CWE-668 · Exposure of Resource to Wrong Sphere (page 4)
Page 4 of 8 — CVEs classified under CWE-668, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-21447 | Medium | 4.0 | 2023-02-09 | Improper access control vulnerabilities in Samsung Cloud prior to version 5.3.0.32 allows local attackers to access information with Samsung Cloud's privil… |
CVE-2023-21445 | Medium | 5.5 | 2023-02-09 | Improper access control vulnerability in MyFiles prior to versions 12.2.09 in Android R(11), 13.1.03.501 in Android S(12) and 14.1.00.422 in Android T(13) allo… |
CVE-2023-21438 | Low | 2.1 | 2023-02-09 | Improper logic in HomeScreen prior to SMR Feb-2023 Release 1 allows physical attacker to access App preview protected by Secure Folder. |
CVE-2022-46756 | High | 8.2 | 2023-02-01 | Dell VxRail, versions prior to 7.0.410, contain a Container Escape Vulnerability. A local high-privileged attacker could potentially exploit this vulnerabilit… |
CVE-2022-22732 | Low | 3.9 | 2023-01-30 | A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause all remote domains to access the resources (data) supplied by the server… |
CVE-2022-26329 | Low | 1.8 | 2023-01-26 | File existence disclosure vulnerability in NetIQ Identity Manager plugin prior to version 4.8.5 allows attacker to determine whether a file exists on the files… |
CVE-2021-41989 | High | 7.8 | 2023-01-26 | Qlik QlikView through 12.60.20100.0 creates a Temporary File in a Directory with Insecure Permissions. |
CVE-2021-41988 | High | 7.8 | 2023-01-26 | Qlik NPrinting Designer through 21.14.3.0 creates a Temporary File in a Directory with Insecure Permissions. |
CVE-2023-21611 | High | 7.8 | 2023-01-18 | Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Creation of Temporary Fil… |
CVE-2022-45438 | Medium | 5.3 | 2023-01-16 | When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard configurati… |
CVE-2023-22497 | Medium | 6.5 | 2023-01-14 | Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. Each Netdata Agent has an automatically generated MACHINE GUID. I… |
CVE-2022-24913 | Medium | 5.5 | 2023-01-12 | Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider() function in StdT… |
CVE-2021-26343 | Medium | 5.5 | 2023-01-11 | Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the contents of sensitive memory which may result… |
CVE-2023-21536 | Medium | 4.7 | 2023-01-10 | Event Tracing for Windows Information Disclosure Vulnerability |
CVE-2018-25068 | Medium | 6.3 | 2023-01-06 | A vulnerability has been found in devent globalpom-utils up to 4.5.0 and classified as critical. This vulnerability affects the function createTmpDir of the fi… |
CVE-2022-45935 | Medium | 5.5 | 2023-01-06 | Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vu… |
CVE-2022-0337 | Medium | 6.5 | 2023-01-02 | Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive inf… |
CVE-2022-48198 | Critical | 9.8 | 2023-01-01 | The ntpd_driver component before 1.3.0 and 2.x before 2.2.0 for Robot Operating System (ROS) allows attackers, who control the source code of a different node… |
CVE-2022-4817 | Low | 3.1 | 2022-12-28 | A vulnerability was found in centic9 jgit-cookbook. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to ins… |
CVE-2015-10004 | High | 7.5 | 2022-12-27 | Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection… |
CVE-2019-9011 | Medium | 5.3 | 2022-12-26 | In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), an attacker can identify valid usernames. |
CVE-2022-45895 | Medium | 6.5 | 2022-12-25 | Planet eStream before 6.72.10.07 discloses sensitive information, related to the ON cookie (findable in HTML source code for Default.aspx in some situations) a… |
CVE-2022-38474 | Medium | 4.3 | 2022-12-22 | A website that had permission to access the microphone could record audio without the audio notification being shown. This bug does not allow the attacker to b… |
CVE-2022-31596 | Medium | 6.0 | 2022-12-12 | Under certain conditions, an attacker authenticated as a CMS administrator and with high privileges access to the Network in SAP BusinessObjects Business Intel… |
CVE-2022-38599 | Medium | 6.5 | 2022-12-08 | Teleport v3.2.2, Teleport v3.5.6-rc6, and Teleport v3.6.3-b2 was discovered to contain an information leak via the /user/get-role-list web interface. |
