CWE-441 · Unintended Proxy or Intermediary (Confused Deputy) (page 2)
Page 2 of 2 — CVEs classified under CWE-441, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-30128 | High | 8.6 | 2024-09-25 | HCL Nomad server on Domino is affected by an open proxy vulnerability in which an unauthenticated attacker can mask their original source IP address. This may… |
CVE-2024-31319 | High | 7.8 | 2024-07-09 | In updateNotificationChannelFromPrivilegedListener of NotificationManagerService.java, there is a possible cross-user data leak due to a confused deputy. This… |
CVE-2024-34068 | Medium | 6.4 | 2024-05-03 | Pterodactyl wings is the server control plane for Pterodactyl Panel. An authenticated user who has access to a game server is able to bypass the previously imp… |
CVE-2023-40111 | High | 7.8 | 2024-02-15 | In setMediaButtonReceiver of MediaSessionRecord.java, there is a possible way to send a pending intent on behalf of system_server due to a confused deputy. Thi… |
CVE-2023-33188 | Medium | 6.3 | 2023-05-27 | Omni-notes is an open source note-taking application for Android. The Omni-notes Android app had an insufficient path validation vulnerability when displaying… |
CVE-2023-21082 | Medium | 5.5 | 2023-04-19 | In getNumberFromCallIntent of NewOutgoingCallIntentBroadcaster.java, there is a possible way to enumerate other user's contact phone number due to a confused d… |
CVE-2022-39361 | High | 8.8 | 2022-10-26 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, H2 (Sample Database) could allow… |
CVE-2022-39349 | Medium | 5.5 | 2022-10-25 | The Tasks.org Android app is an open-source app for to-do lists and reminders. The Tasks.org app uses the activity `ShareLinkActivity.kt` to handle "share" int… |
CVE-2015-10003 | Medium | 4.3 | 2022-07-17 | A vulnerability, which was classified as problematic, was found in FileZilla Server up to 0.9.50. This affects an unknown part of the component PORT Handler. T… |
CVE-2021-20042 | Critical | 9.8 | 2021-12-08 | An unauthenticated remote attacker can use SMA 100 as an unintended proxy or intermediary undetectable proxy to bypass firewall rules. This vulnerability affec… |
CVE-2021-25740 | Low | 3.1 | 2021-09-20 | A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a conf… |
CVE-2020-8561 | Medium | 4.1 | 2021-09-20 | A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration request… |
CVE-2021-32783 | High | 8.5 | 2021-07-23 | Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service may be used to acc… |
CVE-2021-32773 | Medium | 6.1 | 2021-07-20 | Racket is a general-purpose programming language and an ecosystem for language-oriented programming. In versions prior to 8.2, code evaluated using the Racket… |
CVE-2020-26262 | High | 7.2 | 2021-01-13 | Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to… |
CVE-2020-5412 | Medium | 6.5 | 2020-08-07 | Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashbo… |
CVE-2019-3996 | Medium | 6.5 | 2019-12-17 | ELOG 3.1.4-57bea22 and below can be used as an HTTP GET request proxy when unauthenticated remote attackers send crafted HTTP POST requests. |
CVE-2019-1841 | Medium | 6.5 | 2019-04-18 | A vulnerability in the Software Image Management feature of Cisco DNA Center could allow an authenticated, remote attacker to access to internal services witho… |
CVE-2018-12182 | Medium | 6.7 | 2019-03-27 | Insufficient memory write check in SMM service for EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure… |
CVE-2019-3924 | High | 7.5 | 2019-02-20 | MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. The software will execute user defined networ… |
CVE-2018-16598 | Medium | 5.9 | 2018-12-06 | An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middlewar… |
CVE-2018-1999038 | Medium | 4.2 | 2018-08-01 | A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that allows attackers to ha… |
CVE-2015-2947 | Critical | 9.1 | 2017-04-13 | KanColleViewer versions 3.8.1 and earlier operates as an open proxy which allows remote attackers to trigger outbound network traffic. |