CWE-668 · Exposure of Resource to Wrong Sphere (page 3)
Page 3 of 8 — CVEs classified under CWE-668, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-38830 | High | 7.5 | 2023-08-10 | An information leak in PHPJabbers Yacht Listing Script v1.0 allows attackers to export clients' credit card numbers from the Reservations module. |
CVE-2023-39214 | High | 7.6 | 2023-08-08 | Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial of service via network access. |
CVE-2023-38955 | High | 7.5 | 2023-08-03 | ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices, including their IP addresses and device… |
CVE-2023-33368 | Medium | 6.5 | 2023-08-03 | Some API routes exists in Control ID IDSecure 4.7.26.0 and prior, exfiltrating sensitive information and passwords to users accessing these API routes. |
CVE-2023-3670 | High | 7.3 | 2023-07-28 | In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local acce… |
CVE-2023-39155 | Medium | 5.3 | 2023-07-26 | Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it. |
CVE-2022-46901 | High | 7.5 | 2023-07-25 | An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is an Access Control Violation for Database Operations. The Vocera Repo… |
CVE-2023-34189 | Medium | 6.5 | 2023-07-25 | Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The… |
CVE-2023-37645 | Medium | 5.3 | 2023-07-20 | eyoucms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom_model_path/recruit.filelist.txt. |
CVE-2023-3299 | Low | 3.4 | 2023-07-20 | HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1… |
CVE-2023-32760 | High | 7.7 | 2023-07-14 | An issue in Archer Platform before v.6.13 fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to obtain sensitive information via API calls relat… |
CVE-2023-32759 | High | 7.5 | 2023-07-14 | An issue in Archer Platform before v.6.13 and fixed in 6.12.0.6 and 6.13.0 allows an authenticated attacker to obtain sensitive information via a crafted URL. |
CVE-2023-37599 | High | 7.5 | 2023-07-13 | An issue in issabel-pbx v.4.0.0-6 allows a remote attacker to obtain sensitive information via the modules directory |
CVE-2023-34119 | High | 8.2 | 2023-07-11 | Insecure temporary file in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege… |
CVE-2023-31818 | High | 7.5 | 2023-07-11 | An issue found in Marukyu Line v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp function. |
CVE-2023-30960 | Medium | 4.3 | 2023-07-10 | A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not have access to. This d… |
CVE-2023-3270 | High | 8.6 | 2023-07-10 | Exposure of Sensitive Information to an Unauthorized Actor in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive informatio… |
CVE-2023-35696 | High | 7.5 | 2023-07-10 | Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the device via HTTP reque… |
CVE-2023-3456 | Medium | 5.3 | 2023-07-06 | Vulnerability of kernel raw address leakage in the hang detector module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-3455 | Critical | 9.1 | 2023-07-05 | Key management vulnerability on system. Successful exploitation of this vulnerability may affect service availability and integrity. |
CVE-2023-32613 | High | 8.1 | 2023-06-30 | Exposure of resource to wrong sphere issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow a network-adjacent attacker to use functio… |
CVE-2023-32394 | Low | 2.4 | 2023-06-23 | The issue was addressed with improved checks. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, tvOS 16.5, macOS Ventura 13.4. A person with physic… |
CVE-2023-35151 | High | 7.5 | 2023-06-23 | XWiki Platform is a generic wiki platform. Starting in version 7.3-milestone-1 and prior to versions 14.4.8, 14.10.6, and 15.1, ny user can call a REST endpoin… |
CVE-2023-34467 | High | 7.5 | 2023-06-23 | XWiki Platform is a generic wiki platform. Starting in version 3.5-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, the mail obfuscation confi… |
