cve.bz

CWE-706: Use of Incorrectly-Resolved Name or Reference, page 4

Filter

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

What the weakness is: CWE-706 at MITRE. All weaknesses

Related attack patterns (CAPEC): 4
  • CAPEC-48 Passing Local Filenames to Functions That Expect a URL Likelihood: High · Severity: High
  • CAPEC-159 Redirect Access to Libraries Likelihood: High · Severity: Very High
  • CAPEC-177 Create files with the same name as files protected with a higher classification Severity: Very High
  • CAPEC-641 DLL Side-Loading Likelihood: Low · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-706, as MITRE names them. Credits.

Ask an AI about CWE-706

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-706: Use of Incorrectly-Resolved Name or Reference and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/706.html and https://cve.bz/cve/cwe/706?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2020-35894EPSS 1.2%

    An issue was discovered in the obstack crate before 0.1.4 for Rust. Unaligned references can occur.

  2. 7.5CVE-2020-35623EPSS 1.1%

    An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper username validation, it allowed user impersonation with trivial manipulations of certain characters within a given username. An ordinary user ma…

  3. 7.3CVE-2020-26233EPSS 6.0%

    Git Credential Manager Core (GCM Core) is a secure Git credential helper built on .NET Core that runs on Windows and macOS. In Git Credential Manager Core before version 2.0.289, when recursively cloning a Git repository on Windows with su…

  4. 4.3CVE-2020-13311EPSS 1.5%

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Wiki was vulnerable to a parser attack that prohibits anyone from accessing the Wiki functionality through the user interface.

  5. 9.8CVE-2020-15505KEVExploitEPSS 99.7%

    A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2 and earlier, and 9.8.0; and Monitor and …

  6. 9.8CVE-2020-12279EPSS 5.1%

    An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is simil…

  7. 9.8CVE-2020-12278EPSS 5.2%

    An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue i…

  8. 9.8CVE-2020-10574EPSS 1.4%

    An issue was discovered in Janus through 0.9.1. janus.c tries to use a string that doesn't actually exist during a "query_logger" Admin API request, because of a typo in the JSON validation.

  9. 7.0CVE-2019-19921EPSS 0.4%

    runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, an…

  10. 7.5CVE-2019-1351EPSS 8.7%

    A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vulnerability'.

  11. 4.3CVE-2019-12837EPSS 1.1%

    The Java API in accesuniversitat.gencat.cat 1.7.5 allows remote attackers to get personal information of all registered students via several API endpoints.

  12. 5.4CVE-2019-19493ExploitEPSS 2.0%

    Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, leading to XSS.

  13. 7.2CVE-2019-17575EPSS 1.4%

    A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier. This can be exploited by an authenticated user with admin privileges to rename a media filename and extension. (For example: place PHP code in a .j…

  14. 5.3CVE-2019-0220EPSS 18%

    A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular …

  15. 10.0CVE-2019-9901EPSS 5.0%

    Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then interpret the non-normalized pa…

  16. 5.1CVE-2019-0816EPSS 1.4%

    A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka 'Azure SSH Keypairs Security Feature Bypass Vulnerability'.

  17. 7.2CVE-2019-9616EPSS 2.7%

    An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadScrawl URI.

  18. 9.8CVE-2019-8908EPSS 2.3%

    An issue was discovered in WTCMS 1.0. It allows remote attackers to execute arbitrary PHP code by going to the "Setting -> Mailbox configuration -> Registration email template" screen, and uploading an image file, as demonstrated by a .php…

  19. 9.8CVE-2019-8395EPSS 7.1%

    An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment to a request.

  20. 9.8CVE-2019-7731EPSS 4.2%

    MyWebSQL 3.7 has a remote code execution (RCE) vulnerability after an attacker writes shell code into the database, and executes the Backup Database function with a .php filename for the backup's archive file.

  21. 8.8CVE-2019-6289EPSS 1.9%

    uploads/include/dialog/select_soft.php in DedeCMS V57_UTF8_SP2 allows remote attackers to execute arbitrary PHP code by uploading with a safe file extension and then renaming with a mixed-case variation of the .php extension, as demonstrat…

  22. 4.3CVE-2018-6112EPSS 1.6%

    Making URLs clickable and allowing them to be styled in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

  23. 7.8CVE-2019-0571ExploitEPSS 16%

    An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10,…

  24. 7.5CVE-2018-12020EPSS 8.2%

    mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-…

  25. 5.8CVE-2018-0237EPSS 1.2%

    A vulnerability in the file type detection mechanism of the Cisco Advanced Malware Protection (AMP) for Endpoints macOS Connector could allow an unauthenticated, remote attacker to bypass malware detection. The vulnerability occurs because…