CWE-668 · Exposure of Resource to Wrong Sphere (page 5)
Page 5 of 8 — CVEs classified under CWE-668, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-28226 | High | 7.8 | 2022-06-15 | Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.801 allows a local, low privileged, attacker to execute arbitary code with the SYST… |
CVE-2022-31846 | High | 7.5 | 2022-06-14 | A vulnerability in live_mfg.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec cmd… |
CVE-2022-31845 | High | 7.5 | 2022-06-14 | A vulnerability in live_check.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec c… |
CVE-2022-29247 | Low | 2.2 | 2022-06-13 | Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta… |
CVE-2022-31649 | High | 7.5 | 2022-06-09 | ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer. |
CVE-2021-36710 | High | 8.8 | 2022-06-08 | ToaruOS 1.99.2 is affected by incorrect access control via the kernel. Improper MMU management and having a low GDT address allows it to be mapped in userland… |
CVE-2022-30734 | Medium | 4.0 | 2022-06-07 | Sensitive information exposure in Sign-out log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without perm… |
CVE-2022-30732 | Medium | 5.5 | 2022-06-07 | Exposure of Sensitive Information vulnerability in Samsung Account prior to version 13.2.00.6 allows attacker to access sensitive information via onActivityRes… |
CVE-2022-30728 | Low | 1.9 | 2022-06-07 | Information exposure vulnerability in ScanPool prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information. |
CVE-2022-30714 | Low | 1.9 | 2022-06-07 | Information exposure vulnerability in SemIWCMonitor prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information. |
CVE-2022-28794 | Low | 2.2 | 2022-06-07 | Sensitive information exposure in low-battery dumpstate log prior to SMR Jun-2022 Release 1 allows local attackers to get SIM card information. |
CVE-2020-36532 | Medium | 4.3 | 2022-06-07 | A vulnerability has been found in Klapp App and classified as problematic. This vulnerability affects unknown code of the component Authorization. The manipula… |
CVE-2022-26869 | Critical | 9.8 | 2022-06-02 | Dell PowerStore versions 2.0.0.x, 2.0.1.x and 2.1.0.x contains an open port vulnerability. A remote unauthenticated attacker could potentially exploit this vul… |
CVE-2022-1467 | High | 7.4 | 2022-05-23 | Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewa… |
CVE-2022-28924 | Medium | 6.5 | 2022-05-18 | An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted GET request to the e… |
CVE-2022-29646 | Medium | 5.3 | 2022-05-18 | An access control issue in TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 allows attackers to obtain sensitive information via a crafted w… |
CVE-2021-43066 | High | 8.4 | 2022-05-11 | A external control of file name or path in Fortinet FortiClientWindows version 7.0.2 and below, version 6.4.6 and below, version 6.2.9 and below, version 6.0.1… |
CVE-2022-24823 | Medium | 5.5 | 2022-05-06 | Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contain… |
CVE-2022-24900 | Critical | 9.9 | 2022-04-29 | Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. Version 1.3 and prior are vulnerable to… |
CVE-2022-29820 | Low | 3.0 | 2022-04-28 | In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possible |
CVE-2022-27331 | Medium | 4.3 | 2022-04-27 | An access control issue in Zammad v5.0.3 broadcasts administrative configuration changes to all users who have an active application instance, including settin… |
CVE-2022-1385 | Low | 3.7 | 2022-04-19 | Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accident… |
CVE-2022-27817 | Medium | 4.4 | 2022-04-14 | SWHKD 1.1.5 consumes the keyboard events of unintended users. This could potentially cause an information leak, but is usually a denial of functionality. |
CVE-2022-24411 | High | 7.8 | 2022-04-12 | Dell PowerScale OneFS 8.2.2 and above contain an elevation of privilege vulnerability. A local attacker with ISI_PRIV_LOGIN_SSH and/or ISI_PRIV_LOGIN_CONSOLE c… |
CVE-2022-23163 | Medium | 4.7 | 2022-04-12 | Dell PowerScale OneFS, 8.2,x, 9.1.0.x, 9.2.1.x, and 9.3.0.x contain a denial of service vulnerability. A local malicious user could potentially exploit this vu… |
CVE-2021-42255 | High | 7.8 | 2022-04-12 | AppGuard Enterprise before 6.7.100.1 creates a Temporary File in a Directory with Insecure Permissions. Local users can gain SYSTEM privileges because a repair… |
CVE-2022-27822 | Medium | 6.6 | 2022-04-11 | Information exposure vulnerability in ril property setting prior to SMR April-2022 Release 1 allows access to EF_RUIMID value without permission. |
CVE-2022-27576 | Low | 3.3 | 2022-04-11 | Information exposure vulnerability in Samsung DeX Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app information without… |
CVE-2022-22515 | High | 8.1 | 2022-04-07 | A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify t… |
CVE-2022-27818 | Critical | 9.1 | 2022-04-07 | SWHKD 1.1.5 unsafely uses the /tmp/swhkd.sock pathname. There can be an information leak or denial of service. |
CVE-2022-26850 | Medium | 4.3 | 2022-04-06 | When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login Identity Providers configuration to the operating system te… |
