CWE-668— Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.— MITRE CWE catalog

1,226 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-668page 8 of 25

CVE-2022-31845HIGHCVSS 7.5EG 7.5
2022-06-14
A vulnerability in live_check.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec cmd function.
CVE-2022-31309HIGHCVSS 7.5EG 7.5
2022-06-14
A vulnerability in live_check.shtml of WAVLINK AERIAL X 1200M M79X3.V5030.180719 allows attackers to obtain sensitive router information via execution of the exec cmd function.
CVE-2022-31308HIGHCVSS 7.5EG 7.5
2022-06-14
A vulnerability in live_mfg.shtml of WAVLINK AERIAL X 1200M M79X3.V5030.191012 allows attackers to obtain sensitive router information via execution of the exec cmd function.
CVE-2022-31649HIGHCVSS 7.5EG 7.5
2022-06-09
ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer.
CVE-2022-30746HIGHCVSS 7.5EG 7.5
2022-06-07
Missing caller check in Smart Things prior to version 1.7.85.12 allows attacker to access senstive information remotely using javascript interface API.
CVE-2022-28991HIGHCVSS 7.5EG 7.5
2022-05-20
Multi Store Inventory Management System v1.0 was discovered to contain an information disclosure vulnerability which allows attackers to access sensitive files.
CVE-2022-24897HIGHCVSS 7.5EG 7.5
2022-05-02
APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13.0, the velocity scripts are not properly sandboxed against using the Java File A…
CVE-2022-27257HIGHCVSS 7.5EG 7.5
2022-04-15
A PHP Local File Inclusion vulneraility in the default Redbasic theme for Hubzilla before version 7.2 allows remote attackers to include arbitrary php files via the schema parameter.
CVE-2022-25755HIGHCVSS 7.5EG 7.5
2022-04-12
A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC (24V, coated), SCALANCE X302-7 EEC (2x 230V), SCALANCE X302-7 EEC (2x 230V, coated), SCAL…
CVE-2022-23345HIGHCVSS 7.5EG 7.5
2022-03-21
BigAnt Software BigAnt Server v5.6.06 was discovered to contain incorrect access control.
CVE-2022-25481HIGHCVSS 7.5EG 7.5
2022-03-21
ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment…
CVE-2022-26267HIGHCVSS 7.5EG 7.5
2022-03-18
Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin/maintenance_actions.php.
CVE-2021-40051HIGHCVSS 7.5EG 7.5
2022-03-10
There is an unauthorized access vulnerability in system components. Successful exploitation of this vulnerability will affect confidentiality.
CVE-2022-23317HIGHCVSS 7.5EG 7.5
2022-02-15
CobaltStrike <=4.5 HTTP(S) listener does not determine whether the request URL begins with "/", and attackers can obtain relevant information by specifying the URL.
CVE-2021-45421HIGHCVSS 7.5EG 7.5
2022-02-14
Emerson Dixell XWEB-500 products are affected by information disclosure via directory listing. A potential attacker can use this misconfiguration to access all the files in the remote directories. Note: the product has not been supported s…
CVE-2022-24975HIGHCVSS 7.5EG 7.5
2022-02-11
The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security risk if information-disclosure auditing processes rely on a clone operation wit…
CVE-2021-22785HIGHCVSS 7.5EG 7.5
2022-02-11
A CWE-200: Information Exposure vulnerability exists that could cause sensitive information of files located in the web root directory to leak when an attacker sends a HTTP request to the web server of the device. Affected Product: Modicon…
CVE-2020-13670HIGHCVSS 7.5EG 7.5
2022-02-11
Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. This issue affects: Drupa…
CVE-2021-46354HIGHCVSS 7.5EG 7.5
2022-02-09
Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. The ability to send requests to other systems can allow the vulnerable s…
CVE-2021-42641HIGHCVSS 7.5EG 7.5
2022-02-02
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticated attacker to disclose the username and email address of all users.
CVE-2022-21904HIGHCVSS 7.5EG 7.5
2022-01-11
Windows GDI Information Disclosure Vulnerability
CVE-2022-21880HIGHCVSS 7.5EG 7.5
2022-01-11
Windows GDI+ Information Disclosure Vulnerability
CVE-2021-40005HIGHCVSS 7.5EG 7.5
2022-01-10
The distributed data service component has a vulnerability in data access control. Successful exploitation of this vulnerability may affect data confidentiality.
CVE-2021-39972HIGHCVSS 7.5EG 7.5
2022-01-03
MyHuawei-App has a Exposure of Sensitive Information to an Unauthorized Actor vulnerability.Successful exploitation of this vulnerability could compromise confidentiality.
CVE-2021-39971HIGHCVSS 7.5EG 7.5
2022-01-03
Password vault has a External Control of System or Configuration Setting vulnerability.Successful exploitation of this vulnerability could compromise confidentiality.
CVE-2021-39969HIGHCVSS 7.5EG 7.5
2022-01-03
