cve.bz

CWE-610: Externally Controlled Reference to a Resource in Another Sphere, page 4

Filter

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

What the weakness is: CWE-610 at MITRE. OWASP Top 10: A05:2025 Injection

Related attack patterns (CAPEC): 1
  • CAPEC-219 XML Routing Detour Attacks Likelihood: High · Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-610, as MITRE names them. Credits.

Ask an AI about CWE-610

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-610: Externally Controlled Reference to a Resource in Another Sphere and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/610.html and https://cve.bz/cve/cwe/610?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2022-2431EPSS 3.9%

    The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to insufficient file type and path validation on the deleteFiles() function found in the ~/Admin/Menu/P…

  2. 6.5CVE-2022-2638EPSS 1.2%

    The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be the CSV file. This could allow high privilege users to delete arbitrary file from the server

  3. 6.5CVE-2022-32761EPSS 2.9%

    An information disclosure vulnerability exists in the aVideoEncoderReceiveImage functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTT…

  4. 6.5CVE-2022-28710EPSS 2.7%

    An information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to tri…

  5. 7.8CVE-2022-20319EPSS 0.1%

    In DreamServices, there is a possible way to launch arbitrary protected activities due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploit…

  6. 9.8CVE-2022-20239EPSS 0.3%

    remap_pfn_range' here may map out of size kernel memory (for example, may map the kernel area), and because the 'vma->vm_page_prot' can also be controlled by userspace, so userspace may map the kernel area to be writable, which is easy to …

  7. 7.5CVE-2016-0796EPSS 1.3%

    WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and security bypass vulnerabilities because it fails to properly verify user-supplied input. An attacke…

  8. 4.3CVE-2015-10003EPSS 0.6%

    A vulnerability, which was classified as problematic, was found in FileZilla Server up to 0.9.50. This affects an unknown part of the component PORT Handler. The manipulation leads to unintended intermediary. It is possible to initiate the…

  9. 6.5CVE-2022-30245EPSS 1.3%

    Honeywell Alerton Compass Software 1.6.5 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the controller and then implemented. A user with malicious intent can send a crafted p…

  10. 7.8CVE-2022-20223EPSS 0.2%

    In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution p…

  11. 6.5CVE-2021-3779EPSS 1.2%

    A malicious MySQL server can request local file content from a client using ruby-mysql prior to version 2.10.0 without explicit authorization from the user. This issue was resolved in version 2.10.0 and later.

  12. 7.5CVE-2022-24241EPSS 1.0%

    ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp.

  13. 6.5CVE-2022-20789EPSS 1.4%

    A vulnerability in the software upgrade process of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to writ…

  14. 8.8CVE-2022-24854EPSS 1.1%

    Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called `ATTACH DATABASE`, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL perm…

  15. 7.8CVE-2021-39787EPSS 0.4%

    In SystemUI, there is a possible arbitrary Activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: Andr…

  16. 5.5CVE-2021-39765EPSS 0.1%

    In Gallery, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: An…

  17. 7.8CVE-2021-39707EPSS 0.1%

    In onReceive of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User…

  18. 7.8CVE-2021-39703EPSS 0.1%

    In updateState of UsbDeviceManager.java, there is a possible unauthorized access of files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not ne…

  19. 7.8CVE-2021-39668EPSS 0.1%

    In onActivityViewReady of DetailDialog.kt, there is a possible Intent Redirect due to a confused deputy. This could lead to local escalation of privilege that allows actions performed as the System UI, with no additional execution privileg…

  20. 7.8CVE-2021-39663EPSS 0.1%

    In openFileAndEnforcePathPermissionsHelper of MediaProvider.java, there is a possible bypass of a permissions check due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User inte…

  21. 7.8CVE-2021-39626EPSS 0.2%

    In onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege in Bluetooth settings with no additional execution privileges needed. Us…

  22. 7.8CVE-2021-1035EPSS 0.1%

    In setLaunchIntent of BluetoothDevicePickerPreferenceController.java, there is a possible way to invoke an arbitrary broadcast receiver due to a confused deputy. This could lead to local escalation of privilege with no additional execution…

  23. 7.5CVE-2021-3845EPSS 1.3%

    ws-scrcpy is vulnerable to External Control of File Name or Path

  24. 8.8CVE-2021-43844EPSS 3.4%

    MSEdgeRedirect is a tool to redirect news, search, widgets, weather, and more to a user's default browser. MSEdgeRedirect versions before 0.5.0.1 are vulnerable to Remote Code Execution via specifically crafted URLs. This vulnerability req…

  25. 7.8CVE-2021-1003EPSS 0.1%

    In adjustStreamVolume of AudioService.java, there is a possible way for unprivileged app to change audio stream volume due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges neede…

  26. 9.8CVE-2021-44041EPSS 1.8%

    UiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path supplied to the --dev-widget argument of the URI handler for uipath-assistant://. This allows an attacker to execute code on a victim's machine or ca…

  27. 5.3CVE-2021-43794EPSS 1.1%

    Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the users are shown a JSON blob instead of the HTML page. This can lead to a partial…

  28. 9.8CVE-2021-43685EPSS 1.2%

    libretime hv3.0.0-alpha.10 is affected by a path manipulation vulnerability in /blob/master/legacy/application/modules/rest/controllers/ShowImageController.php through the rename function.