CVE-2022-21947 | High | 8.3 | 2022-04-01 | A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API (steve) t… |
CVE-2022-27772 | High | 7.8 | 2022-03-30 | spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot… |
CVE-2021-39777 | Medium | 5.5 | 2022-03-30 | In Telephony, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. This could lead t… |
CVE-2021-22572 | Medium | 5.5 | 2022-03-29 | On unix-like systems, the system temporary directory is shared between all users on that system. The root cause is File.createTempFile creates files in the the… |
CVE-2022-28160 | Medium | 6.5 | 2022-03-29 | Jenkins Tests Selector Plugin 1.3.3 and earlier allows users with Item/Configure permission to read arbitrary files on the Jenkins controller. |
CVE-2022-0315 | High | 7.5 | 2022-03-24 | Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0. |
CVE-2022-25041 | Medium | 4.3 | 2022-03-23 | OpenEMR v6.0.0 was discovered to contain an incorrect access control issue. |
CVE-2021-4180 | Medium | 4.3 | 2022-03-23 | An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit thi… |
CVE-2021-27424 | Medium | 5.3 | 2022-03-23 | GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide. GE was made aware a “Last-key pressed” MODBUS regis… |
CVE-2022-21718 | Low | 3.4 | 2022-03-22 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to `17.0.0-alpha.6`… |
CVE-2022-25481 | High | 7.5 | 2022-03-21 | ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters fr… |
CVE-2022-24074 | Critical | 9.8 | 2022-03-17 | Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could lea… |
CVE-2020-4989 | Medium | 4.3 | 2022-03-15 | IBM Engineering Workflow Management 7.0, 7.0.1, and 7.0.2 and IBM Rational Team Concert 6.0.6 and 6.0.0.1 could allow an authenticated user to obtain sensitive… |
CVE-2022-24742 | Medium | 5.0 | 2022-03-14 | Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed af… |
CVE-2022-0815 | Medium | 6.5 | 2022-03-10 | Improper access control vulnerability in McAfee WebAdvisor Chrome and Edge browser extensions up to 8.1.0.1895 allows a remote attacker to gain access to McAfe… |
CVE-2022-26355 | Medium | 4.4 | 2022-03-10 | Citrix Federated Authentication Service (FAS) 7.17 - 10.6 causes deployments that have been configured to store a registration authority certificate's private… |
CVE-2021-28488 | Medium | 6.5 | 2022-03-10 | Ericsson Network Manager (ENM) before 21.2 has incorrect access-control behavior (that only affects the level of access available to persons who were already g… |
CVE-2022-24747 | Medium | 6.3 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do no properly set sen… |
CVE-2022-24986 | High | 7.8 | 2022-02-26 | KDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename during an editing session. Thus, someone watching it be created th… |
CVE-2022-23835 | High | 8.1 | 2022-02-25 | The Visual Voice Mail (VVM) application through 2022-02-24 for Android allows persistent access if an attacker temporarily controls an application that has the… |
CVE-2022-25643 | Critical | 9.8 | 2022-02-24 | seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The attack vector is a user-supplied socke… |
CVE-2022-25236 | Critical | 9.8 | 2022-02-16 | xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. |
CVE-2021-42714 | High | 7.8 | 2022-02-15 | Splashtop Remote Client (Business Edition) through 3.4.8.3 creates a Temporary File in a Directory with Insecure Permissions. |
CVE-2021-42713 | High | 7.8 | 2022-02-15 | Splashtop Remote Client (Personal Edition) through 3.4.6.1 creates a Temporary File in a Directory with Insecure Permissions. |
CVE-2021-42712 | High | 7.8 | 2022-02-15 | Splashtop Streamer through 3.4.8.3 creates a Temporary File in a Directory with Insecure Permissions. |
CVE-2021-45420 | Critical | 9.8 | 2022-02-14 | Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_u… |
CVE-2022-24975 | High | 7.5 | 2022-02-11 | The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security… |
CVE-2020-13670 | High | 7.5 | 2022-02-11 | Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they… |
CVE-2021-45402 | Medium | 5.5 | 2022-02-11 | The check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not properly update bounds while handling the mov32 instruction… |
CVE-2021-33096 | Medium | 5.5 | 2022-02-09 | Improper isolation of shared resources in network on chip for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticated user to potential… |
CVE-2021-46354 | High | 7.5 | 2022-02-09 | Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cm… |
CVE-2021-42641 | High | 7.5 | 2022-02-02 | PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticat… |
CVE-2021-42640 | Critical | 9.1 | 2022-02-02 | PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticat… |
CVE-2021-24868 | Medium | 4.3 | 2022-02-01 | The Document Embedder WordPress plugin before 1.7.9 contains a AJAX action endpoint, which could allow any authenticated user, such as subscriber to enumerate… |
CVE-2021-24775 | Medium | 5.3 | 2022-02-01 | The Document Embedder WordPress plugin before 1.7.5 contains a REST endpoint, which could allow unauthenticated users to enumerate the title of arbitrary priva… |
CVE-2022-0334 | Medium | 4.3 | 2022-01-25 | A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lea… |
