cve.bz

CWE-668: Exposure of Resource to Wrong Sphere, page 5

Filter

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

What the weakness is: CWE-668 at MITRE

Ask an AI about CWE-668

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-668: Exposure of Resource to Wrong Sphere and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/668.html and https://cve.bz/cve/cwe/668?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2023-36596EPSS 2.1%

    Remote Procedure Call Information Disclosure Vulnerability

  2. 6.5CVE-2023-36429EPSS 2.2%

    Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

  3. 5.3CVE-2023-30802EPSS 0.8%

    The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to a source code disclosure vulnerability. A remote and unauthenticated attacker can obtain PHP source code by sending an HTTP request with an invalid Content-Lengt…

  4. 3.3CVE-2023-44124EPSS 0.10%

    The vulnerability is to theft of arbitrary files with system privilege in the Screen recording ("com.lge.gametools.gamerecorder") app in the "com/lge/gametools/gamerecorder/settings/ProfilePreferenceFragment.java" file. The main problem is…

  5. 7.8CVE-2023-44122EPSS 0.1%

    The vulnerability is to theft of arbitrary files with system privilege in the LockScreenSettings ("com.lge.lockscreensettings") app in the "com/lge/lockscreensettings/dynamicwallpaper/MyCategoryGuideActivity.java" file. The main problem is…

  6. 7.5CVE-2023-43784EPSS 0.6%

    Plesk Onyx 17.8.11 has accessKeyId and secretAccessKey fields that are related to an Amazon AWS Firehose component. NOTE: the vendor's position is that there is no security threat.

  7. 7.5CVE-2023-43783EPSS 0.8%

    Cadence through 0.9.2 2023-08-21 uses an Insecure /tmp/cadence-wineasio.reg Temporary File. The filename is used even if it has been created by a local adversary before Cadence started. The adversary can leverage this to create or overwrit…

  8. 5.5CVE-2023-43782EPSS 0.3%

    Cadence through 0.9.2 2023-08-21 uses an Insecure /tmp/.cadence-aloop-daemon.x Temporary File. The file is used even if it has been created by a local adversary before Cadence started. The adversary can then delete the file, disrupting Cad…

  9. 4.8CVE-2023-31014EPSS 0.1%

    NVIDIA GeForce Now for Android contains a vulnerability in the game launcher component, where a malicious application on the same device can process the implicit intent meant for the streamer component. A successful exploit of this vulnera…

  10. 5.3CVE-2023-40788EPSS 0.8%

    SpringBlade <=V3.6.0 is vulnerable to Incorrect Access Control due to incorrect configuration in the default gateway resulting in unauthorized access to error logs

  11. 6.5CVE-2023-39056EPSS 0.5%

    An information leak in Coffee-jumbo v13.6.1 allows attackers to obtain the channel access token and send crafted messages.

  12. 6.5CVE-2023-39049EPSS 0.5%

    An information leak in youmart-tokunaga v13.6.1 allows attackers to obtain the channel access token and send crafted messages.

  13. 6.5CVE-2023-39046EPSS 0.5%

    An information leak in TonTon-Tei_waiting Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.

  14. 6.5CVE-2023-39058EPSS 0.5%

    An information leak in THE_B_members card v13.6.1 allows attackers to obtain the channel access token and send crafted messages.

  15. 6.5CVE-2023-39043EPSS 0.5%

    An information leak in YKC Tokushima_awayokocho Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.

  16. 6.5CVE-2023-39040EPSS 0.5%

    An information leak in Cheese Cafe Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.

  17. 6.5CVE-2023-39039EPSS 0.5%

    An information leak in Camp Style Project Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.

  18. 4.3CVE-2022-20917EPSS 0.9%

    A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) message processing feature of Cisco Jabber could allow an authenticated, remote attacker to manipulate the content of XMPP messages that are used by the affected appl…

  19. 5.5CVE-2023-38558EPSS 0.2%

    A vulnerability has been identified in SIMATIC PCS neo (Administration Console) V4.0 (All versions), SIMATIC PCS neo (Administration Console) V4.0 Update 1 (All versions). The affected application leaks Windows admin credentials. An attack…

  20. 5.3CVE-2023-38152EPSS 24%

    DHCP Server Service Information Disclosure Vulnerability

  21. 5.3CVE-2023-24965EPSS 0.5%

    IBM Aspera Faspex 5.0.5 does not restrict or incorrectly restricts access to a resource from an unauthorized actor. IBM X-Force ID: 246713.

