Skip to content
OpenAdvisories

Weakness (CWE)

CWE-610: Externally Controlled Reference to a Resource in Another Sphere

Class Draft Mapping discouraged

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Source: MITRE CWE-610

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.0
    CVE-2025-22144

    Account Takeover in NamelessMC

    NamelessMC is a free, easy to use & powerful website software for Minecraft servers. A user with admincp.core.emails or admincp.users.edit permissions can validate users and an attacker can reset their password. When the account is successfully approved by em…

    NamelessMC Nameless
  • Critical 9.1
    CVE-2024-32980

    Spin contains a potential network sandbox escape for specifically configured Spin applications

    Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to make requests to ar…

    fermyon spin spin-sdk crates.io
  • Critical 9.3
    CVE-2023-6569

    External Control of File Name or Path in h2oai/h2o-3

    External Control of File Name or Path in h2oai/h2o-3

    h2oai h2oai/h2o-3 h2o PyPI
  • Critical 9.9
    CVE-2022-39206

    CI/CD Docker Escape in OneDev

    Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. When using Docker-based job executors, the Docker socket (e.g. /var/run/docker.sock on Linux) is mounted into each Docker step. Users that can define and trigger CI/CD jobs on a project c…

    theonedev onedev
  • Critical 10.0
    CVE-2022-27593 Exploited · Ransomware Scanner template EPSS 88%

    DeadBolt Ransomware

    An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QT…

    QNAP Systems Photo Station
    KEV Sep 8, 2022
  • Critical 9.1
    CVE-2021-41244

    Cross organization admin control in Grafana

    Grafana is an open-source platform for monitoring and observability. In affected versions when the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance admins are able to access users from other o…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Alpine Go
  • Critical 9.0
    CVE-2021-27648

    Externally controlled reference to a resource in another sphere in quarantine functionality in Synology Antivirus Essen…

    Synology Synology Antivirus Essential
  • Critical 10.0
    CVE-2017-16088 Public exploit

    Sandbox Breakout in safe-eval

    The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox.

    HackerOne safe-eval node module safe-eval npm