Weakness (CWE)
CWE-668: Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
More detail
Resources such as files and directories may be inadvertently exposed through mechanisms such as insecure permissions, or when a program accidentally operates on the wrong object. For example, a program may intend that private files can only be provided to a specific user. This effectively defines a control sphere that is intended to prevent attackers from accessing these private files. If the file permissions are insecure, then parties other than the user will be able to access those files.
A separate control sphere might effectively require that the user can only access the private files, but not any other files on the system. If the program does not ensure that the user is only requesting private files, then the user might be able to access other files on the system.
In either case, the end result is that a resource has been exposed to the wrong party.
Source: MITRE CWE-668
378 results · Feed
-
High 7.5
TaffyDB can allow access to any data items in the DB
taffydb npm module, vulnerable in all versions up to and including 2.7.3, allows attackers to forge adding additional properties into user-input processed by taffy which can allow access to any data items in the DB. taffy sets an internal index for each data …
-
Critical 9.8
Validation Bypass in schema-inspector
In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate()` function used within schema-inspector.
-
High 8.4
Insecure API port exposed to all Master Node guest containers
The docker-kubic package in SUSE CaaS Platform 3.0 before 17.09.1_ce-7.6.1 provided access to an insecure API locally on the Kubernetes master node.
-
High 7.5CVE-2019-20149 Public exploit
Validation Bypass in kind-of
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate…
-
Medium 6.5
Jenkins JIRA Plugin allows users to select and use credentials with System scope
Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope.
-
Medium 5.3
Pomelo allows external control of critical state data
Pomelo v2.2.5 allows external control of critical state data. A malicious user input can corrupt arbitrary methods and attributes in template/game-server/app/servers/connector/handler/entryHandler.js because certain internal attributes can be overwritten via …
-
Critical 9.1
python-docutils allows insecure usage of temporary files
python-docutils allows insecure usage of temporary files
-
Unscored —
In IntelliSpace Perinatal, Versions K and prior, a vulnerability within the IntelliSpace Perinatal application environm…
-
Medium 5.5
Cisco IOS XE Software ASIC Register Write Vulnerability
A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to write values to the underlying memory of an affected device. The vulnerability is due to improper input validation and authorization of specific commands that …
-
High 7.5
Arbitrary File Read in html-pdf
The html-pdf package 2.2.0 for Node.js has an arbitrary file read vulnerability via an HTML file that uses XMLHttpRequest to access a file:/// URL.
-
Medium 4.3
Jenkins Google Kubernetes Engine Plugin vulnerable to Exposure of Resource to Wrong Sphere
Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier created a temporary file containing a temporary access token in the project workspace, where it could be accessed by users with Job/Read permission.
-
Critical 9.3
Cisco DNA Center Authentication Bypass Vulnerability
A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, adjacent attacker to bypass authentication and access critical internal services. The vulnerability is due to insufficient access restriction to ports necessary…
-
High 8.8
Rancher Privilege Escalation Vulnerability
In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose …
-
Medium 4.2
Access Control Bypass
An issue was discovered in Rancher 2 through 2.1.5. Any project member with access to the default namespace can mount the netes-default service account in a pod, and then use that pod to execute administrative privileged commands against the k8s cluster. This…
-
Unscored —
Vulnerabilities within the Philips Brilliance CT kiosk environment (Brilliance 64 version 2.6.2 and prior, Brilliance i…
-
Medium 5.3
Moodle Unauthorized searching of arbitrary blogs by typing full url
In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing.
-
Low 3.3
RuboCop gem Insecure use of /tmp
RuboCop 0.48.1 and earlier does not use /tmp in safe way, allowing local users to exploit this to tamper with cache files belonging to other users.
-
Critical 9.1CVE-2017-5648 EPSS 13%
Exposure of Resource to Wrong Sphere in Apache Tomcat
While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted appli…