cve.bz

CWE-610: Externally Controlled Reference to a Resource in Another Sphere, page 2

Filter

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

What the weakness is: CWE-610 at MITRE. OWASP Top 10: A05:2025 Injection

Related attack patterns (CAPEC): 1
  • CAPEC-219 XML Routing Detour Attacks Likelihood: High · Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-610, as MITRE names them. Credits.

Ask an AI about CWE-610

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-610: Externally Controlled Reference to a Resource in Another Sphere and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/610.html and https://cve.bz/cve/cwe/610?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.5CVE-2025-10092EPSS 0.6%

    A vulnerability was found in Jinher OA up to 1.2. This impacts an unknown function of the file /c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx/?Type=add of the component XML Handler. The manipulation results in xml external entity ref…

  2. 5.5CVE-2025-10091EPSS 0.6%

    A vulnerability has been found in Jinher OA up to 1.2. This affects an unknown function of the file /c6/Jhsoft.Web.projectmanage/ProjectManage/XmlHttp.aspx/?Type=add of the component XML Handler. The manipulation leads to xml external enti…

  3. 5.5CVE-2024-49728EPSS 0.09%

    In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interactio…

  4. 5.5CVE-2024-49722EPSS 0.1%

    In showAvatarPicker of EditUserPhotoController.java, there is a possible cross user image leak due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is no…

  5. 7.3CVE-2025-48963EPSS 0.1%

    Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40296.

  6. 4.0CVE-2025-26417EPSS 0.3%

    In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening files in shared storage due to a confused deputy. This could lead to local information disclosure with no additional execu…

  7. 5.5CVE-2025-0082EPSS 0.10%

    In multiple functions of StatusHint.java and TelecomServiceImpl.java, there is a possible way to reveal images across users due to a confused deputy. This could lead to local information disclosure with no additional execution privileges n…

  8. 6.9CVE-2015-10142EPSS 0.6%

    Sitecore Experience Platform (XP) prior to 8.0 Initial Release (rev. 141212) and Content Management System (CMS) prior to 7.2 Update-3 (rev. 141226) and prior to 7.5 Update-1 (rev. 150130) contain a vulnerability that may allow an attacker…

  9. 5.5CVE-2025-7824EPSS 0.6%

    A vulnerability was found in Jinher OA 1.1. It has been rated as problematic. This issue affects some unknown processing of the file XmlHttp.aspx. The manipulation leads to xml external entity reference. The attack may be initiated remotel…

  10. 5.5CVE-2025-7823EPSS 0.6%

    A vulnerability was found in Jinher OA 1.2. It has been declared as problematic. This vulnerability affects unknown code of the file ProjectScheduleDelete.aspx. The manipulation leads to xml external entity reference. The attack can be ini…

  11. 5.5CVE-2025-7523EPSS 0.7%

    A vulnerability was found in Jinher OA 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx. The manipulation leads to xml external entity reference…

  12. 8.1CVE-2025-6691EPSS 1.0%

    The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.7.…

  13. 2.1CVE-2025-5877EPSS 0.4%

    A vulnerability, which was classified as problematic, has been found in Fengoffice Feng Office 3.2.2.1. Affected by this issue is some unknown functionality of the file /application/models/ApplicationDataObject.class.php of the component D…

  14. 8.7CVE-2025-2875EPSS 0.4%

    CWE-610: Externally Controlled Reference to a Resource in Another Sphere vulnerability exists that could cause a loss of confidentiality when an unauthenticated attacker manipulates controller’s webserver URL to access resources.

  15. 6.7CVE-2025-26684EPSS 0.4%

    External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.

  16. 5.2CVE-2024-13177EPSS 0.1%

    Netskope Client on Mac OS is impacted by a vulnerability in which the postinstall script does not properly validate the path of the file “nsinstallation”. A standard user could potentially create a symlink of the file “nsinstallation” to e…

  17. 5.3CVE-2025-3241EPSS 0.7%

    A vulnerability, which was classified as problematic, was found in zhangyanbo2007 youkefu up to 4.2.0. This affects an unknown part of the file src/main/java/com/ukefu/webim/web/handler/admin/callcenter/CallCenterRouterController.java of t…

  18. 5.3CVE-2025-2365EPSS 0.4%

    A vulnerability, which was classified as problematic, has been found in crmeb_java up to 1.3.4. Affected by this issue is the function webHook of the file WeChatMessageController.java. The manipulation leads to xml external entity referenc…

  19. 7.5CVE-2024-51961EPSS 0.5%

    There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files fr…

  20. 7.1CVE-2025-0111KEVEPSS 2.0%

    An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobod…

  21. 5.3CVE-2025-1225EPSS 0.4%

    A vulnerability, which was classified as problematic, has been found in ywoa up to 2024.07.03. This issue affects the function extract of the file c-main/src/main/java/com/redmoon/weixin/aes/XMLParse.java of the component WXCallBack Interf…

  22. 6.1CVE-2022-23439EPSS 0.5%

    A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an arbitrary webserver

  23. 9.0CVE-2025-22144EPSS 0.8%

    NamelessMC is a free, easy to use & powerful website software for Minecraft servers. A user with admincp.core.emails or admincp.users.edit permissions can validate users and an attacker can reset their password. When the account is success…

  24. 9.4CVE-2024-42168EPSS 0.4%

    HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability. An attacker can deploy a web server that returns malicious content, and then induce the application to retrieve and process that content.

