cve.bz

CWE-668: Exposure of Resource to Wrong Sphere, page 9

Filter

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

What the weakness is: CWE-668 at MITRE

Ask an AI about CWE-668

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-668: Exposure of Resource to Wrong Sphere and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/668.html and https://cve.bz/cve/cwe/668?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 3.3CVE-2022-33698EPSS 0.10%

    Exposure of Sensitive Information in Telecom application prior to SMR Jul-2022 Release 1 allows local attackers to access ICCID via log.

  2. 3.3CVE-2022-33696EPSS 0.10%

    Exposure of Sensitive Information in Telephony service prior to SMR Jul-2022 Release 1 allows local attacker to access imsi and iccid via log.

  3. 3.3CVE-2022-33694EPSS 0.10%

    Exposure of Sensitive Information in CSC application prior to SMR Jul-2022 Release 1 allows local attacker to access wifi information via unprotected intent broadcasting.

  4. 3.3CVE-2022-33692EPSS 0.10%

    Exposure of Sensitive Information in Messaging application prior to SMR Jul-2022 Release 1 allows local attacker to access imsi and iccid via log.

  5. 5.3CVE-2022-34464EPSS 0.4%

    A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.7.3). The affected application uses an improperly protected file to import SSH keys. This could allow attackers with access to the filesystem of the host on…

  6. 7.8CVE-2022-24139EPSS 0.4%

    In IOBit Advanced System Care (AscService.exe) 15, an attacker with SEImpersonatePrivilege can create a named pipe with the same name as one of ASCService's named pipes. ASCService first tries to connect before trying to create the named p…

  7. 4.9CVE-2021-46687EPSS 0.8%

    JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.31.10 versions prio…

  8. 9.1CVE-2013-4561EPSS 1.4%

    In a openshift node, there is a cron job to update mcollective facts that mishandles a temporary file. This may lead to loss of confidentiality and integrity.

  9. 3.3CVE-2021-20551EPSS 0.3%

    IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 199149.

  10. 7.8CVE-2022-32530EPSS 0.5%

    A CWE-668 Exposure of Resource to Wrong Sphere vulnerability exists that could cause users to be misled, hiding alarms, showing the wrong server connection option or the wrong control request when a mobile device has been compromised by a …

  11. 7.5CVE-2020-25459EPSS 1.0%

    An issue was discovered in function sync_tree in hetero_decision_tree_guest.py in WeBank FATE (Federated AI Technology Enabler) 0.1 through 1.4.2 allows attackers to read sensitive information during the training process of machine learnin…

  12. 7.8CVE-2022-28226EPSS 0.4%

    Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.801 allows a local, low privileged, attacker to execute arbitary code with the SYSTEM privileges through manipulating temporary files in directory with insecure pe…

  13. 7.5CVE-2022-31846ExploitEPSS 7.4%

    A vulnerability in live_mfg.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec cmd function.

  14. 7.5CVE-2022-31845ExploitEPSS 8.7%

    A vulnerability in live_check.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec cmd function.

  15. 9.8CVE-2022-29247EPSS 1.1%

    Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain acce…

  16. 7.5CVE-2022-31649EPSS 1.4%

    ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer.

  17. 8.8CVE-2021-36710EPSS 0.4%

    ToaruOS 1.99.2 is affected by incorrect access control via the kernel. Improper MMU management and having a low GDT address allows it to be mapped in userland. A call gate can then be written to escalate to CPL 0.

  18. 5.3CVE-2022-30734EPSS 0.6%

    Sensitive information exposure in Sign-out log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without permission.

  19. 7.5CVE-2022-30732EPSS 0.6%

    Exposure of Sensitive Information vulnerability in Samsung Account prior to version 13.2.00.6 allows attacker to access sensitive information via onActivityResult.

  20. 3.3CVE-2022-30728EPSS 0.1%

    Information exposure vulnerability in ScanPool prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information.

  21. 3.3CVE-2022-30714EPSS 0.1%

    Information exposure vulnerability in SemIWCMonitor prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information.

  22. 3.3CVE-2022-28794EPSS 0.09%

    Sensitive information exposure in low-battery dumpstate log prior to SMR Jun-2022 Release 1 allows local attackers to get SIM card information.

  23. 6.5CVE-2020-36532EPSS 1.0%

    A vulnerability has been found in Klapp App and classified as problematic. This vulnerability affects unknown code of the component Authorization. The manipulation leads to information disclosure (Credentials). The attack can be initiated …

  24. 9.8CVE-2022-26869EPSS 2.1%

    Dell PowerStore versions 2.0.0.x, 2.0.1.x and 2.1.0.x contains an open port vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure and arbitrary code execution.

