CWE-668 · Exposure of Resource to Wrong Sphere (page 2)
Page 2 of 8 — CVEs classified under CWE-668, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-39553 | Medium | 6.5 | 2024-07-11 | An Exposure of Resource to Wrong Sphere vulnerability in the sampling service of Juniper Networks Junos OS Evolved allows an unauthenticated network-based atta… |
CVE-2024-38368 | Critical | 9.3 | 2024-07-01 | trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. A vulnerability affected older pods which migrated from the pre-2014 pu… |
CVE-2022-48757 | High | 7.1 | 2024-06-20 | In the Linux kernel, the following vulnerability has been resolved: net: fix information leakage in /proc/net/ptype In one net namespace, after creating a pa… |
CVE-2024-22333 | Low | 3.3 | 2024-06-13 | IBM Maximo Asset Management 7.6.1.3 and IBM Maximo Application Suite 8.10 and 8.11 allows web pages to be stored locally which can be read by another user on t… |
CVE-2024-5313 | Medium | 6.5 | 2024-06-12 | CWE-668: Exposure of the Resource Wrong Sphere vulnerability exists that exposes a SSH interface over the product network interface. This does not allow to dir… |
CVE-2023-5751 | High | 7.8 | 2024-06-04 | A local attacker with low privileges can read and modify any users files and cause a DoS in the working directory of the affected products due to exposure of r… |
CVE-2024-36033 | High | 7.1 | 2024-05-30 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix info leak when fetching board id Add the missing sanity check when fe… |
CVE-2024-36032 | High | 8.1 | 2024-05-30 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix info leak when fetching fw build id Add the missing sanity checks and… |
CVE-2023-52700 | Medium | 5.5 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved: tipc: fix kernel warning when sending SYN message When sending a SYN message, this kernel… |
CVE-2021-47401 | High | 7.1 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fix stack information leak The tty driver name is used also after registe… |
CVE-2024-21813 | High | 7.9 | 2024-05-16 | Exposure of resource to wrong sphere in some Intel(R) DTT software installers may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2024-35183 | Medium | 4.4 | 2024-05-15 | wolfictl is a command line tool for working with Wolfi. A git authentication issue in versions prior to 0.16.10 allows a local user’s GitHub token to be sent t… |
CVE-2023-39478 | High | 8.8 | 2024-05-03 | Softing Secure Integration Server Exposure of Resource to Wrong Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu… |
CVE-2023-6096 | High | 7.4 | 2024-04-26 | Vladimir Kononovich, a Security Researcher has found a flaw that using a inappropriate encryption logic on the DVR. firmware encryption is broken and allows t… |
CVE-2024-32473 | Medium | 4.7 | 2024-04-18 | Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes… |
CVE-2024-21605 | Medium | 6.5 | 2024-04-12 | An Exposure of Resource to Wrong Sphere vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX 300 Series allows an unauthenti… |
CVE-2024-29905 | High | 8.1 | 2024-04-09 | DIRAC is an interware, meaning a software framework for distributed computing. Prior to version 8.0.41, during the proxy generation process (e.g., when using `… |
CVE-2024-3019 | High | 8.8 | 2024-03-28 | A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the pr… |
CVE-2024-24562 | Medium | 5.4 | 2024-03-14 | vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issue has been addresse… |
CVE-2024-25153 | Critical | 9.8 | 2024-03-13 | A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ director… |
CVE-2021-46937 | Medium | 5.5 | 2024-02-27 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/dbgfs: fix 'struct pid' leaks in 'dbgfs_target_ids_write()' DAMON debugfs interf… |
CVE-2021-46935 | Medium | 5.5 | 2024-02-27 | In the Linux kernel, the following vulnerability has been resolved: binder: fix async_free_space accounting for empty parcels In 4.13, commit 74310e06be4d ("… |
CVE-2021-46923 | Medium | 5.5 | 2024-02-27 | In the Linux kernel, the following vulnerability has been resolved: fs/mount_setattr: always cleanup mount_kattr Make sure that finish_mount_kattr() is calle… |
CVE-2021-46921 | High | 7.8 | 2024-02-27 | In the Linux kernel, the following vulnerability has been resolved: locking/qrwlock: Fix ordering in queued_write_lock_slowpath() While this code is executed… |
CVE-2021-46917 | Medium | 5.5 | 2024-02-27 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix wq cleanup of WQCFG registers A pre-release silicon erratum workarou… |
CVE-2021-46906 | Medium | 5.5 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: fix info leak in hid_submit_ctrl In hid_submit_ctrl(), the way of calculatin… |
CVE-2023-7014 | Medium | 5.3 | 2024-02-05 | The Author Box, Guest Author and Co-Authors for Your Posts – Molongui plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up t… |
CVE-2023-50328 | Low | 3.7 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 may allow a remote attacker to view session identifiers passed via URL query strings. IBM X-Force ID: 275110. |
CVE-2024-21626 | High | 8.6 | 2024-01-31 | runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descrip… |
CVE-2023-7204 | High | 7.5 | 2024-01-29 | The WP STAGING WordPress Backup plugin before 3.2.0 allows access to cache files during the cloning process which provides |
CVE-2024-21597 | Medium | 5.3 | 2024-01-12 | An Exposure of Resource to Wrong Sphere vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows an unauthenticate… |
CVE-2024-0443 | Medium | 5.5 | 2024-01-12 | A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem. When a cgroup is be… |
CVE-2024-20694 | Medium | 5.5 | 2024-01-09 | Windows CoreMessaging Information Disclosure Vulnerability |
CVE-2024-20692 | Medium | 5.7 | 2024-01-09 | Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability |
CVE-2023-48291 | Medium | 4.3 | 2023-12-21 | Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a re… |
CVE-2023-49347 | Medium | 6.0 | 2023-12-14 | Temporary data passed between application components by Budgie Extras Windows Previews could potentially be viewed or manipulated. The data is stored in a loca… |
CVE-2023-49346 | Medium | 6.0 | 2023-12-14 | Temporary data passed between application components by Budgie Extras WeatherShow applet could potentially be viewed or manipulated. The data is stored in a lo… |
CVE-2023-49345 | Medium | 6.0 | 2023-12-14 | Temporary data passed between application components by Budgie Extras Takeabreak applet could potentially be viewed or manipulated. The data is stored in a loc… |
CVE-2023-49344 | Medium | 6.0 | 2023-12-14 | Temporary data passed between application components by Budgie Extras Window Shuffler applet could potentially be viewed or manipulated. The data is stored in… |
CVE-2023-49343 | Medium | 6.0 | 2023-12-14 | Temporary data passed between application components by Budgie Extras Dropby applet could potentially be viewed or manipulated. The data is stored in a locatio… |
CVE-2023-49342 | Medium | 6.0 | 2023-12-14 | Temporary data passed between application components by Budgie Extras Clockworks applet could potentially be viewed or manipulated. The data is stored in a loc… |
CVE-2023-41120 | Medium | 6.5 | 2023-12-12 | An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15… |
CVE-2023-39171 | High | 7.2 | 2023-12-07 | SENEC Storage Box V1,V2 and V3 accidentially expose a management UI accessible with publicly known admin credentials. |
CVE-2023-42718 | Medium | 5.5 | 2023-12-04 | In dialer, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosu… |
CVE-2023-42717 | High | 7.5 | 2023-12-04 | In telephony service, there is a possible missing permission check. This could lead to remote information disclosure no additional execution privileges needed |
CVE-2023-42716 | High | 7.5 | 2023-12-04 | In telephony service, there is a possible missing permission check. This could lead to remote information disclosure no additional execution privileges needed |
CVE-2023-42715 | Medium | 5.5 | 2023-12-04 | In telephony service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges nee… |
CVE-2023-41786 | Medium | 6.8 | 2023-11-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pandora FMS on all allows File Discovery. This vulnerability allows users with low… |
CVE-2023-36013 | Medium | 6.5 | 2023-11-20 | PowerShell Information Disclosure Vulnerability |
CVE-2023-36043 | Medium | 6.5 | 2023-11-14 | Open Management Infrastructure Information Disclosure Vulnerability |
CVE-2023-5545 | Low | 3.3 | 2023-11-09 | H5P metadata automatically populated the author with the user's username, which could be sensitive information. |
CVE-2023-5542 | Low | 3.3 | 2023-11-09 | Students in "Only see own membership" groups could see other students in the group, which should be hidden. |
CVE-2023-42551 | Medium | 5.5 | 2023-11-07 | Use of implicit intent for sensitive communication vulnerability in startTncActivity in Samsung Account prior to version 14.5.00.7 allows attackers to access a… |
CVE-2023-42549 | Medium | 5.5 | 2023-11-07 | Use of implicit intent for sensitive communication vulnerability in startNameValidationActivity in Samsung Account prior to version 14.5.00.7 allows attackers… |
CVE-2023-42547 | Medium | 5.5 | 2023-11-07 | Use of implicit intent for sensitive communication vulnerability in startEmailValidationActivity in Samsung Account prior to version 14.5.00.7 allows attackers… |
CVE-2023-42546 | Medium | 5.5 | 2023-11-07 | Use of implicit intent for sensitive communication vulnerability in startAgreeToDisclaimerActivity in Samsung Account prior to version 14.5.00.7 allows attacke… |
CVE-2023-4910 | Medium | 5.5 | 2023-11-06 | A flaw was found In 3Scale Admin Portal. If a user logs out from the personal tokens page and then presses the back button in the browser, the tokens page is r… |
CVE-2023-4217 | Low | 3.1 | 2023-11-02 | A vulnerability has been identified in PT-G503 Series versions prior to v5.2, where the session cookies attribute is not set properly in the affected applicati… |
CVE-2023-3972 | High | 7.8 | 2023-11-01 | A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and director… |
CVE-2023-2622 | Low | 2.7 | 2023-11-01 | Authenticated clients can read arbitrary files on the MAIN Computer system using the remote procedure call (RPC) of the InspectSetup service endpoint. The low… |
CVE-2023-38994 | High | 7.9 | 2023-10-31 | The 'check_univention_joinstatus' prometheus monitoring script (and other scripts) in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in… |
CVE-2023-37911 | Medium | 6.5 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 9.4-rc-1 and prior to versions 14… |
CVE-2023-45145 | Low | 3.6 | 2023-10-18 | Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided… |
CVE-2023-45911 | Critical | 9.8 | 2023-10-18 | An issue in WIPOTEC GmbH ComScale v4.3.29.21344 and v4.4.12.723 allows unauthenticated attackers to login as any user without a password. |
CVE-2023-45357 | Medium | 4.3 | 2023-10-17 | Archer Platform 6.x before 6.13 P2 HF2 (6.13.0.2.2) contains a sensitive information disclosure vulnerability. An authenticated attacker could potentially obta… |
CVE-2023-44394 | Medium | 4.3 | 2023-10-16 | MantisBT is an open source bug tracker. Due to insufficient access-level checks on the Wiki redirection page, any user can reveal private Projects' names, by a… |
CVE-2023-35013 | Low | 2.3 | 2023-10-16 | IBM Security Verify Governance 10.0, Identity Manager could allow a local privileged user to obtain sensitive information from source code. IBM X-Force ID: 2… |
CVE-2023-42792 | Medium | 6.5 | 2023-10-14 | Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a re… |
CVE-2023-32275 | Medium | 5.5 | 2023-10-12 | An information disclosure vulnerability exists in the CtEnumCa() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. Specially crafted network packets… |
CVE-2023-44102 | Medium | 5.3 | 2023-10-11 | Broadcast permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability can cause the Bluetooth function to be unavail… |
CVE-2023-44101 | High | 7.5 | 2023-10-11 | The Bluetooth module has a vulnerability in permission control for broadcast notifications.Successful exploitation of this vulnerability may affect confidentia… |
CVE-2023-36596 | High | 7.5 | 2023-10-10 | Remote Procedure Call Information Disclosure Vulnerability |
CVE-2023-36429 | Medium | 6.5 | 2023-10-10 | Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability |
CVE-2023-30802 | Medium | 5.3 | 2023-10-10 | The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to a source code disclosure vulnerability. A remote and unauthenticated attacker can… |
CVE-2023-44124 | Medium | 6.1 | 2023-09-27 | The vulnerability is to theft of arbitrary files with system privilege in the Screen recording ("com.lge.gametools.gamerecorder") app in the "com/lge/gametools… |
CVE-2023-44122 | Medium | 6.1 | 2023-09-27 | The vulnerability is to theft of arbitrary files with system privilege in the LockScreenSettings ("com.lge.lockscreensettings") app in the "com/lge/lockscreens… |
CVE-2023-43784 | High | 7.5 | 2023-09-22 | Plesk Onyx 17.8.11 has accessKeyId and secretAccessKey fields that are related to an Amazon AWS Firehose component. NOTE: the vendor's position is that there i… |
CVE-2023-43783 | High | 7.5 | 2023-09-22 | Cadence through 0.9.2 2023-08-21 uses an Insecure /tmp/cadence-wineasio.reg Temporary File. The filename is used even if it has been created by a local adversa… |
CVE-2023-43782 | Medium | 5.5 | 2023-09-22 | Cadence through 0.9.2 2023-08-21 uses an Insecure /tmp/.cadence-aloop-daemon.x Temporary File. The file is used even if it has been created by a local adversar… |
CVE-2023-31014 | Medium | 4.2 | 2023-09-20 | NVIDIA GeForce Now for Android contains a vulnerability in the game launcher component, where a malicious application on the same device can process the implic… |
CVE-2023-40788 | Medium | 5.3 | 2023-09-19 | SpringBlade <=V3.6.0 is vulnerable to Incorrect Access Control due to incorrect configuration in the default gateway resulting in unauthorized access to error… |
CVE-2023-39056 | Medium | 6.5 | 2023-09-18 | An information leak in Coffee-jumbo v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39049 | Medium | 6.5 | 2023-09-18 | An information leak in youmart-tokunaga v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39046 | Medium | 6.5 | 2023-09-18 | An information leak in TonTon-Tei_waiting Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39058 | Medium | 6.5 | 2023-09-18 | An information leak in THE_B_members card v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39043 | Medium | 6.5 | 2023-09-18 | An information leak in YKC Tokushima_awayokocho Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39040 | Medium | 6.5 | 2023-09-18 | An information leak in Cheese Cafe Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39039 | Medium | 6.5 | 2023-09-18 | An information leak in Camp Style Project Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2022-20917 | Medium | 4.3 | 2023-09-15 | A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) message processing feature of Cisco Jabber could allow an authenticated, remote attack… |
CVE-2023-38558 | Medium | 5.5 | 2023-09-14 | A vulnerability has been identified in SIMATIC PCS neo (Administration Console) V4.0 (All versions), SIMATIC PCS neo (Administration Console) V4.0 Update 1 (Al… |
CVE-2023-38152 | Medium | 5.3 | 2023-09-12 | DHCP Server Service Information Disclosure Vulnerability |
CVE-2023-24965 | Medium | 5.8 | 2023-09-08 | IBM Aspera Faspex 5.0.5 does not restrict or incorrectly restricts access to a resource from an unauthorized actor. IBM X-Force ID: 246713. |
CVE-2023-41745 | Medium | 5.5 | 2023-08-31 | Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Agent (Linux, macOS, Windows)… |
CVE-2023-41742 | High | 7.5 | 2023-08-31 | Excessive attack surface due to binding to an unrestricted IP address. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build… |
CVE-2023-34725 | Medium | 6.8 | 2023-08-28 | An issue was discovered in TechView LA-5570 Wireless Gateway 1.0.19_T53, allows physical attackers to gain escalated privileges via a telnet connection. |
CVE-2023-4230 | Medium | 5.3 | 2023-08-24 | A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which has the potential to facilitate the collecti… |
CVE-2023-39974 | Medium | 5.3 | 2023-08-17 | Exposure of Sensitive Information vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized actors to get the number of subscribers i… |
CVE-2023-39250 | High | 7.8 | 2023-08-16 | Dell Storage Integration Tools for VMware (DSITV) and Dell Storage vSphere Client Plugin (DSVCP) versions prior to 6.1.1 and Replay Manager for VMware (RMSV… |
CVE-2023-2916 | High | 7.5 | 2023-08-15 | The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' func… |
CVE-2023-39383 | High | 7.5 | 2023-08-13 | Vulnerability of input parameters being not strictly verified in the AMS module. Successful exploitation of this vulnerability may compromise apps' data securi… |