There is an Unauthorized file access vulnerability in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2021-37133HIGHCVSS 7.5EG 7.5
2022-01-03
There is an Unauthorized file access vulnerability in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2020-20948HIGHCVSS 7.5EG 7.5
2021-12-27
An arbitrary file download vulnerability in jeecg v3.8 allows attackers to access sensitive files via modification of the "localPath" variable.
CVE-2021-45708HIGHCVSS 7.5EG 7.5
2021-12-27
An issue was discovered in the abomonation crate through 2021-10-17 for Rust. Because transmute operations are insufficiently constrained, there can be an information leak or ASLR bypass.
CVE-2021-20050HIGHCVSS 7.5EG 7.5
2021-12-23
An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exposing configuration meta-data.
CVE-2021-39646HIGHCVSS 7.5EG 7.5
2021-12-15
Product: AndroidVersions: Android kernelAndroid ID: A-201537251References: N/A
CVE-2021-1045HIGHCVSS 7.5EG 7.5
2021-12-15
Product: AndroidVersions: Android kernelAndroid ID: A-195580473References: N/A
CVE-2021-43893HIGHCVSS 7.5EG 7.5
2021-12-15
Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability
CVE-2021-43888HIGHCVSS 7.5EG 7.5
2021-12-15
Microsoft Defender for IoT Information Disclosure Vulnerability
CVE-2021-43222HIGHCVSS 7.5EG 7.5
2021-12-15
Microsoft Message Queuing Information Disclosure Vulnerability
CVE-2021-44522HIGHCVSS 7.5EG 7.5
2021-12-14
A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All versions), Siveillance Identity V1.6 (All version…
CVE-2021-20373HIGHCVSS 7.5EG 7.5
2021-12-09
IBM Db2 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an Information Disclosure when using the LOAD utility as under certain circumstances the LOAD utility does not enforce directory restrictions. IBM X-Force ID: 199521.
CVE-2021-40288HIGHCVSS 7.5EG 7.5
2021-12-07
A denial-of-service attack in WPA2, and WPA3-SAE authentication methods in TP-Link AX10v1 before V1_211014, allows a remote unauthenticated attacker to disconnect an already connected wireless client via sending with a wireless adapter spe…
CVE-2021-34424HIGHCVSS 7.5EG 7.5
2021-11-24
A vulnerability was discovered in the Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.8.4, Zoom Client for Meetings for Blackberry (for Android and iOS) before version 5.8.1, Zoom Client for Meetings…
CVE-2021-43196HIGHCVSS 7.5EG 7.5
2021-11-09
In JetBrains TeamCity before 2021.1, information disclosure via the Docker Registry connection dialog is possible.
CVE-2021-22044HIGHCVSS 7.5EG 7.5
2021-10-28
In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older unsupported versions, applications using type-level `@RequestMapping`annotations over Feign client interfaces, can be involuntarily exposing endpoints corr…
CVE-2021-22488HIGHCVSS 7.5EG 7.5
2021-10-28
There is an Unauthorized file access vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability by modifying soft links may tamper with the files restored from backups.
CVE-2021-22034HIGHCVSS 7.5EG 7.5
2021-10-21
Releases prior to VMware vRealize Operations Tenant App 8.6 contain an Information Disclosure Vulnerability.
CVE-2020-28145HIGHCVSS 7.5EG 7.5
2021-10-12
Arbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via coreframe\app\attachment\admin\index.php, which allows attackers to access sensitive information.
CVE-2020-21503HIGHCVSS 7.5EG 7.5
2021-10-05
waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture. By setting the index.php?m=gift&a=addsave credit parameter to -1, the product is sold for free.
CVE-2021-22012HIGHCVSS 7.5EG 7.5
2021-09-23
The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive …
CVE-2021-22009HIGHCVSS 7.5EG 7.5
2021-09-23
The vCenter Server contains multiple denial-of-service vulnerabilities in VAPI (vCenter API) service. A malicious actor with network access to port 443 on vCenter Server may exploit these issues to create a denial of service condition due …
CVE-2021-22008HIGHCVSS 7.5EG 7.5
2021-09-23
The vCenter Server contains an information disclosure vulnerability in VAPI (vCenter API) service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue by sending a specially crafted json-rpc message t…
CVE-2021-41011HIGHCVSS 7.5EG 7.5
2021-09-22
LINE client for iOS before 11.15.0 might expose authentication information for a certain service to external entities under certain conditions. This is usually impossible, but in combination with a server-side bug, attackers could get this…
CVE-2021-40639HIGHCVSS 7.5EG 7.5
2021-09-15
Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.properties&config=filemanager.config.js.

Map vulnerabilities like CWE-668 to your infrastructure

EchelonGraph correlates every CVE — across CWE-668 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →