CWE-610 · Externally Controlled Reference to a Resource in Another Sphere (page 2)
Page 2 of 3 — CVEs classified under CWE-610, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-44209 | High | 7.8 | 2023-10-04 | Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) b… |
CVE-2023-32615 | Medium | 6.5 | 2023-09-05 | A file write vulnerability exists in the OAS Engine configuration functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted serie… |
CVE-2023-4704 | Medium | 4.9 | 2023-09-01 | External Control of System or Configuration Setting in GitHub repository instantsoft/icms2 prior to 2.16.1-git. |
CVE-2022-46869 | High | 7.8 | 2023-08-31 | Local privilege escalation during installation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Wind… |
CVE-2022-46868 | High | 7.8 | 2023-08-31 | Local privilege escalation during recovery due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows)… |
CVE-2023-35838 | Medium | 5.7 | 2023-08-09 | The WireGuard client 0.5.3 on Windows insecurely configures the operating system and firewall such that traffic to a local network that uses non-RFC1918 IP add… |
CVE-2023-37856 | Medium | 4.3 | 2023-08-09 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the devi… |
CVE-2023-37855 | Medium | 4.3 | 2023-08-09 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the devi… |
CVE-2023-38046 | Medium | 5.5 | 2023-07-12 | A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated administrator with the privilege to commit a specifically created co… |
CVE-2023-3256 | High | 8.8 | 2023-06-22 | Advantech R-SeeNet versions 2.4.22 allows low-level users to access and load the content of local files. |
CVE-2023-33188 | Medium | 6.3 | 2023-05-27 | Omni-notes is an open source note-taking application for Android. The Omni-notes Android app had an insufficient path validation vulnerability when displaying… |
CVE-2023-32076 | Medium | 5.5 | 2023-05-10 | in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior… |
CVE-2023-0008 | Medium | 4.4 | 2023-05-10 | A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to exp… |
CVE-2023-30943 | Medium | 6.5 | 2023-05-02 | The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user… |
CVE-2023-0045 | Medium | 4.7 | 2023-04-25 | The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set function updates the Thread Informatio… |
CVE-2023-21097 | High | 7.8 | 2023-04-19 | In toUriInner of Intent.java, there is a possible way to launch an arbitrary activity due to a confused deputy. This could lead to local escalation of privileg… |
CVE-2023-2152 | Medium | 5.3 | 2023-04-18 | A vulnerability has been found in SourceCodester Student Study Center Desk Management System 1.0 and classified as critical. Affected by this vulnerability is… |
CVE-2023-22616 | High | 7.8 | 2023-04-12 | An issue was discovered in Insyde InsydeH2O with kernel 5.2 through 5.5. The Save State register is not checked before use. The IhisiSmm driver does not check… |
CVE-2023-20964 | High | 7.8 | 2023-03-24 | In multiple functions of MediaSessionRecord.java, there is a possible Intent rebroadcast due to a confused deputy. This could lead to local denial of service o… |
CVE-2023-0003 | Medium | 6.5 | 2023-02-08 | A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read l… |
CVE-2022-43513 | High | 8.2 | 2023-01-10 | A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 Upd4), TeleControl… |
CVE-2014-125044 | Medium | 6.3 | 2023-01-05 | A vulnerability, which was classified as critical, was found in soshtolsus wing-tight. This affects an unknown part of the file index.php. The manipulation of… |
CVE-2022-34669 | High | 8.8 | 2022-12-30 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can access or modify system files or… |
CVE-2022-3032 | Medium | 6.5 | 2022-12-22 | When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute to define the inner HTML document, remot… |
CVE-2022-20550 | High | 7.8 | 2022-12-16 | In Multiple Locations, there is a possibility to launch arbitrary protected activities due to a confused deputy. This could lead to local escalation of privile… |
CVE-2022-20515 | Medium | 5.5 | 2022-12-16 | In onPreferenceClick of AccountTypePreferenceLoader.java, there is a possible way to retrieve protected files from the Settings app due to a confused deputy. T… |
CVE-2022-20199 | Medium | 5.5 | 2022-12-16 | In multiple locations of NfcService.java, there is a possible disclosure of NFC tags due to a confused deputy. This could lead to local information disclosure… |
CVE-2022-45918 | Medium | 6.5 | 2022-12-07 | ILIAS before 7.16 allows External Control of File Name or Path. |
CVE-2022-42893 | High | 7.5 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation wit… |
CVE-2022-42891 | High | 7.5 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation wit… |
CVE-2022-42734 | High | 7.5 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation wit… |
CVE-2022-42733 | High | 7.5 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation wit… |
CVE-2022-42732 | High | 7.5 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation wit… |
CVE-2022-44747 | High | 7.8 | 2022-11-07 | Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40… |
CVE-2022-43428 | Medium | 5.3 | 2022-10-19 | Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing a… |
CVE-2022-43423 | Medium | 5.3 | 2022-10-19 | Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier implements an agent/controller message that does not limit where it… |
