CWE-668— Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.— MITRE CWE catalog

1,226 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-668page 17 of 25

CVE-2022-34765MEDIUMCVSS 5.5EG 5.5
2022-07-13
A CWE-73: External Control of File Name or Path vulnerability exists that could cause loading of unauthorized firmware images when user-controlled data is written to the file path. Affected Products: X80 advanced RTU Communication Module (…
CVE-2022-22414MEDIUMCVSS 5.5EG 5.5
2022-06-20
IBM Robotic Process Automation 21.0.2 could allow a local user to obtain sensitive web service configuration credentials from system memory. IBM X-Force ID: 223026.
CVE-2021-26361MEDIUMCVSS 5.5EG 5.5
2022-05-12
A malicious or compromised User Application (UApp) or AGESA Boot Loader (ABL) could be used by an attacker to exfiltrate arbitrary memory from the ASP stage 2 bootloader potentially leading to information disclosure.
CVE-2022-29102MEDIUMCVSS 5.5EG 5.5
2022-05-10
Windows Failover Cluster Information Disclosure Vulnerability
CVE-2022-26933MEDIUMCVSS 5.5EG 5.5
2022-05-10
Windows NTFS Information Disclosure Vulnerability
CVE-2022-22011MEDIUMCVSS 5.5EG 5.5
2022-05-10
Windows Graphics Component Information Disclosure Vulnerability
CVE-2022-24823MEDIUMCVSS 5.5EG 5.5
2022-05-06
Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are us…
CVE-2021-39777MEDIUMCVSS 5.5EG 5.5
2022-03-30
In Telephony, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. U…
CVE-2021-39757MEDIUMCVSS 5.5EG 5.5
2022-03-30
In PermissionController, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: …
CVE-2021-22572MEDIUMCVSS 5.5EG 5.5
2022-03-29
On unix-like systems, the system temporary directory is shared between all users on that system. The root cause is File.createTempFile creates files in the the system temporary directory with world readable permissions. Any sensitive infor…
CVE-2022-22583MEDIUMCVSS 5.5EG 5.5
2022-03-18
A permissions issue was addressed with improved validation. This issue is fixed in Security Update 2022-001 Catalina, macOS Monterey 12.2, macOS Big Sur 11.6.3. An application may be able to access restricted files.
CVE-2022-0762MEDIUMCVSS 5.5EG 5.5
2022-02-26
Incorrect Authorization in GitHub repository microweber/microweber prior to 1.3.
CVE-2022-25375MEDIUMCVSS 5.5EG 5.5
2022-02-20
An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memor…
CVE-2021-39631MEDIUMCVSS 5.5EG 5.5
2022-02-11
In clear_data_dlg_text of strings.xml, there is a possible situation when "Clear storage" functionality sets up the wrong security/privacy expectations due to a misleading message. This could lead to local information disclosure with no ad…
CVE-2021-45402MEDIUMCVSS 5.5EG 5.5
2022-02-11
The check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not properly update bounds while handling the mov32 instruction, which allows local users to obtain potentially sensitive address information, a…
CVE-2021-33096MEDIUMCVSS 5.5EG 5.5
2022-02-09
Improper isolation of shared resources in network on chip for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially enable denial of service via local access.
CVE-2022-23252MEDIUMCVSS 5.5EG 5.5
2022-02-09
Microsoft Office Information Disclosure Vulnerability
CVE-2022-22716MEDIUMCVSS 5.5EG 5.5
2022-02-09
Microsoft Excel Information Disclosure Vulnerability
CVE-2022-21998MEDIUMCVSS 5.5EG 5.5
2022-02-09
Windows Common Log File System Driver Information Disclosure Vulnerability
CVE-2022-21985MEDIUMCVSS 5.5EG 5.5
2022-02-09
Windows Remote Access Connection Manager Information Disclosure Vulnerability
CVE-2021-39633MEDIUMCVSS 5.5EG 5.5
2022-01-14
In gre_handle_offloads of ip_gre.c, there is a possible page fault due to an invalid memory access. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploita…
CVE-2022-21964MEDIUMCVSS 5.5EG 5.5
2022-01-11
Remote Desktop Licensing Diagnoser Information Disclosure Vulnerability
CVE-2019-8702MEDIUMCVSS 5.5EG 5.5
2021-12-23
This issue was addressed with a new entitlement. This issue is fixed in macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra, iOS 12.4, tvOS 12.4. A local user may be able to read a persistent account…
CVE-2021-0986MEDIUMCVSS 5.5EG 5.5
2021-12-15
In hasGrantedPolicy of DevicePolicyManagerService.java, there is a possible information disclosure about the device owner, profile owner, or device admin due to a logic error in the code. This could lead to local information disclosure wit…
CVE-2021-0966MEDIUMCVSS 5.5EG 5.5
2021-12-15
In code generated by BuildParcelFields of generate_cpp.cpp, there is a possible way for a crafted parcelable to reveal uninitialized memory of a target process due to uninitialized data. This could lead to local information disclosure acro…
CVE-2021-43235MEDIUMCVSS 5.5EG 5.5
2021-12-15
Storage Spaces Controller Information Disclosure Vulnerability
CVE-2021-43227MEDIUMCVSS 5.5EG 5.5
2021-12-15
Storage Spaces Controller Information Disclosure Vulnerability
CVE-2021-43224MEDIUMCVSS 5.5EG 5.5
2021-12-15
Windows Common Log File System Driver Information Disclosure Vulnerability
CVE-2021-42295MEDIUMCVSS 5.5EG 5.5
2021-12-15
Visual Basic for Applications Information Disclosure Vulnerability
CVE-2021-42744MEDIUMCVSS 5.5EG 5.5
2021-11-19
Philips MRI 1.5T and MRI 3T Version 5.3 through 5.8.1 does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2021-26327MEDIUMCVSS 5.5EG 5.5
2021-11-16
Insufficient validation of guest context in the SNP Firmware could lead to a potential loss of guest confidentiality.
CVE-2021-26312MEDIUMCVSS 5.5EG 5.5
2021-11-16
Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory it should not be able to access, resulting in a potential loss of integrity.
CVE-2020-12488MEDIUMCVSS 5.5EG 5.5
2021-11-10
The attacker can access the sensitive information stored within the jovi Smart Scene module by entering carefully constructed commands without requesting permission.
CVE-2021-22454MEDIUMCVSS 5.5EG 5.5
2021-10-28
A component of the HarmonyOS has a External Control of System or Configuration Setting vulnerability. Local attackers may exploit this vulnerability to cause core dump.
CVE-2021-27001MEDIUMCVSS 5.5EG 5.5
2021-10-19
Clustered Data ONTAP versions 9.x prior to 9.5P18, 9.6P16, 9.7P16, 9.8P7 and 9.9.1P2 are susceptible to a vulnerability which could allow an authenticated privileged local attacker to arbitrarily modify Compliance-mode WORM data prior to t…
CVE-2021-30850MEDIUMCVSS 5.5EG 5.5
2021-10-19
An access issue was addressed with improved access restrictions. This issue is fixed in Security Update 2021-005 Catalina, macOS Big Sur 11.6, tvOS 15. A user may gain access to protected parts of the file system.
CVE-2021-30828MEDIUMCVSS 5.5EG 5.5
2021-10-19
This issue was addressed with improved checks. This issue is fixed in Security Update 2021-005 Catalina, macOS Big Sur 11.6. A local user may be able to read arbitrary files as root.
CVE-2021-22007MEDIUMCVSS 5.5EG 5.5
2021-09-23
The vCenter Server contains a local information disclosure vulnerability in the Analytics service. An authenticated user with non-administrative privilege may exploit this issue to gain access to sensitive information.
CVE-2021-30709MEDIUMCVSS 5.5EG 5.5
2021-09-08
This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6. Processing a maliciously crafted USD file may disclose …
CVE-2021-30673MEDIUMCVSS 5.5EG 5.5
2021-09-08
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina. A malicious application may be able to access a user's call history.
CVE-2021-30656MEDIUMCVSS 5.5EG 5.5
2021-09-08
An access issue was addressed with improved memory management. This issue is fixed in iOS 14.5 and iPadOS 14.5. A malicious application may be able to determine kernel memory layout.
CVE-2021-1822MEDIUMCVSS 5.5EG 5.5
2021-09-08
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. A local user may be able to modify protected parts of the file system.
CVE-2021-1807MEDIUMCVSS 5.5EG 5.5
2021-09-08
A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 14.5 and iPadOS 14.5, watchOS 7.4. A local user may be able to write arbitrary files.
CVE-2021-22525MEDIUMCVSS 5.5EG 5.5
2021-09-02
This release addresses a potential information leakage vulnerability in NetIQ Access Manager versions prior to 5.0.1
CVE-2020-18972MEDIUMCVSS 5.5EG 5.5
2021-08-25
Exposure of Sensitive Information to an Unauthorized Actor in PoDoFo v0.9.6 allows attackers to obtain sensitive information via 'IsNextToken' in the component 'src/base/PdfToenizer.cpp'.
CVE-2021-30921MEDIUMCVSS 5.5EG 5.5
2021-08-24
A logic issue was addressed with improved state management. This issue is fixed in iOS 14.5 and iPadOS 14.5. A user's password may be visible onscreen.
CVE-2021-0588MEDIUMCVSS 5.5EG 5.5
2021-07-14
In processInboundMessage of MceStateMachine.java, there is a possible SMS disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not…
CVE-2021-28623MEDIUMCVSS 5.5EG 5.5
2021-06-28
Adobe Premiere Elements version 5.2 (and earlier) is affected by an insecure temporary file creation vulnerability. An unauthenticated attacker could leverage this vulnerability to call functions against the installer to perform high privi…
CVE-2021-28597MEDIUMCVSS 5.5EG 5.5
2021-06-28
Adobe Photoshop Elements version 5.2 (and earlier) is affected by an insecure temporary file creation vulnerability. An unauthenticated attacker could leverage this vulnerability to call functions against the installer to perform high priv…
CVE-2021-26585MEDIUMCVSS 5.5EG 5.5
2021-06-24
A potential vulnerability has been identified in HPE OneView Global Dashboard release 2.31 which could lead to a local disclosure of privileged information. HPE has provided an update to OneView Global Dashboard. The issue is resolved in 2…

Map vulnerabilities like CWE-668 to your infrastructure

EchelonGraph correlates every CVE — across CWE-668 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →