Weakness (CWE)
CWE-402: Transmission of Private Resources into a New Sphere
The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product.
Source: MITRE CWE-402
13 results · Clear filters · Feed
-
Medium 5.3
Due to a firewall misconfiguration, Kerlink devices running KerOS prior to 5.12 incorrectly accept specially crafted UD…
-
Medium 4.3
trytond allows remote attackers to obtain sensitive trace-back (server setup) information
Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
-
Medium 4.7
The YouDao plugin for StarDict, as used in stardict 3.0.7+git20220909+dfsg-6 in Debian trixie and elsewhere, sends an X…
-
Medium 5.8
In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, re…
-
Medium 5.0
In One Identity OneLogin Active Directory Connector before 6.1.5, encryption of the DirectoryToken was mishandled, aka …
-
Medium 4.2
In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared artic…
-
Medium 6.9
Transmission of Private Resources into a New Sphere in Crafter Engine
Transmission of Private Resources into a New Sphere ('Resource Leak') vulnerability in CrafterCMS Engine on Linux, MacOS, x86, Windows, 64 bit, ARM allows Directory Indexing, Resource Leak Exposure.This issue affects CrafterCMS: from 4.0.0 before 4.0.8, from …
-
Medium 6.5
Ruijie Reyee OS Resource Leak
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to obtain the devices serial number if physically adjacent and sniffing the RAW WIFI signal.
-
Medium 5.5
Kernel: blkio memory leakage due to blkcg and some blkgs are not freed after they are made offline.
A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem. When a cgroup is being destroyed, cgroup_rstat_flush() is only called at css_release_work_fn(), which is called when th…
-
Medium 5.5
Kernel: information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c
A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux Kernel. This issue may allow a local attacker to cause double-deactivations of catchall elements, which can result in a memory leak.
-
Medium 4.3
XWiki Platform's obfuscated email addresses should not be sorted
XWiki Platform is a generic wiki platform. In org.xwiki.platform:xwiki-platform-livetable-ui starting with version 3.5-milestone-1 and prior to versions 14.10.9 and 15.3-rc-1, the mail obfuscation configuration was not fully taken into account and is was stil…
-
Medium 4.9
A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected application discl…
-
Medium 5.9
Transmission of Private Resources into a New Sphere ('Resource Leak') in Crafter Engine
Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary).