CWE-749: Exposed Dangerous Method or Function
The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- nextcloud, nextcloud server +1 moreCross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in...6.4 Medium
- docker mcp gateway, mcp-gateway +1 moreDNS Rebinding vulnerability present when running MCP Gateway in sse or streaming mode7.3 High
- qualcomm qam8255p firmware, qam8650p firmware, qam8775p firmware +16 more +18 moreExposed Dangerous Method or Function in Automotive Software platform based on QNX7.8 High
- icinga, icinga icinga2 +1 moreIcinga 2 API users could access restricted values in filter expressions7.1 High
- flocksafety flock safetyThe Flock Safety Android Collins application (aka com.flocksafety.android.collins) 6.35.31 for...9.8 Critical
- No product listedVoltronic Power ViewPower through 1.04-24215, ViewPower Pro through 2.0-22165, and PowerShield...10.0 Critical
- laser romae s.r.l. openblowOpenBlow Missing Critical Security Headers8.4 High
- goldendictGoldenDict 1.5.0 and 1.5.1 has an exposed dangerous method that allows reading and modifying...9.6 Critical
- hewlett packard enterprise insight remote supportA vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an...7.5 High
- filebrowserFile Browser Allows Execution of Shell Commands That Can Spawn Other Commands8.0 High
- autel maxicharger ac wallbox commercial, maxicharger ac elite business c50 firmware, maxicharger ac pro firmware +7 more +9 moreAutel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability4.9 Medium
- wolfbox level 2 ev charger, level 2 ev charger firmware +1 moreWOLFBOX Level 2 EV Charger LAN OTA Exposed Dangerous Method Remote Code Execution Vulnerability8.0 High
- webpack webpack-dev-serverwebpack-dev-server users' source code may be stolen when they access a malicious web site5.3 Medium
- echarge hardy barth cph2 / cpp2 charging stationsBackdoor Functionality via USB Drive in eCharge Hardy Barth cPH2 / cPP2 charging stations6.2 Medium
- sap se s/4hana (private cloud & on-premise)Information Disclosure vulnerability in SAP S/4HANA (Private Cloud & On-Premise)6.4 Medium
- convertigoTwsCachedXPathAPI in Convertigo through 8.3.4 does not restrict the use of commons-jxpath APIs.2.2 Low
- tecno carlcare, com.transsion.carlcare +1 moreInterface exposure vulnerability in the mobile application (com.transsion.carlcare) may lead to ...7.5 High
- microsoft windows 11 version 22h2, windows 11 version 22h3, windows 11 version 23h2 +9 more +11 moreWindows Local Session Manager (LSM) Denial of Service Vulnerability6.5 Medium
- qualcomm ar8035 firmware, fastconnect 6200 firmware, fastconnect 6700 firmware +162 more +164 moreExposed Dangerous Method or Function in HLOS7.1 High
- h2o, h2oai h2oai/h2o-3 +1 moreEncryption of Arbitrary Files with Attacker-Controlled Key in h2oai/h2o-36.5 Medium
- ptt inc. hgs mobile appSensitive Data Exposure in PTT Inc.'s HGS Mobile App8.5 High
- @clerk nuxtOpening a malicious website while running a Nuxt dev server could allow read-only access to code5.3 Medium
- lmfit astevalASTEVAL Vulnerable to Maliciously Crafted Format Strings Leading to Sandbox Escape8.4 High
astevalPyPI,rootio-astevalRoot +1 moreASTEVAL Allows Malicious Tampering of Exposed AST Nodes Leads to Sandbox Escape8.4 High- typo3Cross-Site Request Forgery in DB Check Module in TYPO34.3 Medium
- typo3Cross-Site Request Forgery in Scheduler Module in TYPO38.0 High
- typo3Cross-Site Request Forgery in Indexed Search Module in TYPO34.3 Medium
- typo3Cross-Site Request Forgery in Form Framework Module in TYPO35.4 Medium
- typo3Cross-Site Request Forgery in Extension Manager Module in TYPO37.5 High
- typo3Cross-Site Request Forgery in Dashboard Module in TYPO34.3 Medium
- typo3TYPO3 Cross-Site Request Forgery in Backend User Module4.3 Medium
- typo3TYPO3 Cross-Site Request Forgery in Log Module4.3 Medium
- papercut ngPaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution Vulnerability7.2 High
- orchidsoftware platformMethod Exposure Vulnerability in Modals in orchid/platform4.1 Medium
- sharp bp-30c25 firmware, bp-30c25t firmware, bp-30c25y firmware +324 more +326 moreSharp and Toshiba Tec MFPs provide configuration related APIs. They are expected to be called by...8.1 High
- moxa mxsecurity, mxsecurity series +1 moreMXsecurity License Generation Function Disclosure5.3 Medium
- avg internet securityLocal privilege escalation vulnerability in AVG Internet Security7.8 High
- baramundi management agentLocal privilege escalation vulnerability in baramundi Management Agent via MSI Installer7.8 High
- siemens sinec traffic analyzer, traffic analyzer +1 moreA vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions ...6.9 Medium
- parisneo parisneo/lollms-webui, lollms web ui +1 morePath Traversal and Denial of Service in parisneo/lollms-webui8.2 High
- d-link d-view, dlink d-view 8 +1 moreD-Link D-View execMonitorScript Exposed Dangerous Method Remote Code Execution Vulnerability8.8 High
- d-link d-view, dlink d-view 8, dir-3040 firmware +2 moreD-Link D-View queryDeviceCustomMonitorResult Exposed Dangerous Method Remote Code Execution Vulnerability8.8 High
- voltronic power viewpowerVoltronic Power ViewPower USBCommEx shutdown Exposed Dangerous Method Remote Code Execution Vulnerability8.8 High
- voltronic power viewpowerVoltronic Power ViewPower UpsScheduler Exposed Dangerous Method Remote Code Execution Vulnerability9.8 Critical
- voltronic power viewpowerVoltronic Power ViewPower LinuxMonitorConsole Exposed Dangerous Method Remote Code Execution Vulnerability9.8 Critical
- voltronic power viewpowerVoltronic Power ViewPower MacMonitorConsole Exposed Dangerous Method Remote Code Execution Vulnerability9.8 Critical
- voltronic power viewpowerVoltronic Power ViewPower MonitorConsole Exposed Dangerous Method Denial-of-Service Vulnerability7.5 High
- voltronic power viewpowerVoltronic Power ViewPower setShutdown Exposed Dangerous Method Local Privilege Escalation Vulnerability7.8 High
- voltronic power viewpowerVoltronic Power ViewPower MonitorConsole Exposed Dangerous Method Remote Code Execution Vulnerability9.8 Critical
- voltronic power viewpowerVoltronic Power ViewPower updateManagerPassword Exposed Dangerous Method Authentication Bypass Vulnerability9.8 Critical
- Show moreLoading…