CVE-2022-22154 | Medium | 6.8 | 2022-01-19 | In a Junos Fusion scenario an External Control of Critical State Data vulnerability in the Satellite Device (SD) control state machine of Juniper Networks Juno… |
CVE-2021-44049 | High | 7.8 | 2022-01-15 | CyberArk Endpoint Privilege Manager (EPM) through 11.5.3.328 before 2021-12-20 allows a local user to gain elevated privileges via a Trojan horse Procmon64.exe… |
CVE-2021-39628 | Low | 3.3 | 2022-01-14 | In StatusBar.java, there is a possible disclosure of notification content on the lockscreen due to a logic error in the code. This could lead to local informat… |
CVE-2022-23118 | High | 8.8 | 2022-01-12 | Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agents to invoke command-line `git` at an attacker-specified path… |
CVE-2022-21964 | Medium | 5.5 | 2022-01-11 | Remote Desktop Licensing Diagnoser Information Disclosure Vulnerability |
CVE-2021-42749 | Medium | 5.3 | 2022-01-10 | In Beaver Themer, attackers can bypass conditional logic controls (for hiding content) when viewing the post archives. Exploitation requires that a Themer layo… |
CVE-2021-39971 | High | 7.5 | 2022-01-03 | Password vault has a External Control of System or Configuration Setting vulnerability.Successful exploitation of this vulnerability could compromise confident… |
CVE-2021-37112 | Medium | 5.3 | 2022-01-03 | Hisuite module has a External Control of System or Configuration Setting vulnerability.Successful exploitation of this vulnerability may lead to Firmware leak. |
CVE-2021-1918 | Medium | 6.5 | 2022-01-03 | Improper handling of resource allocation in virtual machines can lead to information exposure in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon… |
CVE-2020-20948 | High | 7.5 | 2021-12-27 | An arbitrary file download vulnerability in jeecg v3.8 allows attackers to access sensitive files via modification of the "localPath" variable. |
CVE-2021-45708 | High | 7.5 | 2021-12-27 | An issue was discovered in the abomonation crate through 2021-10-17 for Rust. Because transmute operations are insufficiently constrained, there can be an info… |
CVE-2019-8702 | Medium | 5.5 | 2021-12-23 | This issue was addressed with a new entitlement. This issue is fixed in macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Si… |
CVE-2021-21878 | Medium | 4.9 | 2021-12-22 | A local file inclusion vulnerability exists in the Web Manager Applications and FsBrowse functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-cra… |
CVE-2020-35215 | Medium | 6.5 | 2021-12-16 | An issue in Atomix v3.1.5 allows attackers to access sensitive information when a malicious Atomix node queries distributed variable primitives which contain t… |
CVE-2021-43893 | High | 7.5 | 2021-12-15 | Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability |
CVE-2021-43216 | Medium | 6.5 | 2021-12-15 | Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability |
CVE-2021-41065 | High | 7.3 | 2021-12-14 | An issue was discovered in Listary through 6. An attacker can create a \\.\pipe\Listary.listaryService named pipe and wait for a privileged user to open a sess… |
CVE-2021-44524 | Critical | 9.8 | 2021-12-14 | A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions)… |
CVE-2021-44523 | Critical | 9.1 | 2021-12-14 | A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions)… |
CVE-2021-44522 | High | 7.5 | 2021-12-14 | A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions)… |
CVE-2021-39915 | Medium | 5.3 | 2021-12-13 | Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 before 14.3.6, all versions starting from 14.4 before 14.4… |
CVE-2021-38931 | Medium | 6.5 | 2021-12-09 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1, and 11.5 is vulnerable to an information disclosure as a result of a connected user hav… |
CVE-2021-22568 | High | 8.8 | 2021-12-09 | When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 access_token th… |
CVE-2021-38505 | Medium | 6.5 | 2021-12-08 | Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to the clipboard to the cloud, and make it… |
CVE-2021-25515 | Medium | 4.0 | 2021-12-08 | An improper usage of implicit intent in SemRewardManager prior to SMR Dec-2021 Release 1 allows attackers to access BSSID. |
CVE-2021-29115 | Medium | 5.3 | 2021-12-07 | An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to vie… |
CVE-2021-36198 | High | 8.3 | 2021-12-06 | Successful exploitation of this vulnerability could allow an unauthorized user to access sensitive data. |
CVE-2021-23264 | High | 8.1 | 2021-12-02 | Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes. |
CVE-2021-23263 | Medium | 5.9 | 2021-12-02 | Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary). |
CVE-2021-38004 | Medium | 4.3 | 2021-11-23 | Insufficient policy enforcement in Autofill in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2021-43560 | Medium | 5.3 | 2021-11-22 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it p… |
CVE-2021-36319 | Low | 3.3 | 2021-11-20 | Dell Networking OS10 versions 10.4.3.x, 10.5.0.x and 10.5.1.x contain an information exposure vulnerability. A low privileged authenticated malicious user can… |
CVE-2021-42254 | High | 7.8 | 2021-11-19 | BeyondTrust Privilege Management prior to version 21.6 creates a Temporary File in a Directory with Insecure Permissions. |