  22. 5.5CVE-2023-41745EPSS 0.2%

    Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 30991, Acronis Cyber Protect 15 (Linux, macOS, Windows) before buil…

  23. 7.5CVE-2023-41742EPSS 0.5%

    Excessive attack surface due to binding to an unrestricted IP address. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 30430, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.

  24. 6.8CVE-2023-34725EPSS 0.5%

    An issue was discovered in TechView LA-5570 Wireless Gateway 1.0.19_T53, allows physical attackers to gain escalated privileges via a telnet connection.

  25. 5.3CVE-2023-4230EPSS 0.4%

    A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which has the potential to facilitate the collection of information on ioLogik 4000 Series devices. This vulnerability may enable …

  26. 5.3CVE-2023-39974EPSS 0.5%

    Exposure of Sensitive Information vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized actors to get the number of subscribers in a specific list.

  27. 5.5CVE-2023-39250EPSS 0.1%

    Dell Storage Integration Tools for VMware (DSITV) and Dell Storage vSphere Client Plugin (DSVCP) versions prior to 6.1.1 and Replay Manager for VMware (RMSV) versions prior to 3.1.2 contain an information disclosure vulnerability. A local …

  28. 5.3CVE-2023-2916EPSS 24%

    The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. This can allow authenticated attackers with subscriber-level permissions o…

  29. 7.5CVE-2023-39383EPSS 0.4%

    Vulnerability of input parameters being not strictly verified in the AMS module. Successful exploitation of this vulnerability may compromise apps' data security.

  30. 7.5CVE-2023-38830EPSS 0.7%

    An information leak in PHPJabbers Yacht Listing Script v1.0 allows attackers to export clients' credit card numbers from the Reservations module.

  31. 8.1CVE-2023-39214EPSS 1.0%

    Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial of service via network access.

  32. 7.5CVE-2023-38955EPSS 0.6%

    ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices, including their IP addresses and device names.

  33. 6.5CVE-2023-33368EPSS 0.5%

    Some API routes exists in Control ID IDSecure 4.7.26.0 and prior, exfiltrating sensitive information and passwords to users accessing these API routes.

  34. 7.3CVE-2023-3670EPSS 0.2%

    In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that co…

  35. 5.3CVE-2023-39155EPSS 0.5%

    Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it.

  36. 7.5CVE-2022-46901EPSS 0.6%

    An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is an Access Control Violation for Database Operations. The Vocera Report Console contains a websocket interface that allows for the unauthenticated ex…

  37. 6.5CVE-2023-34189EPSS 1.3%

    Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The attacker could use general users to delete and update the process, which only th…

  38. 5.3CVE-2023-37645ExploitEPSS 25%

    eyoucms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom_model_path/recruit.filelist.txt.

  39. 2.7CVE-2023-3299EPSS 0.6%

    HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11.

  40. 6.5CVE-2023-32760EPSS 0.5%

    An issue in Archer Platform before v.6.13 fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to obtain sensitive information via API calls related to data feeds and data publication.

  41. 6.5CVE-2023-32759EPSS 0.6%

    An issue in Archer Platform before v.6.13 and fixed in 6.12.0.6 and 6.13.0 allows an authenticated attacker to obtain sensitive information via a crafted URL.

  42. 7.5CVE-2023-37599ExploitEPSS 3.6%

    An issue in issabel-pbx v.4.0.0-6 allows a remote attacker to obtain sensitive information via the modules directory

  43. 7.8CVE-2023-34119EPSS 0.2%

    Insecure temporary file in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.

  44. 7.5CVE-2023-31818EPSS 1.0%

    An issue found in Marukyu Line v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp function.

  45. 4.3CVE-2023-30960EPSS 0.4%

    A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not have access to. This defect was resolved with the release of job-tracker 4.645.0. The service was roll…

  46. 7.5CVE-2023-3270EPSS 1.0%

    Exposure of Sensitive Information to an Unauthorized Actor in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the system.

  47. 7.5CVE-2023-35696EPSS 0.9%

    Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the device via HTTP requests.

  48. 5.3CVE-2023-3456EPSS 0.3%

    Vulnerability of kernel raw address leakage in the hang detector module. Successful exploitation of this vulnerability may affect service confidentiality.

  49. 9.1CVE-2023-3455EPSS 0.4%

    Key management vulnerability on system. Successful exploitation of this vulnerability may affect service availability and integrity.

  50. 8.1CVE-2023-32613EPSS 0.3%

    Exposure of resource to wrong sphere issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow a network-adjacent attacker to use functions originally available after login without logging in.