  25. 6.5CVE-2024-52792EPSS 0.7%

    LDAP Account Manager (LAM) is a php webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In affected versions LAM does not properly sanitize configuration values, that are set via `mainmanage.ph…

  26. 8.8CVE-2024-10979EPSS 4.4%

    Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attac…

  27. 9.1CVE-2024-5823EPSS 0.5%

    A file overwrite vulnerability exists in gaizhenbiao/chuanhuchatgpt versions <= 20240410. This vulnerability allows an attacker to gain unauthorized access to overwrite critical configuration files within the system. Exploiting this vulner…

  28. 8.2CVE-2024-47773ExploitEPSS 1.8%

    Discourse is an open source platform for community discussion. An attacker can make several XHR requests until the cache is poisoned with a response without any preloaded data. This issue only affects anonymous visitors of the site. This p…

  29. 8.5CVE-2024-45826EPSS 12%

    CVE-2024-45826 IMPACT Due to improper input validation, a path traversal and remote code execution vulnerability exists when the ThinManager® processes a crafted POST request. If exploited, a user can install an executable file.

  30. 6.7CVE-2024-8207EPSS 0.2%

    In certain highly specific configurations of the host system and MongoDB server binary installation on Linux Operating Systems, it may be possible for a unintended actor with host-level access to cause the MongoDB Server binary to load uni…

  31. 5.3CVE-2024-7911EPSS 0.7%

    A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as critical. This affects an unknown part of the file /simple-online-bidding-system/bidding/index.php. The manipulation of the argument pa…

  32. 5.8CVE-2024-7625EPSS 0.3%

    In HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.6.13, 1.7.10, and 1.8.2, the archive unpacking process is vulnerable to writes outside the allocation directory during migration of allocation directories when multiple archive hea…

  33. 5.4CVE-2024-6079EPSS 0.2%

    A vulnerability exists in the Rockwell Automation Emulate3D™, which could be leveraged to execute a DLL Hijacking attack. The application loads shared libraries, which are readable and writable by any user. If exploited, a malicious user c…

  34. 7.5CVE-2024-28962EPSS 0.4%

    Dell Command | Update, Dell Update, and Alienware Update UWP, versions prior to 5.4, contain an Exposed Dangerous Method or Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability…

  35. 7.3CVE-2024-29069EPSS 0.2%

    In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file…

  36. 8.6CVE-2024-6717EPSS 0.4%

    HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to path escaping of the allocation directory. This vulnerability, CVE-2024-6717, is fixed in Nomad 1.6.13, 1.7.10, and 1.8.…

  37. 7.8CVE-2024-31319EPSS 0.2%

    In updateNotificationChannelFromPrivilegedListener of NotificationManagerService.java, there is a possible cross-user data leak due to a confused deputy. This could lead to local escalation of privilege with no additional execution privile…

  38. 8.1CVE-2024-38049EPSS 1.6%

    Windows Distributed Transaction Coordinator Remote Code Execution Vulnerability

  39. 8.1CVE-2024-28826EPSS 0.5%

    Improper restriction of local upload and download paths in check_sftp in Checkmk before 2.3.0p4, 2.2.0p27, 2.1.0p44, and in Checkmk 2.0.0 (EOL) allows attackers with sufficient permissions to configure the check to read and write local fil…

  40. 9.1CVE-2024-32980EPSS 0.5%

    Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to…

  41. 7.8CVE-2023-6154EPSS 0.2%

    A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender Antivirus Free allows an attacker to change the product's expected behavior and po…

  42. 5.9CVE-2024-24818EPSS 0.6%

    EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" page and redirect victim to malicious page that could lead to credential stealing or another attack. T…

  43. 9.8CVE-2024-25117EPSS 0.9%

    php-svg-lib is a scalable vector graphics (SVG) file parsing/rendering library. Prior to version 0.5.2, php-svg-lib fails to validate that font-family doesn't contain a PHAR url, which might leads to RCE on PHP < 8.0, and doesn't validate …

  44. 7.8CVE-2024-23639EPSS 0.3%

    Micronaut Framework is a modern, JVM-based, full stack Java framework designed for building modular, easily testable JVM applications with support for Java, Kotlin and the Groovy language. Enabled but unsecured management endpoints are sus…

  45. 7.5CVE-2024-1329EPSS 0.6%

    HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. This vulnerability, CVE-2024-1329, is fixed in Nomad 1…

  46. 7.3CVE-2024-24760EPSS 0.9%

    mailcow is a dockerized email package, with multiple containers linked in one bridged network. A security vulnerability has been identified in mailcow affecting versions < 2024-01c. This vulnerability potentially allows attackers on the sa…

  47. 4.4CVE-2020-36772EPSS 0.4%

    CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allows local users to read and write arbitrary files of certain file formats outside the CageFS environment.

  48. 9.8CVE-2024-0728EPSS 0.7%

    A vulnerability classified as problematic was found in ForU CMS up to 2020-06-23. Affected by this vulnerability is an unknown functionality of the file channel.php. The manipulation of the argument c_cmodel leads to file inclusion. The at…

  49. 6.5CVE-2023-49864EPSS 1.1%

    An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.This vulnerab…

  50. 6.5CVE-2023-49863EPSS 1.1%

    An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.This vulnerab…