CWE-668 · Exposure of Resource to Wrong Sphere (page 5)
Page 5 of 8 — CVEs classified under CWE-668, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-24900 | Critical | 9.9 | 2022-04-29 | Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. Version 1.3 and prior are vulnerable to… |
CVE-2022-29820 | Low | 3.0 | 2022-04-28 | In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possible |
CVE-2022-27331 | Medium | 4.3 | 2022-04-27 | An access control issue in Zammad v5.0.3 broadcasts administrative configuration changes to all users who have an active application instance, including settin… |
CVE-2022-1385 | Low | 3.7 | 2022-04-19 | Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accident… |
CVE-2022-27817 | Medium | 4.4 | 2022-04-14 | SWHKD 1.1.5 consumes the keyboard events of unintended users. This could potentially cause an information leak, but is usually a denial of functionality. |
CVE-2022-24411 | High | 7.8 | 2022-04-12 | Dell PowerScale OneFS 8.2.2 and above contain an elevation of privilege vulnerability. A local attacker with ISI_PRIV_LOGIN_SSH and/or ISI_PRIV_LOGIN_CONSOLE c… |
CVE-2022-23163 | Medium | 4.7 | 2022-04-12 | Dell PowerScale OneFS, 8.2,x, 9.1.0.x, 9.2.1.x, and 9.3.0.x contain a denial of service vulnerability. A local malicious user could potentially exploit this vu… |
CVE-2021-42255 | High | 7.8 | 2022-04-12 | AppGuard Enterprise before 6.7.100.1 creates a Temporary File in a Directory with Insecure Permissions. Local users can gain SYSTEM privileges because a repair… |
CVE-2022-27822 | Medium | 6.6 | 2022-04-11 | Information exposure vulnerability in ril property setting prior to SMR April-2022 Release 1 allows access to EF_RUIMID value without permission. |
CVE-2022-27576 | Low | 3.3 | 2022-04-11 | Information exposure vulnerability in Samsung DeX Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app information without… |
CVE-2022-22515 | High | 8.1 | 2022-04-07 | A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify t… |
CVE-2022-27818 | Critical | 9.1 | 2022-04-07 | SWHKD 1.1.5 unsafely uses the /tmp/swhkd.sock pathname. There can be an information leak or denial of service. |
CVE-2022-26850 | Medium | 4.3 | 2022-04-06 | When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login Identity Providers configuration to the operating system te… |
CVE-2022-21947 | High | 8.3 | 2022-04-01 | A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API (steve) t… |
CVE-2022-27772 | High | 7.8 | 2022-03-30 | spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot… |
CVE-2021-39777 | Medium | 5.5 | 2022-03-30 | In Telephony, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. This could lead t… |
CVE-2021-22572 | Medium | 5.5 | 2022-03-29 | On unix-like systems, the system temporary directory is shared between all users on that system. The root cause is File.createTempFile creates files in the the… |
CVE-2022-28160 | Medium | 6.5 | 2022-03-29 | Jenkins Tests Selector Plugin 1.3.3 and earlier allows users with Item/Configure permission to read arbitrary files on the Jenkins controller. |
CVE-2022-0315 | High | 7.5 | 2022-03-24 | Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0. |
CVE-2022-25041 | Medium | 4.3 | 2022-03-23 | OpenEMR v6.0.0 was discovered to contain an incorrect access control issue. |
CVE-2021-4180 | Medium | 4.3 | 2022-03-23 | An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit thi… |
CVE-2021-27424 | Medium | 5.3 | 2022-03-23 | GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide. GE was made aware a “Last-key pressed” MODBUS regis… |
CVE-2022-21718 | Low | 3.4 | 2022-03-22 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to `17.0.0-alpha.6`… |
CVE-2022-25481 | High | 7.5 | 2022-03-21 | ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters fr… |
CVE-2022-24074 | Critical | 9.8 | 2022-03-17 | Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could lea… |
CVE-2020-4989 | Medium | 4.3 | 2022-03-15 | IBM Engineering Workflow Management 7.0, 7.0.1, and 7.0.2 and IBM Rational Team Concert 6.0.6 and 6.0.0.1 could allow an authenticated user to obtain sensitive… |
CVE-2022-24742 | Medium | 5.0 | 2022-03-14 | Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed af… |
CVE-2022-0815 | Medium | 6.5 | 2022-03-10 | Improper access control vulnerability in McAfee WebAdvisor Chrome and Edge browser extensions up to 8.1.0.1895 allows a remote attacker to gain access to McAfe… |
CVE-2022-26355 | Medium | 4.4 | 2022-03-10 | Citrix Federated Authentication Service (FAS) 7.17 - 10.6 causes deployments that have been configured to store a registration authority certificate's private… |
CVE-2021-28488 | Medium | 6.5 | 2022-03-10 | Ericsson Network Manager (ENM) before 21.2 has incorrect access-control behavior (that only affects the level of access available to persons who were already g… |
CVE-2022-24747 | Medium | 6.3 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do no properly set sen… |
CVE-2022-24986 | High | 7.8 | 2022-02-26 | KDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename during an editing session. Thus, someone watching it be created th… |
CVE-2022-23835 | High | 8.1 | 2022-02-25 | The Visual Voice Mail (VVM) application through 2022-02-24 for Android allows persistent access if an attacker temporarily controls an application that has the… |
CVE-2022-25643 | Critical | 9.8 | 2022-02-24 | seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The attack vector is a user-supplied socke… |
CVE-2022-25236 | Critical | 9.8 | 2022-02-16 | xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. |
CVE-2021-42714 | High | 7.8 | 2022-02-15 | Splashtop Remote Client (Business Edition) through 3.4.8.3 creates a Temporary File in a Directory with Insecure Permissions. |
CVE-2021-42713 | High | 7.8 | 2022-02-15 | Splashtop Remote Client (Personal Edition) through 3.4.6.1 creates a Temporary File in a Directory with Insecure Permissions. |
CVE-2021-42712 | High | 7.8 | 2022-02-15 | Splashtop Streamer through 3.4.8.3 creates a Temporary File in a Directory with Insecure Permissions. |
CVE-2021-45420 | Critical | 9.8 | 2022-02-14 | Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_u… |
CVE-2022-24975 | High | 7.5 | 2022-02-11 | The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security… |
CVE-2020-13670 | High | 7.5 | 2022-02-11 | Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they… |
CVE-2021-45402 | Medium | 5.5 | 2022-02-11 | The check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not properly update bounds while handling the mov32 instruction… |
CVE-2021-33096 | Medium | 5.5 | 2022-02-09 | Improper isolation of shared resources in network on chip for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticated user to potential… |
CVE-2021-46354 | High | 7.5 | 2022-02-09 | Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cm… |
CVE-2021-42641 | High | 7.5 | 2022-02-02 | PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticat… |
CVE-2021-42640 | Critical | 9.1 | 2022-02-02 | PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticat… |
CVE-2021-24868 | Medium | 4.3 | 2022-02-01 | The Document Embedder WordPress plugin before 1.7.9 contains a AJAX action endpoint, which could allow any authenticated user, such as subscriber to enumerate… |
CVE-2021-24775 | Medium | 5.3 | 2022-02-01 | The Document Embedder WordPress plugin before 1.7.5 contains a REST endpoint, which could allow unauthenticated users to enumerate the title of arbitrary priva… |
CVE-2022-0334 | Medium | 4.3 | 2022-01-25 | A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lea… |
CVE-2022-22154 | Medium | 6.8 | 2022-01-19 | In a Junos Fusion scenario an External Control of Critical State Data vulnerability in the Satellite Device (SD) control state machine of Juniper Networks Juno… |
CVE-2021-44049 | High | 7.8 | 2022-01-15 | CyberArk Endpoint Privilege Manager (EPM) through 11.5.3.328 before 2021-12-20 allows a local user to gain elevated privileges via a Trojan horse Procmon64.exe… |
CVE-2021-39628 | Low | 3.3 | 2022-01-14 | In StatusBar.java, there is a possible disclosure of notification content on the lockscreen due to a logic error in the code. This could lead to local informat… |
CVE-2022-23118 | High | 8.8 | 2022-01-12 | Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agents to invoke command-line `git` at an attacker-specified path… |
CVE-2022-21964 | Medium | 5.5 | 2022-01-11 | Remote Desktop Licensing Diagnoser Information Disclosure Vulnerability |
CVE-2021-42749 | Medium | 5.3 | 2022-01-10 | In Beaver Themer, attackers can bypass conditional logic controls (for hiding content) when viewing the post archives. Exploitation requires that a Themer layo… |
CVE-2021-39971 | High | 7.5 | 2022-01-03 | Password vault has a External Control of System or Configuration Setting vulnerability.Successful exploitation of this vulnerability could compromise confident… |
CVE-2021-37112 | Medium | 5.3 | 2022-01-03 | Hisuite module has a External Control of System or Configuration Setting vulnerability.Successful exploitation of this vulnerability may lead to Firmware leak. |
CVE-2021-1918 | Medium | 6.5 | 2022-01-03 | Improper handling of resource allocation in virtual machines can lead to information exposure in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon… |
CVE-2020-20948 | High | 7.5 | 2021-12-27 | An arbitrary file download vulnerability in jeecg v3.8 allows attackers to access sensitive files via modification of the "localPath" variable. |
CVE-2021-45708 | High | 7.5 | 2021-12-27 | An issue was discovered in the abomonation crate through 2021-10-17 for Rust. Because transmute operations are insufficiently constrained, there can be an info… |
CVE-2019-8702 | Medium | 5.5 | 2021-12-23 | This issue was addressed with a new entitlement. This issue is fixed in macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Si… |
CVE-2021-21878 | Medium | 4.9 | 2021-12-22 | A local file inclusion vulnerability exists in the Web Manager Applications and FsBrowse functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-cra… |
CVE-2020-35215 | Medium | 6.5 | 2021-12-16 | An issue in Atomix v3.1.5 allows attackers to access sensitive information when a malicious Atomix node queries distributed variable primitives which contain t… |
CVE-2021-43893 | High | 7.5 | 2021-12-15 | Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability |
CVE-2021-43216 | Medium | 6.5 | 2021-12-15 | Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability |
CVE-2021-41065 | High | 7.3 | 2021-12-14 | An issue was discovered in Listary through 6. An attacker can create a \\.\pipe\Listary.listaryService named pipe and wait for a privileged user to open a sess… |
CVE-2021-44524 | Critical | 9.8 | 2021-12-14 | A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions)… |
CVE-2021-44523 | Critical | 9.1 | 2021-12-14 | A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions)… |
CVE-2021-44522 | High | 7.5 | 2021-12-14 | A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions)… |
CVE-2021-39915 | Medium | 5.3 | 2021-12-13 | Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 before 14.3.6, all versions starting from 14.4 before 14.4… |
CVE-2021-38931 | Medium | 6.5 | 2021-12-09 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1, and 11.5 is vulnerable to an information disclosure as a result of a connected user hav… |
CVE-2021-22568 | High | 8.8 | 2021-12-09 | When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 access_token th… |
CVE-2021-38505 | Medium | 6.5 | 2021-12-08 | Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to the clipboard to the cloud, and make it… |
CVE-2021-25515 | Medium | 4.0 | 2021-12-08 | An improper usage of implicit intent in SemRewardManager prior to SMR Dec-2021 Release 1 allows attackers to access BSSID. |
CVE-2021-29115 | Medium | 5.3 | 2021-12-07 | An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to vie… |
CVE-2021-36198 | High | 8.3 | 2021-12-06 | Successful exploitation of this vulnerability could allow an unauthorized user to access sensitive data. |
CVE-2021-23264 | High | 8.1 | 2021-12-02 | Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes. |
CVE-2021-23263 | Medium | 5.9 | 2021-12-02 | Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary). |
CVE-2021-38004 | Medium | 4.3 | 2021-11-23 | Insufficient policy enforcement in Autofill in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2021-43560 | Medium | 5.3 | 2021-11-22 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it p… |
CVE-2021-36319 | Low | 3.3 | 2021-11-20 | Dell Networking OS10 versions 10.4.3.x, 10.5.0.x and 10.5.1.x contain an information exposure vulnerability. A low privileged authenticated malicious user can… |
CVE-2021-42254 | High | 7.8 | 2021-11-19 | BeyondTrust Privilege Management prior to version 21.6 creates a Temporary File in a Directory with Insecure Permissions. |
CVE-2021-26327 | Medium | 5.5 | 2021-11-16 | Insufficient validation of guest context in the SNP Firmware could lead to a potential loss of guest confidentiality. |
CVE-2021-26312 | Medium | 5.5 | 2021-11-16 | Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory it should not be abl… |
CVE-2020-12488 | Medium | 5.5 | 2021-11-10 | The attacker can access the sensitive information stored within the jovi Smart Scene module by entering carefully constructed commands without requesting permi… |
CVE-2021-22047 | Medium | 5.3 | 2021-10-28 | In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured… |
CVE-2021-22044 | High | 7.5 | 2021-10-28 | In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older unsupported versions, applications using type-level `@RequestMapping`annota… |
CVE-2021-22468 | Low | 3.3 | 2021-10-28 | A component of the HarmonyOS has a Exposure of Sensitive Information to an Unauthorized Actor vulnerability. Local attackers may exploit this vulnerability to… |
CVE-2021-22454 | Medium | 5.5 | 2021-10-28 | A component of the HarmonyOS has a External Control of System or Configuration Setting vulnerability. Local attackers may exploit this vulnerability to cause c… |
CVE-2021-34761 | Medium | 4.4 | 2021-10-27 | A vulnerability in Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to overwrite or append arbitrary data to system f… |
CVE-2021-42536 | High | 8.0 | 2021-10-22 | The affected product is vulnerable to a disclosure of peer username and password by allowing all users access to read global variables. |
CVE-2020-11303 | High | 8.6 | 2021-10-20 | Accepting AMSDU frames with mismatched destination and source address can lead to information disclosure in Snapdragon Auto, Snapdragon Connectivity, Snapdrago… |
CVE-2021-41140 | Medium | 5.3 | 2021-10-19 | Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post. In affected versions reactions given by user to… |
CVE-2021-39184 | Medium | 6.8 | 2021-10-12 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to 11.5.0, 12.1.0, an… |
CVE-2021-40497 | Medium | 5.3 | 2021-10-12 | SAP BusinessObjects Analysis (edition for OLAP) - versions 420, 430, allows an attacker to exploit certain application endpoints to read sensitive data. These… |
CVE-2021-40496 | Medium | 4.3 | 2021-10-12 | SAP Internet Communication framework (ICM) - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attacker with logon funct… |
CVE-2020-28145 | High | 7.5 | 2021-10-12 | Arbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via coreframe\app\attachment\admin\index.php, which allows attackers to access sensiti… |
CVE-2020-21503 | High | 7.5 | 2021-10-05 | waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture. By setting the… |
CVE-2021-41094 | Medium | 4.2 | 2021-10-04 | Wire is an open source secure messenger. Users of Wire by Bund may bypass the mandatory encryption at rest feature by simply disabling their device passcode. U… |
CVE-2021-22869 | Critical | 9.8 | 2021-09-24 | An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted runner group it should not have had acc… |