CVE-2021-27406 | High | 8.8 | 2022-10-14 | An attacker can take leverage on PerFact OpenVPN-Client versions 1.4.1.0 and prior to send the config command from any application running on the local host ma… |
CVE-2022-39206 | Critical | 9.9 | 2022-09-13 | Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. When using Docker-based job executors, the Docker socket (e.g. /var/run/docker.sock on… |
CVE-2022-27593 | Critical | 10.0 | 2022-09-08 | An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an at… |
CVE-2022-2633 | High | 7.5 | 2022-09-06 | The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found… |
CVE-2022-2431 | High | 8.1 | 2022-09-06 | The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to insufficient file ty… |
CVE-2022-2638 | Medium | 6.5 | 2022-08-29 | The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be the CSV file. This c… |
CVE-2022-32761 | Medium | 6.5 | 2022-08-22 | An information disclosure vulnerability exists in the aVideoEncoderReceiveImage functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-c… |
CVE-2022-28710 | Medium | 6.5 | 2022-08-22 | An information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP requ… |
CVE-2022-20319 | High | 7.8 | 2022-08-12 | In DreamServices, there is a possible way to launch arbitrary protected activities due to a confused deputy. This could lead to local escalation of privilege w… |
CVE-2022-20239 | Critical | 9.8 | 2022-08-10 | remap_pfn_range' here may map out of size kernel memory (for example, may map the kernel area), and because the 'vma->vm_page_prot' can also be controlled by u… |
CVE-2016-0796 | High | 7.5 | 2022-07-28 | WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and security bypass vul… |
CVE-2015-10003 | Medium | 4.3 | 2022-07-17 | A vulnerability, which was classified as problematic, was found in FileZilla Server up to 0.9.50. This affects an unknown part of the component PORT Handler. T… |
CVE-2022-30245 | Medium | 6.5 | 2022-07-15 | Honeywell Alerton Compass Software 1.6.5 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the co… |
CVE-2022-20223 | High | 7.8 | 2022-07-13 | In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due to a confused deputy… |
CVE-2021-3779 | Medium | 6.5 | 2022-06-28 | A malicious MySQL server can request local file content from a client using ruby-mysql prior to version 2.10.0 without explicit authorization from the user. Th… |
CVE-2022-24241 | High | 7.5 | 2022-06-02 | ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp. |
CVE-2022-20789 | Medium | 4.9 | 2022-04-21 | A vulnerability in the software upgrade process of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Managemen… |
CVE-2022-24854 | High | 8.0 | 2022-04-14 | Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called `ATTACH DATABASE`, which allows connecting mu… |
CVE-2021-39787 | High | 7.8 | 2022-03-30 | In SystemUI, there is a possible arbitrary Activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execut… |
CVE-2021-39765 | Medium | 5.5 | 2022-03-30 | In Gallery, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with User execution privileges need… |
CVE-2021-39707 | High | 7.8 | 2022-03-16 | In onReceive of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due to a confused deputy. This could lead to lo… |
CVE-2021-39703 | High | 7.8 | 2022-03-16 | In updateState of UsbDeviceManager.java, there is a possible unauthorized access of files due to a confused deputy. This could lead to local escalation of priv… |
CVE-2021-39668 | High | 7.8 | 2022-02-11 | In onActivityViewReady of DetailDialog.kt, there is a possible Intent Redirect due to a confused deputy. This could lead to local escalation of privilege that… |
CVE-2021-39663 | High | 7.8 | 2022-02-11 | In openFileAndEnforcePathPermissionsHelper of MediaProvider.java, there is a possible bypass of a permissions check due to a confused deputy. This could lead t… |
CVE-2021-39626 | High | 7.8 | 2022-01-14 | In onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of pr… |
CVE-2021-1035 | High | 7.8 | 2022-01-14 | In setLaunchIntent of BluetoothDevicePickerPreferenceController.java, there is a possible way to invoke an arbitrary broadcast receiver due to a confused deput… |
CVE-2021-3845 | High | 7.5 | 2022-01-04 | ws-scrcpy is vulnerable to External Control of File Name or Path |
CVE-2021-43844 | High | 8.8 | 2021-12-20 | MSEdgeRedirect is a tool to redirect news, search, widgets, weather, and more to a user's default browser. MSEdgeRedirect versions before 0.5.0.1 are vulnerabl… |
CVE-2021-1003 | High | 7.8 | 2021-12-15 | In adjustStreamVolume of AudioService.java, there is a possible way for unprivileged app to change audio stream volume due to a confused deputy. This could lea… |
CVE-2021-44041 | Critical | 9.8 | 2021-12-14 | UiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path supplied to the --dev-widget argument of the URI handler for uipath-a… |
CVE-2021-43794 | Medium | 5.3 | 2021-12-01 | Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the… |
CVE-2021-43685 | Critical | 9.8 | 2021-12-01 | libretime hv3.0.0-alpha.10 is affected by a path manipulation vulnerability in /blob/master/legacy/application/modules/rest/controllers/ShowImageController.php… |
