cve.bz

CWE-668: Exposure of Resource to Wrong Sphere, page 6

Filter

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

What the weakness is: CWE-668 at MITRE

Ask an AI about CWE-668

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-668: Exposure of Resource to Wrong Sphere and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/668.html and https://cve.bz/cve/cwe/668?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 2.4CVE-2023-32394EPSS 0.3%

    The issue was addressed with improved checks. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, tvOS 16.5, macOS Ventura 13.4. A person with physical access to a device may be able to view contact information from the lock scre…

  2. 7.5CVE-2023-35151EPSS 0.7%

    XWiki Platform is a generic wiki platform. Starting in version 7.3-milestone-1 and prior to versions 14.4.8, 14.10.6, and 15.1, ny user can call a REST endpoint and obtain the obfuscated passwords, even when the mail obfuscation is activat…

  3. 7.5CVE-2023-34467EPSS 1.0%

    XWiki Platform is a generic wiki platform. Starting in version 3.5-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, the mail obfuscation configuration was not fully taken into account. While the mail displayed to the end u…

  4. 6.8CVE-2023-2820EPSS 0.2%

    An information disclosure vulnerability in the faye endpoint in Proofpoint Threat Response / Threat Response Auto-Pull (PTR/TRAP) could be used by an attacker on an adjacent network to obtain credentials to integrated services via a man-in…

  5. 4.7CVE-2023-32019EPSS 1.4%

    Windows Kernel Information Disclosure Vulnerability

  6. 5.3CVE-2023-29355EPSS 1.3%

    DHCP Server Service Information Disclosure Vulnerability

  7. 5.3CVE-2023-34250EPSS 0.4%

    Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, an attacker could use the new topics dismissal endpoint to reveal the number …

  8. 6.5CVE-2023-34114EPSS 1.0%

    Exposure of resource to wrong sphere in Zoom for Windows and Zoom for MacOS clients before 5.14.10 may allow an authenticated user to potentially enable information disclosure via network access.

  9. 6.5CVE-2022-43684EPSS 1.8%

    ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow Core functionality. Additional Details This issue is present in the following supported ServiceNow releases: * Q…

  10. 7.8CVE-2023-29403EPSS 0.4%

    On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descript…

  11. 7.5CVE-2023-33510ExploitEPSS 4.1%

    Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters.

  12. 8.2CVE-2023-32550EPSS 0.4%

    Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further information from the Landscape API.

  13. 5.5CVE-2022-40525EPSS 0.1%

    Information disclosure in Linux Networking Firmware due to unauthorized information leak during side channel analysis.

  14. 5.5CVE-2022-40523EPSS 0.1%

    Information disclosure in Kernel due to indirect branch misprediction.

  15. 5.3CVE-2023-33518EPSS 0.5%

    emoncms v11 and later was discovered to contain an information disclosure vulnerability which allows attackers to obtain the web directory path and other information leaked by the server via a crafted web request.

  16. 4.3CVE-2023-29538EPSS 0.4%

    Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-extension:///</code> URI during a load request. This leaked directory paths on the user's machine. This vulnerability affe…

  17. 4.3CVE-2023-25750EPSS 0.5%

    Under certain circumstances, a ServiceWorker's offline cache may have leaked to the file system when using private browsing mode. This vulnerability affects Firefox < 111.

  18. 6.2CVE-2023-2062EPSS 0.3%

    Missing Password Field Masking vulnerability in Mitsubishi Electric Corporation EtherNet/IP configuration tools SW1DNN-EIPCT-BD and SW1DNN-EIPCTFX5-BD allows a remote unauthenticated attacker to know the password for MELSEC iQ-R Series Eth…

  19. 7.1CVE-2023-28344EPSS 0.9%

    An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application allows unauthenticated attackers to view constantly updated screenshots of student desktops and to submit falsified screenshots on b…

  20. 7.5CVE-2023-2703EPSS 0.6%

    Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Finex Media Competition Management System allows Retrieve Embedded Sensitive Data, Collect Data as Provided by Users. This issue affects Competition Manage…

  21. 5.3CVE-2023-33293EPSS 0.6%

    An issue was discovered in KaiOS 3.0 and 3.1. The binary /system/kaios/api-daemon exposes a local web server on *.localhost with subdomains for each installed applications, e.g., myapp.localhost. An attacker can make fetch requests to api-…

  22. 7.5CVE-2023-31103EPSS 1.3%

    Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0.  Attackers can change the immutable name and type of cluster of InLong. Users are ad…

  23. 7.5CVE-2023-31206EPSS 1.2%

    Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers can change the immutable name and type of nodes of InLong. Users are advis…

  24. 6.5CVE-2023-2025EPSS 0.5%

    OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 may expose sensitive information to an unauthorized user under certain circumstances.

  25. 5.3CVE-2023-23448EPSS 0.8%

    Inclusion of Sensitive Information in Source Code in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote attacker to gain information about valid usernames via analysis o…

  26. 5.5CVE-2023-29820EPSS 0.2%

    An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to access sensitive information via the EXE installer. NOTE: the vendor's perspective is that this is not a separate vulner…

  27. 7.5CVE-2023-27564EPSS 1.2%

    The n8n package 0.218.0 for Node.js allows Information Disclosure.

  28. 7.8CVE-2022-40210EPSS 0.2%

    Exposure of data element to wrong session in the Intel DCM software before version 5.0.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

  29. 5.5CVE-2022-38087EPSS 0.2%

    Exposure of resource to wrong sphere in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.

  30. 4.3CVE-2023-2069EPSS 0.8%

    An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.10.7, all versions starting from 13.0 before 13.0.1. A user with the role of developer could use the…

  31. 6.5CVE-2023-0485EPSS 1.0%

    An issue has been discovered in GitLab affecting all versions starting from 13.11 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible that a project member demoted …

  32. 5.5CVE-2023-22307EPSS 0.2%

    Sensitive data exposure in Webconf in Tribe29 Checkmk Appliance before 1.6.4 allows local attacker to retrieve passwords via reading log files.

  33. 8.8CVE-2023-27976EPSS 0.8%

    A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause remote code execution when a valid user visits a malicious link provided through the web endpoints. Affected Products: EcoStruxure Control Expert (V15.1 …

  34. 4.3CVE-2021-30153EPSS 0.8%

    An issue was discovered in the VisualEditor extension in MediaWiki before 1.31.13, and 1.32.x through 1.35.x before 1.35.2. . When using VisualEditor to edit a MediaWiki user page belonging to an existing, but hidden, user, VisualEditor wi…

  35. 7.5CVE-2023-29208EPSS 0.9%

    XWiki Commons are technical libraries common to several other top level XWiki projects. Rights added to a document are not taken into account for viewing it once it's deleted. Note that this vulnerability only impact deleted documents that…

  36. 5.3CVE-2023-29203EPSS 0.7%

    XWiki Commons are technical libraries common to several other top level XWiki projects. It's possible to list some users who are normally not viewable from subwiki by requesting users on a subwiki which allows only global users with `uorgs…

  37. 5.5CVE-2023-25954EPSS 0.3%

    KYOCERA Mobile Print' v3.2.0.230119 and earlier, 'UTAX/TA MobilePrint' v3.2.0.230119 and earlier, and 'Olivetti Mobile Print' v3.2.0.230119 and earlier are vulnerable to improper intent handling. When a malicious app is installed on the vi…

  38. 8.1CVE-2023-25409EPSS 0.8%

    Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. Restricted users have access to other users outlets.

  39. 7.1CVE-2022-47338EPSS 0.09%

    In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.

  40. 7.5CVE-2023-26588EPSS 0.6%

    Use of hard-coded credentials vulnerability in Buffalo network devices allows an attacker to access the debug function of the product. The affected products and versions are as follows: BS-GSL2024 firmware Ver. 1.10-0.03 and earlier, BS-GS…

  41. 8.7CVE-2023-26458EPSS 0.6%

    An information disclosure vulnerability exists in SAP Landscape Management - version 3.0, enterprise edition. It allows an authenticated SAP Landscape Management user to obtain privileged access to other systems making those other systems …

  42. 4.3CVE-2023-29192EPSS 0.4%

    SilverwareGames.io versions before 1.2.19 allow users with access to the game upload panel to edit download links for games uploaded by other developers. This has been fixed in version 1.2.19.

  43. 5.3CVE-2023-1777EPSS 0.5%

    Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of the linked message.

  44. 6.5CVE-2023-1775EPSS 0.5%

    When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently con…

  45. 4.3CVE-2023-28336EPSS 0.7%

    Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access.

  46. 4.3CVE-2023-1402EPSS 0.7%

    The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.

  47. 8.8CVE-2023-28433EPSS 1.0%

    Minio is a Multi-Cloud Object Storage framework. All users on Windows prior to version RELEASE.2023-03-20T20-16-18Z are impacted. MinIO fails to filter the `\` character, which allows for arbitrary object placement across buckets. As a res…

  48. 4.3CVE-2023-1562EPSS 0.5%

    Mattermost fails to check the "Show Full Name" setting when rendering the result for the /plugins/focalboard/api/v2/users API call, allowing an attacker to learn the full name of a board owner.

  49. 9.1CVE-2020-22647EPSS 0.7%

    An issue found in DepositGame v.1.0 allows an attacker to gain sensitive information via the GetBonusWithdraw and withdraw functions.

  50. 6.5CVE-2023-24906EPSS 1.5%

    Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability