CWE-610— Externally Controlled Reference to a Resource in Another Sphere

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.— MITRE CWE catalog

272 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-610page 3 of 6

CVE-2021-0608HIGHCVSS 7.8EG 7.8
2021-06-22
In handleAppLaunch of AppLaunchActivity.java, there is a possible arbitrary activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not …
CVE-2021-0550HIGHCVSS 7.8EG 7.8
2021-06-22
In onLoadFailed of AnnotateActivity.java, there is a possible way to gain WRITE_EXTERNAL_STORAGE permissions without user consent due to a confused deputy. This could lead to local escalation of privilege with no additional execution privi…
CVE-2021-0536HIGHCVSS 7.8EG 7.8
2021-06-22
In dropFile of WiFiInstaller, there is a way to delete files accessible to CertInstaller due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not nee…
CVE-2020-6105HIGHCVSS 7.8EG 7.8
2020-10-15
An exploitable code execution vulnerability exists in the multiple devices functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause Information overwrite resulting in a code execution. An attacker can provi…
CVE-2020-0345HIGHCVSS 7.8EG 7.8
2020-09-17
In DocumentsUI, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVe…
CVE-2020-0267HIGHCVSS 7.8EG 7.8
2020-09-17
In WindowManager, there is a possible launch of an unexpected app due to a confused deputy. This could lead to local escalation of privilege due to launching a malicious app instead of the one the user intended, with no additional executio…
CVE-2020-0210HIGHCVSS 7.8EG 7.8
2020-06-11
In removeSharedAccountAsUser of AccountManager.java, there is a possible permissions bypass to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for ex…
CVE-2019-15429HIGHCVSS 7.8EG 7.8
2019-11-14
The Panasonic ELUGA_I9 Android device with a build fingerprint of Panasonic/ELUGA_I9/ELUGA_I9:7.0/NRD90M/1501740649:user/release-keys contains a pre-installed app with a package name of com.ovvi.modem app (versionCode=1, versionName=1) tha…
CVE-2019-15419HIGHCVSS 7.8EG 7.8
2019-11-14
The Asus ASUS_X015_1 Android device with a build fingerprint of asus/CN_X015/ASUS_X015_1:7.0/NRD90M/CN_X015-14.00.1709.35-20171215:user/release-keys contains a pre-installed app with a package name of com.lovelyfont.defcontainer app (versi…
CVE-2019-15418HIGHCVSS 7.8EG 7.8
2019-11-14
The Asus ASUS_X00K_1 Android device with a build fingerprint of asus/CN_X00K/ASUS_X00K_1:7.0/NRD90M/CN_X00K-14.01.1711.27-20180420:user/release-keys contains a pre-installed app with a package name of com.lovelyfont.defcontainer app (versi…
CVE-2019-15405HIGHCVSS 7.8EG 7.8
2019-11-14
The Asus ASUS_X00K_1 Android device with a build fingerprint of asus/CN_X00K/ASUS_X00K_1:7.0/NRD90M/CN_X00K-14.01.1711.27-20180420:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app (version…
CVE-2019-15394HIGHCVSS 7.8EG 7.8
2019-11-14
The Asus ZenFone 5 Selfie Android device with a build fingerprint of asus/WW_Phone/ASUS_X017D_1:7.1.1/NMF26F/14.0400.1810.061-20181107:user/release-keys contains a pre-installed app with a package name of com.asus.atd.smmitest app (version…
CVE-2018-9582HIGHCVSS 7.8EG 7.8
2019-02-11
In package installer in Android-8.0, Android-8.1 and Android-9, there is a possible bypass of the unknown source warning due to a confused deputy scenario. This could lead to local escalation of privilege with no additional execution privi…
CVE-2024-6717HIGHCVSS 7.7EG 7.7
2024-07-23
HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to path escaping of the allocation directory. This vulnerability, CVE-2024-6717, is fixed in Nomad 1.6.13, 1.7.10, and 1.8.…
CVE-2024-1329HIGHCVSS 7.7EG 7.7
2024-02-08
HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. This vulnerability, CVE-2024-1329, is fixed in Nomad 1…
CVE-2026-55389HIGHCVSS 7.5EG 7.5
2026-07-28
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.62.0, datamodel-code-generator resolves JSON Schem…
CVE-2026-55390HIGHCVSS 7.5EG 7.5
2026-07-28
datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodel_code_generator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import,…
CVE-2026-10816HIGHCVSS 7.5EG 7.5
2026-06-30
Arbitrary File Read (Unauthenticated) in NetScaler ADC and NetScaler Gateway if the access to NSIP, Cluster Management IP or SNIP with management access is enabled
CVE-2025-2875HIGHCVSS 7.5EG 7.5
2025-05-14
CWE-610: Externally Controlled Reference to a Resource in Another Sphere vulnerability exists that could cause a loss of confidentiality when an unauthenticated attacker manipulates controller’s webserver URL to access resources.
CVE-2024-51961HIGHCVSS 7.5EG 7.5
2025-03-03
There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files fr…
CVE-2022-42893HIGHCVSS 7.5EG 7.5
2022-11-17
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow to write data in any folder acc…
CVE-2022-42891HIGHCVSS 7.5EG 7.5
2022-11-17
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow to write data in any folder acc…
CVE-2022-42734HIGHCVSS 7.5EG 7.5
2022-11-17
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow to write data in any folder acc…
CVE-2022-42733HIGHCVSS 7.5EG 7.5
2022-11-17
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper read access control that could allow files to be retrieved from any f…
CVE-2022-42732HIGHCVSS 7.5EG 7.5
2022-11-17
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper read access control that could allow files to be retrieved from any f…
CVE-2016-0796HIGHCVSS 7.5EG 7.5
2022-07-28
WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and security bypass vulnerabilities because it fails to properly verify user-supplied input. An attacke…
CVE-2022-24241HIGHCVSS 7.5EG 7.5
2022-06-02
ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp.
CVE-2021-3845HIGHCVSS 7.5EG 7.5
2022-01-04
ws-scrcpy is vulnerable to External Control of File Name or Path
CVE-2021-39971HIGHCVSS 7.5EG 7.5
2022-01-03
Password vault has a External Control of System or Configuration Setting vulnerability.Successful exploitation of this vulnerability could compromise confidentiality.
CVE-2022-43428HIGHCVSS 5.3EG 7.5
2022-10-19
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system pro…
CVE-2026-62960HIGHCVSS 7.4EG 7.4
2026-08-21
Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file() in bundle-u…
CVE-2026-41107HIGHCVSS 7.4EG 7.4
2026-05-12
External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
CVE-2026-28722HIGHCVSS 7.3EG 7.3
2026-03-06
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.
CVE-2026-28721HIGHCVSS 7.3EG 7.3
2026-03-06
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.
CVE-2025-10092HIGHCVSS 7.3EG 7.3
2025-09-08
A vulnerability was found in Jinher OA up to 1.2. This impacts an unknown function of the file /c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx/?Type=add of the component XML Handler. The manipulation results in xml external entity ref…
CVE-2025-48963HIGHCVSS 7.3EG 7.3
2025-08-28
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40296.
CVE-2021-0591HIGHCVSS 7.3EG 7.3
2021-08-17
In sendReplyIntentToReceiver of BluetoothPermissionActivity.java, there is a possible way to invoke privileged broadcast receivers due to a confused deputy. This could lead to local escalation of privilege with User execution privileges ne…
CVE-2021-27183HIGHCVSS 7.2EG 7.2
2021-04-14
An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to exploit an Arbitrary File Write vulnerability. An attacker is able to create new files in any location of the filesystem, or he may be able t…
CVE-2020-2009HIGHCVSS 7.2EG 7.2
2020-05-13
An external control of filename vulnerability in the SD WAN component of Palo Alto Networks PAN-OS Panorama allows an authenticated administrator to send a request that results in the creation and write of an arbitrary file on all firewall…
CVE-2025-68478HIGHCVSS 7.1EG 7.1
2025-12-19
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, if an arbitrary path is specified in the request body's `fs_path`, the server serializes the Flow object into JSON and creates/overwrite…
CVE-2015-10142MEDIUMCVSS 6.9EG 6.9
2025-07-25
Sitecore Experience Platform (XP) prior to 8.0 Initial Release (rev. 141212) and Content Management System (CMS) prior to 7.2 Update-3 (rev. 141226) and prior to 7.5 Update-1 (rev. 150130) contain a vulnerability that may allow an attacke…
CVE-2024-45826MEDIUMCVSS 6.8EG 6.8
2024-09-12
CVE-2024-45826 IMPACT Due to improper input validation, a path traversal and remote code execution vulnerability exists when the ThinManager® processes a crafted POST request. If exploited, a user can install an executable file.
CVE-2024-25117MEDIUMCVSS 6.8EG 6.8
2024-02-21
php-svg-lib is a scalable vector graphics (SVG) file parsing/rendering library. Prior to version 0.5.2, php-svg-lib fails to validate that font-family doesn't contain a PHAR url, which might leads to RCE on PHP < 8.0, and doesn't validate …
CVE-2025-26684MEDIUMCVSS 6.7EG 6.7
2025-05-13
External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
CVE-2025-48598MEDIUMCVSS 6.6EG 6.6
2025-12-08
In multiple locations, there is a possible way to alter the primary user's face unlock settings due to a confused deputy. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction …
CVE-2024-38049MEDIUMCVSS 6.6EG 6.6
2024-07-09
Windows Distributed Transaction Coordinator Remote Code Execution Vulnerability
CVE-2026-32008MEDIUMCVSS 6.5EG 6.5
2026-03-19
OpenClaw versions prior to 2026.2.21 contain an improper URL scheme validation vulnerability in the assertBrowserNavigationAllowed() function that allows authenticated users with browser-tool access to navigate to file:// URLs. Attackers c…
CVE-2025-8057MEDIUMCVSS 6.5EG 6.5
2025-09-16
Authorization Bypass Through User-Controlled Key, Externally Controlled Reference to a Resource in Another Sphere, Improper Authorization vulnerability in Patika Global Technologies HumanSuite allows Exploiting Trust in Client. This issue…
CVE-2024-52792MEDIUMCVSS 6.5EG 6.5
2024-12-17
LDAP Account Manager (LAM) is a php webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In affected versions LAM does not properly sanitize configuration values, that are set via `mainmanage.ph…
CVE-2024-28962MEDIUMCVSS 6.5EG 6.5
2024-08-06
Dell Command | Update, Dell Update, and Alienware Update UWP, versions prior to 5.4, contain an Exposed Dangerous Method or Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability…

Map vulnerabilities like CWE-610 to your infrastructure

EchelonGraph correlates every CVE — across CWE-610 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →