CWE-668 · Exposure of Resource to Wrong Sphere (page 8)
Page 8 of 8 — CVEs classified under CWE-668, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-16603 | High | 8.8 | 2018-01-23 | This vulnerability allows remote attackers to execute code by creating arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.73… |
CVE-2017-16601 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. A… |
CVE-2017-16600 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to overwrite files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although au… |
CVE-2017-16599 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Alth… |
CVE-2017-16598 | High | 8.8 | 2018-01-23 | This vulnerability allows remote attackers to execute code by overwriting arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2… |
CVE-2017-16597 | Critical | 9.8 | 2018-01-23 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Auth… |
CVE-2017-16593 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Alth… |
CVE-2017-17087 | Medium | 5.5 | 2017-12-01 | fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group (which may be different from the group ownership of the… |
CVE-2017-12363 | Medium | 5.3 | 2017-11-30 | A vulnerability in Cisco WebEx Meeting Server could allow an unauthenticated, remote attacker to modify the welcome message of a meeting on an affected system… |
CVE-2017-12351 | Medium | 5.7 | 2017-11-30 | A vulnerability in the guest shell feature of Cisco NX-OS System Software could allow an authenticated, local attacker to read and send packets outside the sco… |
CVE-2017-12342 | Medium | 6.8 | 2017-11-30 | A vulnerability in the Open Agent Container (OAC) feature of Cisco Nexus Series Switches could allow an unauthenticated, local attacker to read and send packet… |
CVE-2017-8185 | High | 7.8 | 2017-11-22 | ME906s-158 earlier than ME906S_Installer_13.1805.10.3 versions has a privilege elevation vulnerability. An attacker could exploit this vulnerability to modify… |
CVE-2017-8171 | Medium | 4.6 | 2017-11-22 | Huawei smart phones with software earlier than Vicky-AL00AC00B172D versions have a Factory Reset Protection (FRP) bypass security vulnerability. When re-config… |
CVE-2017-8161 | Medium | 4.6 | 2017-11-22 | EVA-L09 smartphones with software Earlier than EVA-L09C25B150CUSTC25D003 versions,Earlier than EVA-L09C440B140 versions,Earlier than EVA-L09C464B361 versions,E… |
CVE-2017-16660 | High | 7.2 | 2017-11-08 | Cacti 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Path under the web root, and then making a… |
CVE-2017-15592 | High | 8.8 | 2017-10-18 | An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to cause a denial of service (hypervisor crash) or possibly gain privileges becaus… |
CVE-2017-12249 | Critical | 9.1 | 2017-09-13 | A vulnerability in the Traversal Using Relay NAT (TURN) server included with Cisco Meeting Server (CMS) could allow an authenticated, remote attacker to gain u… |
CVE-2017-6872 | Medium | 6.5 | 2017-08-08 | A vulnerability was discovered in Siemens OZW672 (all versions) and OZW772 (all versions) that could allow an attacker with access to port 21/tcp to access or… |
CVE-2017-11382 | High | 7.5 | 2017-08-03 | Denial of Service vulnerability in Trend Micro Deep Discovery Email Inspector 2.5.1 allows remote attackers to delete arbitrary files on vulnerable installatio… |
CVE-2017-0215 | Medium | 5.3 | 2017-06-15 | Microsoft Windows 10 1607 and Windows Server 2016 allow an attacker to exploit a security feature bypass vulnerability in Device Guard that could allow the att… |
CVE-2017-7490 | Medium | 5.3 | 2017-05-15 | In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing. |
CVE-2017-8418 | Low | 3.3 | 2017-05-02 | RuboCop 0.48.1 and earlier does not use /tmp in safe way, allowing local users to exploit this to tamper with cache files belonging to other users. |
CVE-2017-5648 | Critical | 9.1 | 2017-04-17 | While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8… |
CVE-2017-6100 | High | 7.5 | 2017-02-23 | tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP. |
CVE-2017-5634 | Medium | 6.6 | 2017-02-09 | The Norwegian Air Shuttle (aka norwegian.com) airline kiosk allows physically proximate attackers to bypass the intended "Please select booking identification"… |
CVE-2016-5334 | Medium | 5.3 | 2016-12-29 | VMware Identity Manager 2.x before 2.7.1 and vRealize Automation 7.x before 7.2.0 allow remote attackers to read /SAAS/WEB-INF and /SAAS/META-INF files via uns… |
CVE-2016-5787 | Medium | 6.3 | 2016-07-15 | General Electric (GE) Digital Proficy HMI/SCADA - CIMPLICITY before 8.2 SIM 27 mishandles service DACLs, which allows local users to modify a service configura… |
CVE-2013-4480 | | 2013-11-18 | Red Hat Satellite 5.6 and earlier does not disable the web interface that is used to create the first user for a satellite, which allows remote attackers to cr… | |
CVE-2012-1846 | | 2012-03-22 | Google Chrome 17.0.963.66 and earlier allows remote attackers to bypass the sandbox protection mechanism by leveraging access to a sandboxed process, as demons… | |
CVE-2011-1960 | | 2011-08-10 | Microsoft Internet Explorer 6 through 9 does not properly implement JavaScript event handlers, which allows remote attackers to access content from a different… | |
CVE-2011-1258 | | 2011-06-16 | Microsoft Internet Explorer 6 through 8 does not properly restrict web script, which allows user-assisted remote attackers to obtain sensitive information from… | |
CVE-2004-1489 | | 2004-12-31 | Opera 7.54 and earlier does not properly limit an applet's access to internal Java packages from Sun, which allows remote attackers to gain sensitive informati… | |
CVE-2001-0893 | | 2001-11-13 | Acme mini_httpd before 1.16 allows remote attackers to view sensitive files under the document root (such as .htpasswd) via a GET request with a trailing /. | |
CVE-2001-0892 | | 2001-11-13 | Acme Thttpd Secure Webserver before 2.22, with the chroot option enabled, allows remote attackers to view sensitive files under the document root (such as .htp… |