified communications manager Cisco Unified Communications Manager Improper Access Control Vulnerability 5.3 Medium
- oneplus oxygenos OnePlus OxygenOS exposed dangerous method vulnerability 8.4 High
- apconw aix-db Aix-DB 1.2.4 Authenticated RCE via ChatBI Common Agent Execute Tool 8.7 High
- getgrav grav Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@ 9.3 Critical
- shd101wyy vscode-markdown-preview-enhanced Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler 7.3 High
- ivanti neurons patch for intune An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated... 9.9 Critical
- sap se netweaver visual composer Broken Access Control in SAP NetWeaver Visual Composer 9.9 Critical
- tianma-if edgeever EdgeEver Desktop 1.92.0 through 1.112.0 Local Program Execution via ACP IPC 7.3 High
- netease cloud music for windows NetEase Cloud Music RCE via os.navigateExternal IPC 9.2 Critical
- smart media4u technology shareit app Smart Media4U Technology SHAREit App WebView JS Bridge syncInvoke routine 6.9 Medium
- misp MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change 6.9 Medium
- @payloadcms plugin-stripe, payloadcms payload +1 more Payload: Insufficient Access Control in Stripe REST Proxy 6.4 Medium
- joyland joyland.ai Joyland AI WebView command injection 9.0 Critical
- flowring technology corp agentflow 4.0 Flowring Agentflow 4.0 - Exposed Dangerous Method or Function 8.7 High
- progress software progress® telerik® fiddler® everywhere Exposure of Privileged IPC Functionality in Progress Telerik Fiddler Everywhere 5.6 Medium
- qualcomm package manager, software center, qualcomm, inc. snapdragon +2 more Exposed function in Qualcomm Package Manager and Qualcomm Software Center. 8.8 High
- 1panel-dev maxkb MaxKB: Prompt-injectable agent can lead to command execution 10.0 Critical
- temporal technologies, inc. server Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host 8.7 High
- acode-foundation acode Acode: Exported TerminalService (bundled terminal plugin) lets any installed app execute arbitrary shell commands as Acode 8.6 High
- eclipse foundation iceoryx™ In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as... 1.0 Low
- nuxt-modules og-image Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter 6.9 Medium
- cisco enterprise nfv infrastructure software, unified computing system (managed), unified computing system (standalone) +3 more +5 more Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability 7.1 High
- electerm electerm before 5.3.15 Arbitrary Command Execution via Unvalidated runGlobalAsync IPC Bridge 7.5 High
- asus armoury crate Exposed Dangerous Method or Function in ASUS Armoury Crate allow a local user to cause a brief... 5.7 Medium
- lmfit asteval asteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter 5.5 Medium
- parallels ras client Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability 7.8 High
- parallels ras client Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability 7.8 High
- parallels ras client Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability 7.8 High
-
org.geoserver:gs-mainMaven,org.geoserver:gs-wmsMaven,org.geoserver.web:gs-web-appMaven +2 more GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates 7.2 High - truelockmc streambert Streambert : Insecure Protocol Execution in open-external IPC Handler 8.3 High
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13 +4 more +6 more Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication 5.4 Medium
- flowiseai flowise Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore 9.0 Critical
- flowiseai flowise Flowise before 3.1.3 Sandbox Escape via Puppeteer 9.4 Critical
- truelockmc streambert Streambert Vulnerable to Arbitrary Binary Execution via Downloader IPC Handler 10.0 Critical
- microsoft azure confidential ledger Azure Confidential Ledger Remote Code Execution Vulnerability 9.1 Critical
- h3c nx15 H3C NX15 Web API esps service.add routine 8.6 High
- mediatek, inc. mediatek chipset In apusys, there is a possible escalation of privilege due to a missing bounds check. This could... 6.0 Medium
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 more Exposed Reboot via Modbus 8.7 High
- owncloud core ownCloud Core: Updater has an exposed dangerous method or function 9.1 Critical
- Show olderLoading…