CVE-2022-32221 | Critical | 9.8 | 2022-12-05 | When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIEL… |
CVE-2022-41971 | Medium | 4.8 | 2022-12-01 | Nextcould Talk android is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0, guests can continue to recei… |
CVE-2022-43901 | Medium | 5.7 | 2022-12-01 | IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps 1.4.3 could disclose sensitive information. An authenticated local attacker could exploit this vul… |
CVE-2022-1911 | Medium | 5.3 | 2022-11-30 | Error in parser function in M-Files Server versions before 22.6.11534.1 and before 22.6.11505.0 allowed unauthenticated access to some information of the under… |
CVE-2022-21126 | High | 7.3 | 2022-11-29 | The package com.github.samtools:htsjdk before 3.0.1 are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due to the createTempDi… |
CVE-2022-41954 | Low | 3.3 | 2022-11-25 | MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems (not Windows or mac… |
CVE-2022-38813 | High | 8.1 | 2022-11-25 | PHPGurukul Blood Donor Management System 1.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, dele… |
CVE-2022-41946 | Medium | 4.7 | 2022-11-23 | pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either `PreparedStatement.setText(int, InputStream)` or `Prepa… |
CVE-2022-3952 | Low | 2.6 | 2022-11-11 | A vulnerability has been found in ManyDesigns Portofino 5.3.2 and classified as problematic. Affected by this vulnerability is the function createTempDir of th… |
CVE-2022-41874 | Low | 2.6 | 2022-11-10 | Tauri is a framework for building binaries for all major desktop platforms. In versions prior to 1.0.7 and 1.1.2, Tauri is vulnerable to an Incorrectly-Resolve… |
CVE-2022-3866 | Medium | 5.0 | 2022-11-10 | HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs… |
CVE-2022-2882 | Medium | 5.5 | 2022-10-28 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versio… |
CVE-2022-39349 | Medium | 5.5 | 2022-10-25 | The Tasks.org Android app is an open-source app for to-do lists and reminders. The Tasks.org app uses the activity `ShareLinkActivity.kt` to handle "share" int… |
CVE-2013-4253 | High | 7.5 | 2022-10-19 | The deployment script in the unsupported "OpenShift Extras" set of add-on scripts, in Red Hat Openshift 1, installs a default public key in the root user's aut… |
CVE-2022-39309 | Medium | 4.9 | 2022-10-14 | GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD version… |
CVE-2022-39015 | Medium | 6.5 | 2022-10-11 | Under certain conditions, BOE AdminTools/ BOE SDK allows an attacker to access information which would otherwise be restricted. |
CVE-2022-26121 | Low | 3.7 | 2022-10-10 | An exposure of resource to wrong sphere vulnerability [CWE-668] in FortiAnalyzer and FortiManager GUI 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.0 through 6… |
CVE-2022-39871 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability cloudNotificationManager.java in SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information v… |
CVE-2022-39870 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information v… |
CVE-2022-39869 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information v… |
CVE-2020-27601 | Low | 3.5 | 2022-09-29 | In BigBlueButton before 2.2.7, lockSettingsProps.disablePrivateChat does not apply to already opened chats. This occurs in bigbluebutton-html5/imports/ui/compo… |
CVE-2022-23950 | High | 7.5 | 2022-09-21 | In Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unprivileged users a method to prohibit keylime oper… |
CVE-2022-40234 | Medium | 5.9 | 2022-09-19 | Versions of IBM Spectrum Protect Plus prior to 10.1.12 (excluding 10.1.12) include the private key information for a certificate inside the generated .crt file… |
CVE-2022-34867 | High | 7.3 | 2022-09-06 | Unauthenticated Sensitive Information Disclosure vulnerability in WP Libre Form 2 plugin <= 2.0.8 at WordPress allows attackers to list and delete submissions… |
CVE-2022-2403 | Medium | 6.5 | 2022-09-01 | A credentials leak was found in the OpenShift Container Platform. The private key for the external cluster certificate was stored incorrectly in the oauth-serv… |
