cve.bz

CWE-706: Use of Incorrectly-Resolved Name or Reference, page 3

Filter

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

What the weakness is: CWE-706 at MITRE. All weaknesses

Related attack patterns (CAPEC): 4
  • CAPEC-48 Passing Local Filenames to Functions That Expect a URL Likelihood: High · Severity: High
  • CAPEC-159 Redirect Access to Libraries Likelihood: High · Severity: Very High
  • CAPEC-177 Create files with the same name as files protected with a higher classification Severity: Very High
  • CAPEC-641 DLL Side-Loading Likelihood: Low · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-706, as MITRE names them. Credits.

Ask an AI about CWE-706

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-706: Use of Incorrectly-Resolved Name or Reference and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/706.html and https://cve.bz/cve/cwe/706?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2025-24733EPSS 0.6%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Akhtarujjaman Shuvo Post Grid Master ajax-filter-posts allows PHP Local File Inclusion.This issue affects Post Grid Ma…

  2. 4.9CVE-2024-57785EPSS 0.7%

    Zenitel AlphaWeb XE v11.2.3.10 was discovered to contain a local file inclusion vulnerability via the component amc_uploads.php.

  3. 4.3CVE-2024-55058EPSS 0.2%

    An insecure direct object reference (IDOR) vulnerability was discovered in PHPGurukul Online Birth Certificate System v1.0. This vulnerability resides in the viewid parameter of /user/view-application-detail.php. Authenticated users can ex…

  4. 9.8CVE-2024-53739EPSS 0.7%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Cool Plugins Cryptocurrency Widgets For Elementor cryptocurrency-widgets-for-elementor allows PHP Local File Inclusion…

  5. 6.5CVE-2024-52515EPSS 0.7%

    Nextcloud Server is a self hosted personal cloud system. After an admin enables the default-disabled SVG preview provider, a malicious user could upload a manipulated SVG file referencing paths. If the file would exist the preview of the S…

  6. 1.8CVE-2024-51746EPSS 0.1%

    Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor'…

  7. 2.5CVE-2024-45305EPSS 0.2%

    gix-path is a crate of the gitoxide project dealing with git paths and their conversions. `gix-path` executes `git` to find the path of a configuration file that belongs to the `git` installation itself, but mistakenly treats the local rep…

  8. 9.8CVE-2024-35198EPSS 0.8%

    TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. TorchServe 's check on allowed_urls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the …

  9. 7.5CVE-2024-4887EPSS 0.6%

    The Qi Addons For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.2 via the 'behavior' attributes found in the qi_addons_for_elementor_blog_list shortcode. This makes it possib…

  10. 6.5CVE-2024-37150EPSS 0.4%

    An issue in `.npmrc` support in Deno 1.44.0 was discovered where Deno would send `.npmrc` credentials for the scope to the tarball URL when the registry provided URLs for a tarball on a different domain. All users relying on .npmrc are pot…

  11. 5.3CVE-2024-36383EPSS 0.4%

    An issue was discovered in Logpoint SAML Authentication before 6.0.3. An attacker can place a crafted filename in the state field of a SAML SSO-URL response, and the file corresponding to this filename will ultimately be deleted. This can …

  12. 5.5CVE-2021-47276EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: ftrace: Do not blindly read the ip address in ftrace_bug() It was reported that a bug on arm64 caused a bad ip address to be used for updating into a nop in ftrace_init(…

  13. 7.8CVE-2021-47261EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix initializing CQ fragments buffer The function init_cq_frag_buf() can be called to initialize the current CQ fragments buffer cq->buf, or the temporary cq->r…

  14. 7.8CVE-2023-42125EPSS 0.4%

    Avast Premium Security Sandbox Protection Link Following Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Avast Premium Security. An attacker must first obtai…

  15. 7.5CVE-2024-27292ExploitEPSS 69%

    Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vu…

  16. 8.2CVE-2024-27295EPSS 0.7%

    Directus is a real-time API and App dashboard for managing SQL database content. The password reset mechanism of the Directus backend allows attackers to receive a password reset email of a victim user, specifically having it arrive at a s…

  17. 7.5CVE-2023-42451EPSS 0.7%

    Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances, attackers can exploit a flaw in domain name normalization to spoof domains the…

  18. 7.5CVE-2023-34092ExploitEPSS 3.2%

    Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options (`server.fs.deny`) can be bypassed using double forward-slash (//) allows any unauthenticated user to read file from the V…

  19. 9.8CVE-2023-31814EPSS 0.9%

    D-Link DIR-300 firmware <=REVA1.06 and <=REVB2.06 is vulnerable to File inclusion via /model/__lang_msg.php.