CVE-2023-2820 | Medium | 6.1 | 2023-06-14 | An information disclosure vulnerability in the faye endpoint in Proofpoint Threat Response / Threat Response Auto-Pull (PTR/TRAP) could be used by an attacker… |
CVE-2023-32019 | Medium | 4.7 | 2023-06-14 | Windows Kernel Information Disclosure Vulnerability |
CVE-2023-29355 | Medium | 5.3 | 2023-06-14 | DHCP Server Service Information Disclosure Vulnerability |
CVE-2023-34250 | Medium | 4.8 | 2023-06-13 | Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branche… |
CVE-2023-34114 | High | 7.4 | 2023-06-13 | Exposure of resource to wrong sphere in Zoom for Windows and Zoom for MacOS clients before 5.14.10 may allow an authenticated user to potentially enable infor… |
CVE-2022-43684 | Critical | 9.9 | 2023-06-13 | ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow Core functionality. Additional Details … |
CVE-2023-29403 | High | 7.8 | 2023-06-08 | On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as… |
CVE-2023-33510 | High | 7.5 | 2023-06-07 | Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters. |
CVE-2023-32550 | Critical | 9.3 | 2023-06-06 | Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further… |
CVE-2022-40525 | High | 7.1 | 2023-06-06 | Information disclosure in Linux Networking Firmware due to unauthorized information leak during side channel analysis. |
CVE-2022-40523 | High | 7.1 | 2023-06-06 | Information disclosure in Kernel due to indirect branch misprediction. |
CVE-2023-33518 | Medium | 5.3 | 2023-06-05 | emoncms v11 and later was discovered to contain an information disclosure vulnerability which allows attackers to obtain the web directory path and other infor… |
CVE-2023-29538 | Medium | 4.3 | 2023-06-02 | Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-extension:///</code> URI during a load req… |
CVE-2023-25750 | Medium | 4.3 | 2023-06-02 | Under certain circumstances, a ServiceWorker's offline cache may have leaked to the file system when using private browsing mode. This vulnerability affects Fi… |
CVE-2023-2062 | Medium | 6.2 | 2023-06-02 | Missing Password Field Masking vulnerability in Mitsubishi Electric Corporation EtherNet/IP configuration tools SW1DNN-EIPCT-BD and SW1DNN-EIPCTFX5-BD allows a… |
CVE-2023-28344 | High | 7.1 | 2023-05-31 | An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application allows unauthenticated attackers to view constantly… |
CVE-2023-2703 | High | 7.5 | 2023-05-23 | Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Finex Media Competition Management System allows Retrieve Embedded Sensitive… |
CVE-2023-33293 | Medium | 5.3 | 2023-05-22 | An issue was discovered in KaiOS 3.0 and 3.1. The binary /system/kaios/api-daemon exposes a local web server on *.localhost with subdomains for each installed… |
CVE-2023-31103 | High | 7.5 | 2023-05-22 | Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Att… |
CVE-2023-31206 | High | 7.5 | 2023-05-22 | Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Atta… |
CVE-2023-2025 | Medium | 5.0 | 2023-05-18 | OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 may expose sensitive information to an unauthorized user under certain circumstances. |
CVE-2023-23448 | Medium | 5.3 | 2023-05-15 | Inclusion of Sensitive Information in Source Code in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 a… |
CVE-2023-29820 | Medium | 5.5 | 2023-05-12 | An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to access sensitive information via the EXE… |
CVE-2023-27564 | High | 7.5 | 2023-05-10 | The n8n package 0.218.0 for Node.js allows Information Disclosure. |
CVE-2022-40210 | Medium | 6.8 | 2023-05-10 | Exposure of data element to wrong session in the Intel DCM software before version 5.0.1 may allow an authenticated user to potentially enable escalation of pr… |
CVE-2022-38087 | Medium | 4.1 | 2023-05-10 | Exposure of resource to wrong sphere in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via… |
CVE-2023-2069 | Medium | 6.4 | 2023-05-03 | An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.10.7, all versions s… |
CVE-2023-0485 | Medium | 6.5 | 2023-05-03 | An issue has been discovered in GitLab affecting all versions starting from 13.11 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions st… |
CVE-2023-22307 | Medium | 5.5 | 2023-04-18 | Sensitive data exposure in Webconf in Tribe29 Checkmk Appliance before 1.6.4 allows local attacker to retrieve passwords via reading log files. |
CVE-2023-27976 | High | 8.8 | 2023-04-18 | A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause remote code execution when a valid user visits a malicious link provided… |
CVE-2021-30153 | Medium | 4.3 | 2023-04-15 | An issue was discovered in the VisualEditor extension in MediaWiki before 1.31.13, and 1.32.x through 1.35.x before 1.35.2. . When using VisualEditor to edit a… |
CVE-2023-29208 | High | 7.5 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. Rights added to a document are not taken into account for viewing it on… |
CVE-2023-29203 | Low | 3.7 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. It's possible to list some users who are normally not viewable from sub… |
CVE-2023-25954 | Medium | 5.5 | 2023-04-13 | KYOCERA Mobile Print' v3.2.0.230119 and earlier, 'UTAX/TA MobilePrint' v3.2.0.230119 and earlier, and 'Olivetti Mobile Print' v3.2.0.230119 and earlier are vul… |
CVE-2023-25409 | High | 8.1 | 2023-04-11 | Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. Restricted users have access to other users outlets. |
CVE-2022-47338 | High | 7.1 | 2023-04-11 | In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service. |
CVE-2023-26588 | High | 7.5 | 2023-04-11 | Use of hard-coded credentials vulnerability in Buffalo network devices allows an attacker to access the debug function of the product. The affected products an… |
CVE-2023-26458 | Medium | 6.8 | 2023-04-11 | An information disclosure vulnerability exists in SAP Landscape Management - version 3.0, enterprise edition. It allows an authenticated SAP Landscape Manageme… |
CVE-2023-29192 | Low | 2.7 | 2023-04-10 | SilverwareGames.io versions before 1.2.19 allow users with access to the game upload panel to edit download links for games uploaded by other developers. This… |
CVE-2023-1777 | Medium | 6.5 | 2023-03-31 | Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of t… |
CVE-2023-1775 | Medium | 4.3 | 2023-03-31 | When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leadin… |
CVE-2023-28336 | Medium | 4.3 | 2023-03-23 | Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access. |
CVE-2023-1402 | Medium | 4.3 | 2023-03-23 | The course participation report required additional checks to prevent roles being displayed which the user did not have access to view. |
CVE-2023-28433 | High | 8.8 | 2023-03-22 | Minio is a Multi-Cloud Object Storage framework. All users on Windows prior to version RELEASE.2023-03-20T20-16-18Z are impacted. MinIO fails to filter the `\`… |
CVE-2023-1562 | Low | 3.5 | 2023-03-22 | Mattermost fails to check the "Show Full Name" setting when rendering the result for the /plugins/focalboard/api/v2/users API call, allowing an attacker to lea… |
CVE-2020-22647 | Critical | 9.1 | 2023-03-16 | An issue found in DepositGame v.1.0 allows an attacker to gain sensitive information via the GetBonusWithdraw and withdraw functions. |
CVE-2023-24906 | Medium | 6.5 | 2023-03-14 | Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability |
CVE-2023-24870 | Medium | 6.5 | 2023-03-14 | Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability |
CVE-2023-24866 | Medium | 6.5 | 2023-03-14 | Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability |
CVE-2023-24863 | Medium | 6.5 | 2023-03-14 | Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability |
CVE-2023-23409 | Medium | 5.5 | 2023-03-14 | Client Server Run-Time Subsystem (CSRSS) Information Disclosure Vulnerability |
CVE-2023-23394 | Medium | 5.5 | 2023-03-14 | Client Server Run-Time Subsystem (CSRSS) Information Disclosure Vulnerability |