CVE-2022-1902 | High | 8.8 | 2022-09-01 | A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows aut… |
CVE-2022-0852 | Medium | 5.5 | 2022-08-29 | There is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription-manager via the command line, which could allow unauthorized… |
CVE-2021-3859 | High | 7.5 | 2022-08-26 | A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out deni… |
CVE-2022-29850 | High | 8.1 | 2022-08-26 | Various Lexmark products through 2022-04-27 allow an attacker who has already compromised an affected Lexmark device to maintain persistence across reboots. |
CVE-2022-2610 | Medium | 6.5 | 2022-08-12 | Insufficient policy enforcement in Background Fetch in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to leak cross-origin data via a crafted H… |
CVE-2021-0734 | Medium | 5.5 | 2022-08-11 | In Settings, there is a possible way to determine whether an app is installed without query permissions, due to side channel information disclosure. This could… |
CVE-2022-35936 | High | 8.2 | 2022-08-05 | Ethermint is an Ethereum library. In Ethermint running versions before `v0.17.2`, the contract `selfdestruct` invocation permanently removes the corresponding… |
CVE-2022-1875 | Medium | 4.3 | 2022-07-27 | Inappropriate implementation in PDF in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2022-1873 | Medium | 6.5 | 2022-07-27 | Insufficient policy enforcement in COOP in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2022-1637 | Medium | 4.3 | 2022-07-26 | Inappropriate implementation in Web Contents in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to leak cross-origin data via a crafted HTML pag… |
CVE-2022-1501 | Medium | 6.5 | 2022-07-26 | Inappropriate implementation in iframe in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2022-1498 | Medium | 4.3 | 2022-07-26 | Inappropriate implementation in HTML Parser in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2022-1488 | Medium | 4.3 | 2022-07-26 | Inappropriate implementation in Extensions API in Google Chrome prior to 101.0.4951.41 allowed an attacker who convinced a user to install a malicious extensio… |
CVE-2022-1137 | Medium | 6.5 | 2022-07-23 | Inappropriate implementation in Extensions in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extension to… |
CVE-2022-34047 | High | 7.5 | 2022-07-20 | An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/set_safety… |
CVE-2022-23825 | Medium | 6.5 | 2022-07-14 | Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure. |
CVE-2022-34765 | Medium | 5.5 | 2022-07-13 | A CWE-73: External Control of File Name or Path vulnerability exists that could cause loading of unauthorized firmware images when user-controlled data is writ… |
CVE-2022-32249 | High | 7.5 | 2022-07-12 | Under special integration scenario of SAP Business one and SAP HANA - version 10.0, an attacker can exploit HANA cockpit�s data volume to gain access to highly… |
CVE-2022-29901 | Medium | 5.6 | 2022-07-12 | Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary… |
CVE-2022-33700 | Low | 2.0 | 2022-07-12 | Exposure of Sensitive Information in putDsaSimImsi in TelephonyUI prior to SMR Jul-2022 Release 1 allows local attacker to access imsi via log. |
CVE-2022-33699 | Low | 2.0 | 2022-07-12 | Exposure of Sensitive Information in getDsaSimImsi in TelephonyUI prior to SMR Jul-2022 Release 1 allows local attacker to access imsi via log. |
CVE-2022-33698 | Low | 3.3 | 2022-07-12 | Exposure of Sensitive Information in Telecom application prior to SMR Jul-2022 Release 1 allows local attackers to access ICCID via log. |
CVE-2022-33696 | Medium | 4.0 | 2022-07-12 | Exposure of Sensitive Information in Telephony service prior to SMR Jul-2022 Release 1 allows local attacker to access imsi and iccid via log. |
CVE-2022-33694 | Medium | 4.0 | 2022-07-12 | Exposure of Sensitive Information in CSC application prior to SMR Jul-2022 Release 1 allows local attacker to access wifi information via unprotected intent br… |
CVE-2022-33692 | Medium | 4.0 | 2022-07-12 | Exposure of Sensitive Information in Messaging application prior to SMR Jul-2022 Release 1 allows local attacker to access imsi and iccid via log. |