  20. 8.8CVE-2023-28643EPSS 0.8%

    Nextcloud server is an open source home cloud implementation. In affected versions when a recipient receives 2 shares with the same name, while a memory cache is configured, the second share will replace the first one instead of being rena…

  21. 6.1CVE-2023-28628EPSS 0.5%

    lambdaisland/uri is a pure Clojure/ClojureScript URI library. In versions prior to 1.14.120 `authority-regex` allows an attacker to send malicious URLs to be parsed by the `lambdaisland/uri` and return the wrong authority. This issue is si…

  22. 7.0CVE-2023-27561EPSS 0.4%

    runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be…

  23. 9.1CVE-2021-37315EPSS 1.1%

    Incorrect Access Control issue discoverd in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to write arbitrary files via improper sanitation on the source for COPY and MOVE operations.

  24. 9.8CVE-2022-30258EPSS 0.7%

    An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V2 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious d…

  25. 9.8CVE-2022-30257EPSS 0.7%

    An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V1 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious d…

  26. 4.7CVE-2022-41874EPSS 0.5%

    Tauri is a framework for building binaries for all major desktop platforms. In versions prior to 1.0.7 and 1.1.2, Tauri is vulnerable to an Incorrectly-Resolved Name. Due to incorrect escaping of special characters in paths selected via th…

  27. 6.5CVE-2022-30621EPSS 0.7%

    Allows a remote user to read files on the camera's OS "GetFileContent.cgi". Reading arbitrary files on the camera's OS as root user.

  28. 7.5CVE-2022-31089EPSS 1.2%

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions certain types of invalid files requests are not handled properly and can crash the server. If you are running mult…

  29. 8.1CVE-2022-27778EPSS 3.8%

    A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.

  30. 4.9CVE-2022-29448EPSS 1.0%

    Authenticated (admin or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Herd Effects plugin <= 5.2 at WordPress.

  31. 7.2CVE-2022-29445EPSS 1.1%

    Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress.

  32. 6.8CVE-2022-28198EPSS 0.3%

    NVIDIA Omniverse Nucleus and Cache contain a vulnerability in its configuration of OpenSSL, where an attacker with physical access to the system can cause arbitrary code execution which can impact confidentiality, integrity, and availabili…

  33. 6.1CVE-2022-0855EPSS 1.0%

    Improper Resolution of Path Equivalence in GitHub repository microweber-dev/whmcs_plugin prior to 0.0.4.

  34. 7.5CVE-2021-40856ExploitEPSS 50%

    Auerswald COMfortel 1400 IP and 2600 IP before 2.8G devices allow Authentication Bypass via the /about/../ substring.

  35. 9.8CVE-2021-40539KEVExploitEPSS 99%

    Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.

  36. 7.5CVE-2021-39156EPSS 1.2%

    Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a…

  37. 4.3CVE-2021-37215EPSS 0.7%

    The employee management page of Flygo contains an Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attacker can manipulate the user data and then over-write another employee’s user …

  38. 8.8CVE-2021-37214EPSS 1.1%

    The employee management page of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID in specific parameters to arbitrary access e…

  39. 4.3CVE-2021-37213EPSS 0.8%

    The check-in record page of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID and date in specific parameters to access partic…

  40. 5.4CVE-2021-37212EPSS 0.6%

    The bulletin function of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers can manipulate the bulletin ID in specific Url parameters and access and modify bu…

  41. 3.7CVE-2021-22924EPSS 6.3%

    libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compar…

  42. 9.1CVE-2021-37144EPSS 1.3%

    CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion. This occurs in PHP when the unlink() function is called and user input might affect portions of or the whole affected parameter, which represents the path of the file to remove, witho…

  43. 6.5CVE-2021-31920EPSS 1.3%

    Istio before 1.8.6 and 1.9.x before 1.9.5 has a remotely exploitable vulnerability where an HTTP request path with multiple slashes or escaped slash characters (%2F or %5C) could potentially bypass an Istio authorization policy when path b…

  44. 6.1CVE-2021-32054EPSS 1.0%

    Firely/Incendi Spark before 1.5.5-r4 lacks Content-Disposition headers in certain situations, which may cause crafted files to be delivered to clients such that they are rendered directly in a victim's web browser.

  45. 7.2CVE-2021-31933ExploitEPSS 14%

    A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and improper file-extension filtering for certain filenames (e.g., .phar or .pht). A remote au…

  46. 7.5CVE-2021-27306EPSS 1.8%

    An improper access control vulnerability in the JWT plugin in Kong Gateway prior to 2.3.2.0 allows unauthenticated users access to authenticated routes without a valid token JWT.

  47. 4.9CVE-2020-4719EPSS 0.9%

    The IBM Cloud APM 8.1.4 server will issue a DNS request to resolve any hostname specified in the Cloud Event Management Webhook URL configuration definition. This could enable an authenticated user with admin authorization to create DNS qu…

  48. 5.3CVE-2020-35566EPSS 1.2%

    An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An attacker can read arbitrary JSON files via Local File Inclusion.

  49. 9.8CVE-2020-23448EPSS 1.6%

    newbee-mall all versions are affected by incorrect access control to remotely gain privileges through AdminLoginInterceptor.java. The authentication logic of the system's background /admin is in code AdminLoginInterceptor, which can be byp…

  50. 5.9CVE-2021-24122EPSS 23%

    When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some confi…