CWE-749: Exposed Dangerous Method or Function
The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- efm networks & multimedia iptime c200 ip camera, iptime c200 firmware +1 moreIpTime C200 IP camera remote code execution vulnerability7.5 High
- microsoft windows, windows server 2008 r2 service pack 1, windows server 2008 r2 service pack 1 (server core installation) +15 more +17 moreWindows LSA Spoofing Vulnerability7.5 High
- qnap systems inc. hbs 3, qnap hybrid backup sync +1 moreMissing Authentication for Critical Function in RTRR Server in HBS39.8 Critical
- qnap qesStored cross-site scripting vulnerability in QES9.0 Critical
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreCrash while handling internal Javascript exception types6.5 Medium
- amd vbios flash tool software development kitA potential vulnerability in a dynamically loaded AMD driver in AMD VBIOS Flash Tool SDK may...7.8 High
- amd energy driver for linuxA potential vulnerability in the AMD extension to Linux "hwmon" service may allow an attacker to...5.5 Medium
- cisco anyconnect secure mobility clientCisco AnyConnect Secure Mobility Client for Windows Arbitrary File Read Vulnerability5.5 Medium
- amd ryzen masterA vulnerability in a dynamically loaded AMD driver in AMD Ryzen Master V15 may allow any...7.8 High
- cisco ios xe software, ios xe +1 moreCisco IOS XE Software for Cisco ASR 900 Series Route Switch Processor 3 Arbitrary Code Execution Vulnerabilities6.7 Medium
- cisco ios xe software, ios xe +1 moreCisco IOS XE Software for Cisco ASR 900 Series Route Switch Processor 3 Arbitrary Code Execution Vulnerabilities6.7 Medium
- marvell qconvergeconsoleThis vulnerability allows remote attackers to execute arbitrary code on affected installations of...8.8 High
- parallels desktopThis vulnerability allows local attackers to disclose information on affected installations of...6.5 Medium
- citrix xenmobile serverImproper access control in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10...9.8 Critical
- centos web panel web panel, centos-webpanel centos web panel, control-webpanel webpanel +2 moreThis vulnerability allows remote attackers to write arbitrary files on affected installations of...9.8 Critical
- kuka kr c4 firmware, kuka roboter gmbh kr3r540, krc4, kss8.5.7hf1, win7 embedded +1 moreRVD#2550: Terminate Critical Services in KUKA controller KR C46.1 Medium
- siemens control center server (ccs), control center server +1 moreA vulnerability has been identified in SiNVR 3 Central Control Server (CCS) (all versions), SiNVR...9.9 Critical
- siemens simatic s7-1200 cpu family (incl. siplus variants), siemens ag simatic s7-1200 cpu family < v4.x (incl. siplus variants), simatic s7-1200 cpu family v4.x (incl. siplus variants) +31 more +33 moreA vulnerability has been identified in SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All...6.8 Medium
- polycom unified communications software, united communications software +1 moreAn RCE (Remote Code Execution) vulnerability exists in the UCS software through 6.0.0 used by...8.3 High
- ibm db2, db2 for linux, unix and windows +1 moreIBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 could allow an...6.5 Medium
- siemens simatic pcs 7 v8.0 and earlier, simatic pcs 7 v8.1, simatic pcs 7 v8.2 +15 more +17 moreA vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS...8.8 High
- pixar renderman, talos pixar renderman +1 moreA local privilege escalation vulnerability exists in the Mac OS X version of Pixar Renderman 22.3...9.0 Critical
- gigabyte aorus graphics engine, app center, oc guru ii +2 more +4 moreThe GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS...7.8 High
- cobbler, redhat satellite +1 moreCobbler has Exposed Dangerous Method or Function9.8 Critical
- medtronic 24950 mycarelink monitor, 24952 mycarelink monitor, 24950 mycarelink monitor firmware +1 more +3 moreMedtronic MyCareLink Patient Monitor Exposed Dangerous Method or Function6.2 Medium
- misp-project mispAn issue was discovered in app/Model/Attribute.php in MISP before 2.4.89. There is a critical API...4.3 Medium
- huawei technologies co., ltd. tit-al00, huawei y6 pro firmware +1 moreTIT-AL00 smartphones with software versions earlier before TIT-AL00C583B214 have a exposed system...7.1 High
- gitlabMultiple versions of GitLab expose a dangerous method to any authenticated user that could lead...8.2 High
- vmware vrealize operationsThe Suite REST API in VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote...8.5 High
- beckhoff embedded pc images, twincat, twincat components featuring automation device specification (ads) communication +2 moreBeckhoff Embedded PC Images and TwinCAT Components Exposed Dangerous Method or Function9.1 Critical
- iconics genesis32ICONICS GENESIS32 Exposed Dangerous Method or Function9.3
- red hat jboss, redhat jboss enterprise application platform +1 moreThe Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform ...7.5 High
- red hat jboss, redhat jboss enterprise application platform +1 moreThe JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka...5.3 Medium
- apache struts, struts 1 +1 moreImproper Input Validation in Apache Struts7.5 High