CVE-2022-34464 | Medium | 6.3 | 2022-07-12 | A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.7.3). The affected application uses an improperly protected file to import S… |
CVE-2022-24139 | High | 7.8 | 2022-07-06 | In IOBit Advanced System Care (AscService.exe) 15, an attacker with SEImpersonatePrivilege can create a named pipe with the same name as one of ASCService's na… |
CVE-2021-46687 | Medium | 4.9 | 2022-07-06 | JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. This issue affects… |
CVE-2013-4561 | Critical | 9.1 | 2022-06-30 | In a openshift node, there is a cron job to update mcollective facts that mishandles a temporary file. This may lead to loss of confidentiality and integrity. |
CVE-2021-20551 | Low | 3.3 | 2022-06-24 | IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force I… |
CVE-2022-32530 | Medium | 4.8 | 2022-06-24 | A CWE-668 Exposure of Resource to Wrong Sphere vulnerability exists that could cause users to be misled, hiding alarms, showing the wrong server connection opt… |
CVE-2020-25459 | High | 7.5 | 2022-06-16 | An issue was discovered in function sync_tree in hetero_decision_tree_guest.py in WeBank FATE (Federated AI Technology Enabler) 0.1 through 1.4.2 allows attack… |
CVE-2022-28226 | High | 7.8 | 2022-06-15 | Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.801 allows a local, low privileged, attacker to execute arbitary code with the SYST… |
CVE-2022-31846 | High | 7.5 | 2022-06-14 | A vulnerability in live_mfg.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec cmd… |
CVE-2022-31845 | High | 7.5 | 2022-06-14 | A vulnerability in live_check.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec c… |
CVE-2022-29247 | Low | 2.2 | 2022-06-13 | Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta… |
CVE-2022-31649 | High | 7.5 | 2022-06-09 | ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer. |
CVE-2021-36710 | High | 8.8 | 2022-06-08 | ToaruOS 1.99.2 is affected by incorrect access control via the kernel. Improper MMU management and having a low GDT address allows it to be mapped in userland… |
CVE-2022-30734 | Medium | 4.0 | 2022-06-07 | Sensitive information exposure in Sign-out log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without perm… |
CVE-2022-30732 | Medium | 5.5 | 2022-06-07 | Exposure of Sensitive Information vulnerability in Samsung Account prior to version 13.2.00.6 allows attacker to access sensitive information via onActivityRes… |
CVE-2022-30728 | Low | 1.9 | 2022-06-07 | Information exposure vulnerability in ScanPool prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information. |
CVE-2022-30714 | Low | 1.9 | 2022-06-07 | Information exposure vulnerability in SemIWCMonitor prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information. |
CVE-2022-28794 | Low | 2.2 | 2022-06-07 | Sensitive information exposure in low-battery dumpstate log prior to SMR Jun-2022 Release 1 allows local attackers to get SIM card information. |
CVE-2020-36532 | Medium | 4.3 | 2022-06-07 | A vulnerability has been found in Klapp App and classified as problematic. This vulnerability affects unknown code of the component Authorization. The manipula… |
CVE-2022-26869 | Critical | 9.8 | 2022-06-02 | Dell PowerStore versions 2.0.0.x, 2.0.1.x and 2.1.0.x contains an open port vulnerability. A remote unauthenticated attacker could potentially exploit this vul… |
CVE-2022-1467 | High | 7.4 | 2022-05-23 | Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewa… |
CVE-2022-28924 | Medium | 6.5 | 2022-05-18 | An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted GET request to the e… |
CVE-2022-29646 | Medium | 5.3 | 2022-05-18 | An access control issue in TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 allows attackers to obtain sensitive information via a crafted w… |
CVE-2021-43066 | High | 8.4 | 2022-05-11 | A external control of file name or path in Fortinet FortiClientWindows version 7.0.2 and below, version 6.4.6 and below, version 6.2.9 and below, version 6.0.1… |
CVE-2022-24823 | Medium | 5.5 | 2022-05-06 | Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contain… |