CVE-2021-41244 | Critical | 9.1 | 2021-11-15 | Grafana is an open-source platform for monitoring and observability. In affected versions when the fine-grained access control beta feature is enabled and ther… |
CVE-2021-0708 | High | 7.8 | 2021-10-22 | In runDumpHeap of ActivityManagerShellCommand.java, there is a possible deletion of system files due to a confused deputy. This could lead to local escalation… |
CVE-2021-25740 | Low | 3.1 | 2021-09-20 | A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a conf… |
CVE-2020-8561 | Medium | 4.1 | 2021-09-20 | A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration request… |
CVE-2021-0593 | High | 7.8 | 2021-08-17 | In sendDevicePickedIntent of DevicePickerFragment.java, there is a possible way to invoke a privileged broadcast receiver due to a confused deputy. This could… |
CVE-2021-0591 | High | 7.3 | 2021-08-17 | In sendReplyIntentToReceiver of BluetoothPermissionActivity.java, there is a possible way to invoke privileged broadcast receivers due to a confused deputy. Th… |
CVE-2020-21363 | Medium | 6.5 | 2021-08-11 | An arbitrary file deletion vulnerability exists within Maccms10. |
CVE-2020-23171 | Medium | 5.5 | 2021-08-10 | A vulnerability in all versions of Nim-lang allows unauthenticated attackers to write files to arbitrary directories via a crafted zip file with dot-slash char… |
CVE-2021-32578 | High | 7.8 | 2021-08-05 | Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to improper soft link handling (issue 2 of 2). |
CVE-2021-32576 | High | 7.8 | 2021-08-05 | Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to improper soft link handling (issue 1 of 2). |
CVE-2021-32783 | High | 8.5 | 2021-07-23 | Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service may be used to acc… |
CVE-2021-32773 | Medium | 6.1 | 2021-07-20 | Racket is a general-purpose programming language and an ecosystem for language-oriented programming. In versions prior to 8.2, code evaluated using the Racket… |
CVE-2021-0599 | Medium | 5.5 | 2021-07-14 | In scheduleTimeoutLocked of NotificationRecord.java, there is a possible disclosure of a sensitive identifier via broadcasted intent due to a confused deputy… |
CVE-2021-26920 | Medium | 6.5 | 2021-07-02 | In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to… |
CVE-2021-29965 | Medium | 5.3 | 2021-06-24 | A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the currently ac… |
CVE-2021-0608 | High | 7.8 | 2021-06-22 | In handleAppLaunch of AppLaunchActivity.java, there is a possible arbitrary activity launch due to a confused deputy. This could lead to local escalation of pr… |
CVE-2021-0550 | High | 7.8 | 2021-06-22 | In onLoadFailed of AnnotateActivity.java, there is a possible way to gain WRITE_EXTERNAL_STORAGE permissions without user consent due to a confused deputy. Thi… |
CVE-2021-0536 | High | 7.8 | 2021-06-22 | In dropFile of WiFiInstaller, there is a way to delete files accessible to CertInstaller due to a confused deputy. This could lead to local escalation of privi… |
CVE-2021-1306 | Medium | 4.4 | 2021-05-22 | A vulnerability in the restricted shell of Cisco Evolved Programmable Network (EPN) Manager, Cisco Identity Services Engine (ISE), and Cisco Prime Infrastructu… |
CVE-2021-27648 | Critical | 9.0 | 2021-04-28 | Externally controlled reference to a resource in another sphere in quarantine functionality in Synology Antivirus Essential before 1.4.8-2801 allows remote aut… |
CVE-2021-30245 | High | 8.8 | 2021-04-15 | The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks. The problem has existed since about 2006 an… |
CVE-2021-27183 | High | 7.2 | 2021-04-14 | An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to exploit an Arbitrary File Write vulnerability. An attacker is… |
CVE-2020-25161 | High | 8.8 | 2021-02-23 | The WADashboard component of WebAccess/SCADA Versions 9.0 and prior may allow an attacker to control or influence a path used in an operation on the filesystem… |
CVE-2021-26711 | Medium | 5.3 | 2021-02-05 | A frame-injection issue in the online help in Redwood Report2Web 4.3.4.5 allows remote attackers to render an external resource inside a frame via the help/Onl… |
CVE-2020-6105 | High | 7.8 | 2020-10-15 | An exploitable code execution vulnerability exists in the multiple devices functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can… |
CVE-2020-0345 | High | 7.8 | 2020-09-17 | In DocumentsUI, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution p… |
CVE-2020-0267 | High | 7.8 | 2020-09-17 | In WindowManager, there is a possible launch of an unexpected app due to a confused deputy. This could lead to local escalation of privilege due to launching a… |
CVE-2018-12475 | Medium | 6.5 | 2020-09-01 | A Externally Controlled Reference to a Resource in Another Sphere vulnerability in obs-service-download_files of openSUSE Open Build Service allows authenticat… |
CVE-2020-8226 | Medium | 5.8 | 2020-08-17 | A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image dimensions check to be used to SSRF. |
CVE-2020-5412 | Medium | 6.5 | 2020-08-07 | Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashbo… |
CVE-2020-8553 | Medium | 5.9 | 2020-07-29 | The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to ov… |
CVE-2020-14057 | Critical | 9.8 | 2020-07-01 | Monsta FTP 2.10.1 or below allows external control of paths used in filesystem operations. This allows attackers to read and write arbitrary local files, allow… |