cve.bz

CWE-668: Exposure of Resource to Wrong Sphere, page 16

Filter

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

What the weakness is: CWE-668 at MITRE

Ask an AI about CWE-668

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-668: Exposure of Resource to Wrong Sphere and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/668.html and https://cve.bz/cve/cwe/668?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 3.3CVE-2017-8418EPSS 0.4%

    RuboCop 0.48.1 and earlier does not use /tmp in safe way, allowing local users to exploit this to tamper with cache files belonging to other users.

  2. 9.1CVE-2017-5648EPSS 13%

    While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When runnin…

  3. 7.5CVE-2017-6100EPSS 1.5%

    tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP.

  4. 6.6CVE-2017-5634EPSS 0.4%

    The Norwegian Air Shuttle (aka norwegian.com) airline kiosk allows physically proximate attackers to bypass the intended "Please select booking identification" UI step, and obtain administrative privileges and network access on the underly…

  5. 5.3CVE-2016-5334EPSS 2.1%

    VMware Identity Manager 2.x before 2.7.1 and vRealize Automation 7.x before 7.2.0 allow remote attackers to read /SAAS/WEB-INF and /SAAS/META-INF files via unspecified vectors.

  6. 6.3CVE-2016-5787EPSS 0.4%

    General Electric (GE) Digital Proficy HMI/SCADA - CIMPLICITY before 8.2 SIM 27 mishandles service DACLs, which allows local users to modify a service configuration via unspecified vectors.

  7. –CVE-2013-4480EPSS 2.1%

    Red Hat Satellite 5.6 and earlier does not disable the web interface that is used to create the first user for a satellite, which allows remote attackers to create administrator accounts.

  8. –CVE-2012-1846EPSS 4.2%

    Google Chrome 17.0.963.66 and earlier allows remote attackers to bypass the sandbox protection mechanism by leveraging access to a sandboxed process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012. NOTE: the prim…

  9. –CVE-2011-1960EPSS 18%

    Microsoft Internet Explorer 6 through 9 does not properly implement JavaScript event handlers, which allows remote attackers to access content from a different (1) domain or (2) zone via unspecified script code, aka "Event Handlers Informa…

  10. –CVE-2011-1258EPSS 15%

    Microsoft Internet Explorer 6 through 8 does not properly restrict web script, which allows user-assisted remote attackers to obtain sensitive information from a different (1) domain or (2) zone via vectors involving a drag-and-drop operat…

  11. –CVE-2004-1489EPSS 2.0%

    Opera 7.54 and earlier does not properly limit an applet's access to internal Java packages from Sun, which allows remote attackers to gain sensitive information, such as user names and the installation directory.

  12. –CVE-2001-0893EPSS 2.5%

    Acme mini_httpd before 1.16 allows remote attackers to view sensitive files under the document root (such as .htpasswd) via a GET request with a trailing /.

  13. –CVE-2001-0892EPSS 1.9%

    Acme Thttpd Secure Webserver before 2.22, with the chroot option enabled, allows remote attackers to view sensitive files under the document root (such as .htpasswd) via a GET request with a trailing /.