CWE-749: Exposed Dangerous Method or Function
The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- d-link d-view, dlink d-view 8 +1 moreD-Link D-View coreservice_action_script Exposed Dangerous Function Remote Code Execution Vulnerability9.8 Critical
- visualware myconnection serverVisualware MyConnection Server doRTAAccessUPass Exposed Dangerous Method Information Disclosure Vulnerability7.5 High
- lg simple editorLG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution Vulnerability9.8 Critical
- lg simple editorLG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution Vulnerability9.8 Critical
- pdf-xchange editor, tracker-software pdf-xchange editor, pdf-xchange pdf-tools +2 morePDF-XChange Editor Net.HTTP.requests Exposed Dangerous Function Information Disclosure Vulnerability5.5 Medium
- pdf-xchange editor, pdf-tools +1 morePDF-XChange Editor readFileIntoStream Exposed Dangerous Function Information Disclosure Vulnerability5.5 Medium
- pdf-xchange editor, pdf-tools +1 morePDF-XChange Editor exportAsText Exposed Dangerous Method Remote Code Execution Vulnerability7.8 High
- triangle microworks scada data gatewayTriangle MicroWorks SCADA Data Gateway DbasSectorFileToExecuteOnReset Exposed Dangerous Function Remote Code Execution Vulnerability7.2 High
- inductive automation ignitionInductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution Vulnerability7.2 High
- netgear prosafe network management systemNETGEAR ProSAFE Network Management System SettingConfigController Exposed Dangerous Function Remote Code Execution Vulnerability7.2 High
- netgear prosafe network management systemNETGEAR ProSAFE Network Management System BkreProcessThread Exposed Dangerous Function Remote Code Execution Vulnerability7.2 High
- kofax power pdfKofax Power PDF exportAsText Exposed Dangerous Method Remote Code Execution Vulnerability7.8 High
- foxit pdf editor, pdf reader, phantompdf +2 moreFoxit PDF Editor DOC File Parsing Exposed Dangerous Method Remote Code Execution Vulnerability7.8 High
- foxit pdf editor, pdf reader +1 moreFoxit PDF Editor XLS File Parsing Exposed Dangerous Method Remote Code Execution Vulnerability7.8 High
- foxit pdf reader, pdf editor, phantompdf +2 moreFoxit PDF Reader exportXFAData Exposed Dangerous Method Remote Code Execution Vulnerability7.8 High
- qnap myqnapcloud linkmyQNAPcloud Link9.9 Critical
- ibm storage defender, storage defender resiliency service +1 moreIBM Storage Defender - Resiliency Service privilege escalation6.4 Medium
- tp-link ac1350 wireless mu-mimo gigabit access point (eap225 v3), eap225 firmware +1 moreA denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU...7.4 High
- voltronic power viewpower pro, voltronicpower viewpower +1 moreVoltronic Power ViewPower Pro updateManagerPassword Exposed Dangerous Function Authentication Bypass Vulnerability9.8 Critical
- jetbrains teamcityIn JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain...4.2 Medium
- langchain experimental, langchain-experimental +1 moreLangChain Experimental vulnerable to arbitrary code execution9.8 Critical
- misp-project mispAn issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an...9.8 Critical
- honeywell controledge uoc, controledge unit operations controller firmware, controledge virtual unit operations controller firmware +2 moreAn attacker could potentially exploit this vulnerability, leading to the ability to modify files...9.1 Critical
- swift mailer project mailer, drupal swift mailer (abandoned) +1 moreSwift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-0069.1 Critical
- sap sap-xssecEscalation of Privileges in SAP BTP Security Services Integration Library ([Python] cloud-pysec)9.1 Critical
- sap cloud-security-client-go, sap se github.com/sap/cloud-security-client-go +1 moreEscalation of Privileges in SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go)9.1 Critical
- sap cloud-security-services-integration-libraryEscalation of Privileges in SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library)9.1 Critical
- sap se @sap/xssec, sap \@sap\/xssec +1 moreEscalation of Privileges in SAP BTP Security Services Integration Library ([Node.js] @sap/xssec)9.1 Critical
- delta electronics infrasuite device masterDelta Electronics InfraSuite Device Master Exposed Dangerous Method Or Function9.8 Critical
- red lion controls st-ipm-6350, st-ipm-8460, vt-ipm2m-113-d +9 more +11 moreRed Lion Controls Sixnet RTU Exposed Dangerous Method Or Function10.0 Critical
- busbaer eisbaer scada, eisbaer scada v3.0.6433.1964 +1 moreEisBaer Scada - CWE-749: Exposed Dangerous Method or Function7.5 High
- pos/ dienstleistung, entwicklung & vertrieb gmbh cashit! - serving solutions., cashit cashit\! +1 moreUnauthenticated Remote Database Exfiltration7.5 High
- pos/ dienstleistung, entwicklung & vertrieb gmbh cashit! - serving solutions., cashit cashit\! +1 moreUnauthenticated Remote Code Execution9.8 Critical
- solarwinds platform, orion platform +1 moreSolarWinds Platform Exposed Dangerous Method Vulnerability6.8 Medium
- solarwinds platform, orion platform +1 moreSolarWinds Platform Exposed Dangerous Method Vulnerability6.8 Medium
- softneta meddream pacsSoftneta MedDream PACS Exposed Dangerous Method or Function9.8 Critical
- govee homeUnprotected WebView access in Govee Home App8.2 High
- zoom, zoom video communications, inc. sdk's, zoom meeting software development kit +1 more +3 moreExposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated...7.6 High
- keysight geolocation server, keysight technologies n6845a geolocation server +1 moreKeysight Geolocation Server Exposed Dangerous Method or Function7.8 High
- siemens cp-8031 master module, cp-8050 master module, cpci85 firmware +2 moreA vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050...6.8 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2023.05 a specific endpoint was vulnerable to brute force attacks5.3 Medium
- pdf-xchange editorThis vulnerability allows remote attackers to execute arbitrary code on affected installations of...7.8 High
- ivanti avalancheThis vulnerability allows remote attackers to bypass authentication on affected installations of...7.5 High
- linux kernel, openatom openeuler kernel +1 moreREMAP cmd of SVM driver can be used to remap read only memory as read-write, then cause read only...7.5 High
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-store-filesystem-oldcore has Exposed Dangerous Method or Function6.6 Medium
- grafana synthetic-monitoring-agent, synthetic monitoring agent +1 moreGrafana's default installation of `synthetic-monitoring-agent` exposes sensitive information7.2 High
- leadshop, qmpaas qmpaas/leadshop +1 moreExposed Dangerous Method or Function in qmpaas/leadshop8.6 High
- commvault commcellThis vulnerability allows remote attackers to execute arbitrary code on affected installations of...8.8 High
- solarwinds web help deskHTTP PUT & DELETE Methods Enabled5.3 Medium
- ivanti avalancheAn exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 using...9.8 Critical
- Show moreLoading…