  29. 7.2CVE-2021-41244EPSS 2.9%

    Grafana is an open-source platform for monitoring and observability. In affected versions when the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance admins are able to acces…

  30. 7.8CVE-2021-0708EPSS 0.1%

    In runDumpHeap of ActivityManagerShellCommand.java, there is a possible deletion of system files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is…

  31. 3.1CVE-2021-25740EPSS 2.0%

    A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack.

  32. 4.1CVE-2020-8561EPSS 2.1%

    A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiser…

  33. 7.8CVE-2021-0593EPSS 0.1%

    In sendDevicePickedIntent of DevicePickerFragment.java, there is a possible way to invoke a privileged broadcast receiver due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. Use…

  34. 7.3CVE-2021-0591EPSS 0.4%

    In sendReplyIntentToReceiver of BluetoothPermissionActivity.java, there is a possible way to invoke privileged broadcast receivers due to a confused deputy. This could lead to local escalation of privilege with User execution privileges ne…

  35. 6.5CVE-2020-21363EPSS 0.8%

    An arbitrary file deletion vulnerability exists within Maccms10.

  36. 5.5CVE-2020-23171EPSS 0.7%

    A vulnerability in all versions of Nim-lang allows unauthenticated attackers to write files to arbitrary directories via a crafted zip file with dot-slash characters included in the name of the crafted file.

  37. 7.8CVE-2021-32578EPSS 0.2%

    Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to improper soft link handling (issue 2 of 2).

  38. 7.8CVE-2021-32576EPSS 0.2%

    Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to improper soft link handling (issue 1 of 2).

  39. 8.5CVE-2021-32783EPSS 1.2%

    Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service may be used to access Envoy's admin interface, which Contour normally prevents from access outside…

  40. 7.5CVE-2021-32773EPSS 0.9%

    Racket is a general-purpose programming language and an ecosystem for language-oriented programming. In versions prior to 8.2, code evaluated using the Racket sandbox could cause system modules to incorrectly use attacker-created modules i…

  41. 5.5CVE-2021-0599EPSS 0.1%

    In scheduleTimeoutLocked of NotificationRecord.java, there is a possible disclosure of a sensitive identifier via broadcasted intent due to a confused deputy. This could lead to local information disclosure with no additional execution pri…

  42. 6.5CVE-2021-26920EPSS 9.5%

    In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with…

  43. 5.3CVE-2021-29965EPSS 0.7%

    A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the currently active website instead of the website that triggered the dialog. *This bug only af…

  44. 7.8CVE-2021-0608EPSS 0.1%

    In handleAppLaunch of AppLaunchActivity.java, there is a possible arbitrary activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not …

  45. 7.8CVE-2021-0550EPSS 0.1%

    In onLoadFailed of AnnotateActivity.java, there is a possible way to gain WRITE_EXTERNAL_STORAGE permissions without user consent due to a confused deputy. This could lead to local escalation of privilege with no additional execution privi…

  46. 7.8CVE-2021-0536EPSS 0.1%

    In dropFile of WiFiInstaller, there is a way to delete files accessible to CertInstaller due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not nee…

  47. 3.4CVE-2021-1306EPSS 0.2%

    A vulnerability in the restricted shell of Cisco Evolved Programmable Network (EPN) Manager, Cisco Identity Services Engine (ISE), and Cisco Prime Infrastructure could allow an authenticated, local attacker to identify directories and writ…

  48. 8.8CVE-2021-27648EPSS 2.8%

    Externally controlled reference to a resource in another sphere in quarantine functionality in Synology Antivirus Essential before 1.4.8-2801 allows remote authenticated users to obtain privilege via unspecified vectors.

  49. 8.8CVE-2021-30245EPSS 4.9%

    The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks. The problem has existed since about 2006 and the issue is also in 4.1.9. If the link is specifically crafted this could lea…

  50. 7.2CVE-2021-27183EPSS 2.7%

    An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to exploit an Arbitrary File Write vulnerability. An attacker is able to create new files in any location of the filesystem, or he may be able t…