  25. 9.9CVE-2022-1467EPSS 1.0%

    Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewable in the browser alongside the AVEVA InTouch Access Anywhere and Plant SCADA A…

  26. 6.5CVE-2022-28924EPSS 1.0%

    An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted GET request to the endpoint /api/students/me/courses/.

  27. 5.3CVE-2022-29646EPSS 0.8%

    An access control issue in TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 allows attackers to obtain sensitive information via a crafted web request.

  28. 7.8CVE-2021-43066EPSS 0.2%

    A external control of file name or path in Fortinet FortiClientWindows version 7.0.2 and below, version 6.4.6 and below, version 6.2.9 and below, version 6.0.10 and below allows attacker to escalate privilege via the MSI installer.

  29. 5.5CVE-2022-24823EPSS 1.0%

    Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are us…

  30. 8.6CVE-2022-24900ExploitEPSS 8.4%

    Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. Version 1.3 and prior are vulnerable to a path traversal attack. The `os.path.join` call is unsafe for use with untruste…

  31. 3.5CVE-2022-29820EPSS 0.4%

    In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possible

  32. 4.3CVE-2022-27331EPSS 0.7%

    An access control issue in Zammad v5.0.3 broadcasts administrative configuration changes to all users who have an active application instance, including settings that should only be visible to authenticated users.

  33. 4.6CVE-2022-1385EPSS 0.8%

    Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public …

  34. 4.4CVE-2022-27817EPSS 0.5%

    SWHKD 1.1.5 consumes the keyboard events of unintended users. This could potentially cause an information leak, but is usually a denial of functionality.

  35. 7.8CVE-2022-24411EPSS 0.2%

    Dell PowerScale OneFS 8.2.2 and above contain an elevation of privilege vulnerability. A local attacker with ISI_PRIV_LOGIN_SSH and/or ISI_PRIV_LOGIN_CONSOLE could potentially exploit this vulnerability, leading to elevation of privilege. …

  36. 5.5CVE-2022-23163EPSS 0.2%

    Dell PowerScale OneFS, 8.2,x, 9.1.0.x, 9.2.1.x, and 9.3.0.x contain a denial of service vulnerability. A local malicious user could potentially exploit this vulnerability, leading to denial of service/data unavailability.

  37. 7.8CVE-2021-42255EPSS 0.3%

    AppGuard Enterprise before 6.7.100.1 creates a Temporary File in a Directory with Insecure Permissions. Local users can gain SYSTEM privileges because a repair operation relies on the %TEMP% directory of an unprivileged user.

  38. 5.5CVE-2022-27822EPSS 0.1%

    Information exposure vulnerability in ril property setting prior to SMR April-2022 Release 1 allows access to EF_RUIMID value without permission.

  39. 3.3CVE-2022-27576EPSS 0.3%

    Information exposure vulnerability in Samsung DeX Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app information without permission

  40. 8.1CVE-2022-22515EPSS 1.3%

    A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify the configuration file(s) of the affected products.

  41. 9.1CVE-2022-27818EPSS 1.8%

    SWHKD 1.1.5 unsafely uses the /tmp/swhkd.sock pathname. There can be an information leak or denial of service.

  42. 4.3CVE-2022-26850EPSS 1.5%

    When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login Identity Providers configuration to the operating system temporary directory. On most platforms, the operating system temporary directory h…

  43. 8.8CVE-2022-21947EPSS 0.6%

    A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API (steve) to carry out arbitrary actions. This issue affects: SUSE Rancher Desktop versions…

  44. 7.8CVE-2022-27772EPSS 0.6%

    spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: Thi…

  45. 5.5CVE-2021-39777EPSS 0.1%

    In Telephony, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. U…

  46. 5.5CVE-2021-22572EPSS 0.1%

    On unix-like systems, the system temporary directory is shared between all users on that system. The root cause is File.createTempFile creates files in the the system temporary directory with world readable permissions. Any sensitive infor…

  47. 6.5CVE-2022-28160EPSS 1.1%

    Jenkins Tests Selector Plugin 1.3.3 and earlier allows users with Item/Configure permission to read arbitrary files on the Jenkins controller.

  48. 7.5CVE-2022-0315EPSS 1.0%

    Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0.

  49. 4.3CVE-2022-25041EPSS 0.8%

    OpenEMR v6.0.0 was discovered to contain an incorrect access control issue.

  50. 4.3CVE-2021-4180EPSS 0.8%

    An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking the www_authenticate_uri parameter (which is visible to all end us…