Skip to content
OpenAdvisories

Weakness (CWE)

CWE-749: Exposed Dangerous Method or Function

Base Incomplete

The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

More detail

Many different kinds of technologies effectively provide access to methods or functions, such as ActiveX controls, Java functions, IOCTLs, and so on.

The exposure can occur in a few different ways:

- The function/method was never intended to be exposed to outside actors.

- The function/method was only intended to be accessible to a limited set of actors, such as Internet-based access from a single web site.

How to prevent it (2 mitigations)

  1. Architecture and Design

    If you must expose a method, make sure to perform input validation on all arguments, limit access to authorized parties, and protect against all possible vulnerabilities.

  2. Architecture and Design, Implementation

    Identify all exposed functionality. Explicitly list all functionality that must be exposed to some user or set of users. Identify which functionality may be:

    - accessible to all users

    - restricted to a small set of privileged users

    - prevented from being directly accessible at all

    Ensure that the implemented code follows these expectations. This includes setting the appropriate access modifiers where applicable (public, private, protected, etc.) or not marking ActiveX controls safe-for-scripting.

Source: MITRE CWE-749

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-116779 Exploited Public exploit

    FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofia_presence_handle_sip_i_message() split the To user of …

    signalwire freeswitch
    KEV Nov 9, 2026
  • Low 3.7
    CVE-2010-0738 Exploited · Ransomware Public exploit EPSS 74%

    The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.…

    KEV May 25, 2022
  • Medium 5.9
    CVE-2010-1428 Exploited · Ransomware Public exploit EPSS 53%

    The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) …

    KEV May 25, 2022
  • High 7.5
    CVE-2006-1547 Exploited EPSS 55%

    Improper Input Validation in Apache Struts

    ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler metho…

    struts:struts Maven
    KEV Jan 21, 2022