CVE-2023-25802 | High | 7.5 | 2023-03-13 | Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.6.0 don't correctly neutralize `dir/../filename`… |
CVE-2023-22892 | High | 7.5 | 2023-03-08 | There exists an information disclosure vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by unauthenticated users to read arb… |
CVE-2022-46257 | Medium | 4.3 | 2023-03-07 | An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed private repositories to be added to a GitHub Actions runner gro… |
CVE-2023-20061 | Medium | 6.5 | 2023-03-03 | Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect sensitive information or perform a serve… |
CVE-2023-25536 | Medium | 6.7 | 2023-03-02 | Dell PowerScale OneFS 9.4.0.x contains exposure of sensitive information to an unauthorized actor. A malicious authenticated local user could potentially expl… |
CVE-2023-25544 | High | 7.5 | 2023-03-01 | Dell NetWorker versions 19.5 and earlier contain 'Apache Tomcat' version disclosure vulnerability. A NetWorker server user with remote access to NetWorker cli… |
CVE-2023-24567 | High | 7.5 | 2023-03-01 | Dell NetWorker versions 19.5 and earlier contain 'RabbitMQ' version disclosure vulnerability. A NetWorker server user with remote access to NetWorker clients… |
CVE-2023-22777 | Medium | 4.9 | 2023-03-01 | An authenticated information disclosure vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability resul… |
CVE-2023-22775 | Medium | 6.5 | 2023-03-01 | A vulnerability exists which allows an authenticated attacker to access sensitive information on the ArubaOS command line interface. Successful exploitation co… |
CVE-2023-26041 | Low | 2.6 | 2023-02-27 | Nextcloud Talk is a fully on-premises audio/video and chat communication service. When cron jobs were misconfigured and therefore messages are not expired, the… |
CVE-2023-23501 | Medium | 5.5 | 2023-02-27 | The issue was addressed with improved memory handling This issue is fixed in macOS Ventura 13.2. An app may be able to disclose kernel memory. |
CVE-2023-27265 | Low | 2.7 | 2023-02-27 | Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team… |
CVE-2022-44310 | High | 7.5 | 2023-02-24 | In Development IL ecdh before 0.2.0, an attacker can send an invalid point (not on the curve) as the public key, and obtain the derived shared secret. |
CVE-2023-0481 | Low | 3.3 | 2023-02-24 | In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure p… |
CVE-2023-26081 | High | 7.5 | 2023-02-20 | In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts. |
CVE-2022-39952 | Critical | 9.8 | 2023-02-16 | A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7… |
CVE-2023-25192 | Medium | 5.3 | 2023-02-15 | AMI MegaRAC SPX devices allow User Enumeration through Redfish. The fixed versions are SPx12-update-7.00 and SPx13-update-5.00. |
CVE-2023-21714 | Medium | 5.5 | 2023-02-14 | Microsoft Office Information Disclosure Vulnerability |
CVE-2023-21687 | Medium | 5.5 | 2023-02-14 | HTTP.sys Information Disclosure Vulnerability |
CVE-2023-24523 | High | 8.8 | 2023-02-14 | An attacker authenticated as a non-admin user with local access to a server port assigned to the SAP Host Agent (Start Service) - versions 7.21, 7.22, can subm… |
CVE-2022-34387 | Medium | 6.4 | 2023-02-11 | Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain a privilege escalation vuln… |
CVE-2022-34364 | Medium | 4.4 | 2023-02-10 | Dell BSAFE SSL-J, versions before 6.5 and version 7.0 contain a debug message revealing unnecessary information vulnerability. This may lead to disclosing s… |
CVE-2022-4903 | Medium | 5.0 | 2023-02-10 | A vulnerability was found in CodenameOne 7.0.70. It has been classified as problematic. Affected is an unknown function. The manipulation leads to use of impli… |
CVE-2022-34452 | Low | 2.7 | 2023-02-10 | PowerPath Management Appliance with versions 3.3, 3.2*, 3.1 & 3.0* contains sensitive information disclosure vulnerability. An Authenticated admin user can ab… |