Common Weakness Enumeration
CWE-668
DiscouragedExposure of Resource to Wrong Sphere
Abstraction: Class · Status: Draft
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
1277 vulnerabilities reference this CWE, most recent first.
GHSA-RJWW-2X8V-M9V9
Vulnerability from github – Published: 2021-04-19 14:52 – Updated: 2022-09-21 19:31
VLAI
Summary
Potential sensitive data exposure in applications using Vaadin 15
Details
Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g. @RestController
- https://vaadin.com/security/cve-2020-36319
Severity
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.vaadin:flow-server"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-36319"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-668"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-16T23:16:31Z",
"nvd_published_at": "2021-04-23T16:15:00Z",
"severity": "LOW"
},
"details": "Insecure configuration of default `ObjectMapper` in `com.vaadin:flow-server` versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g. `@RestController`\n\n- https://vaadin.com/security/cve-2020-36319",
"id": "GHSA-rjww-2x8v-m9v9",
"modified": "2022-09-21T19:31:15Z",
"published": "2021-04-19T14:52:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/vaadin/flow/security/advisories/GHSA-rjww-2x8v-m9v9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36319"
},
{
"type": "WEB",
"url": "https://github.com/vaadin/flow/pull/8016"
},
{
"type": "WEB",
"url": "https://github.com/vaadin/flow/pull/8051"
},
{
"type": "PACKAGE",
"url": "https://github.com/vaadin/flow"
},
{
"type": "WEB",
"url": "https://vaadin.com/security/cve-2020-36319"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Potential sensitive data exposure in applications using Vaadin 15"
}
GHSA-RJXF-4M2W-4CQQ
Vulnerability from github – Published: 2023-09-18 21:30 – Updated: 2024-04-04 07:43
VLAI
Details
An information leak in THE_B_members card v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-39058"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-18T21:15:55Z",
"severity": "MODERATE"
},
"details": "An information leak in THE_B_members card v13.6.1 allows attackers to obtain the channel access token and send crafted messages.",
"id": "GHSA-rjxf-4m2w-4cqq",
"modified": "2024-04-04T07:43:28Z",
"published": "2023-09-18T21:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39058"
},
{
"type": "WEB",
"url": "https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39058.md"
},
{
"type": "WEB",
"url": "http://thebmembers.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RMC2-G977-JR5R
Vulnerability from github – Published: 2022-05-24 17:08 – Updated: 2022-05-24 17:08
VLAI
Details
An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.
{
"affected": [],
"aliases": [
"CVE-2020-8449"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-02-04T20:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.",
"id": "GHSA-rmc2-g977-jr5r",
"modified": "2022-05-24T17:08:00Z",
"published": "2022-05-24T17:08:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8449"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G6W2IQ7QV2OGREFFUBNVZIDD3RJBDE4R"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TSU6SPANL27AGK5PCGBJOKG4LUWA555J"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202003-34"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20210304-0002"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4289-1"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4682"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00012.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00010.html"
},
{
"type": "WEB",
"url": "http://www.squid-cache.org/Advisories/SQUID-2020_1.txt"
},
{
"type": "WEB",
"url": "http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2020_1.patch"
},
{
"type": "WEB",
"url": "http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-8e657e835965c3a011375feaa0359921c5b3e2dd.patch"
},
{
"type": "WEB",
"url": "http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_1.patch"
},
{
"type": "WEB",
"url": "http://www.squid-cache.org/Versions/v4/changesets/squid-4-b3a0719affab099c684f1cd62b79ab02816fa962.patch"
},
{
"type": "WEB",
"url": "http://www.squid-cache.org/Versions/v4/changesets/squid-4-d8e4715992d0e530871519549add5519cbac0598.patch"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-RP69-VV8V-JVMW
Vulnerability from github – Published: 2023-10-11 12:30 – Updated: 2024-04-04 08:33
VLAI
Details
The Bluetooth module has a vulnerability in permission control for broadcast notifications.Successful exploitation of this vulnerability may affect confidentiality.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2023-44101"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-11T12:15:11Z",
"severity": "HIGH"
},
"details": "The Bluetooth module has a vulnerability in permission control for broadcast notifications.Successful exploitation of this vulnerability may affect confidentiality.",
"id": "GHSA-rp69-vv8v-jvmw",
"modified": "2024-04-04T08:33:43Z",
"published": "2023-10-11T12:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44101"
},
{
"type": "WEB",
"url": "https://https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-0000001663676540"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RP88-5VG5-8WX2
Vulnerability from github – Published: 2022-09-20 00:00 – Updated: 2022-09-22 00:00
VLAI
Details
Versions of IBM Spectrum Protect Plus prior to 10.1.12 (excluding 10.1.12) include the private key information for a certificate inside the generated .crt file when uploading a TLS certificate to IBM Spectrum Protect Plus. If this generated .crt file is shared, an attacker can obtain the private key information for the uploaded certificate. IBM X-Force ID: 235718.
Severity
5.9 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-40234"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-19T18:15:00Z",
"severity": "MODERATE"
},
"details": "Versions of IBM Spectrum Protect Plus prior to 10.1.12 (excluding 10.1.12) include the private key information for a certificate inside the generated .crt file when uploading a TLS certificate to IBM Spectrum Protect Plus. If this generated .crt file is shared, an attacker can obtain the private key information for the uploaded certificate. IBM X-Force ID: 235718.",
"id": "GHSA-rp88-5vg5-8wx2",
"modified": "2022-09-22T00:00:26Z",
"published": "2022-09-20T00:00:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40234"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/235718"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6619947"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RPGF-WX3X-J576
Vulnerability from github – Published: 2022-03-26 00:00 – Updated: 2022-03-31 00:00
VLAI
Details
Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not specify an initial configuration file. The configuration allows certain anonymous access to administration and an API.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2022-27919"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-25T20:15:00Z",
"severity": "CRITICAL"
},
"details": "Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not specify an initial configuration file. The configuration allows certain anonymous access to administration and an API.",
"id": "GHSA-rpgf-wx3x-j576",
"modified": "2022-03-31T00:00:33Z",
"published": "2022-03-26T00:00:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27919"
},
{
"type": "WEB",
"url": "https://security.gradle.com/advisory/2022-05"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RPJH-XM3C-R22W
Vulnerability from github – Published: 2023-03-01 15:30 – Updated: 2023-03-10 03:30
VLAI
Details
Dell NetWorker versions 19.5 and earlier contain 'Apache Tomcat' version disclosure vulnerability. A NetWorker server user with remote access to NetWorker clients may potentially exploit this vulnerability and may launch target-specific attacks.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-25544"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-01T15:15:00Z",
"severity": "MODERATE"
},
"details": "Dell NetWorker versions 19.5 and earlier contain \u0027Apache Tomcat\u0027 version disclosure vulnerability. A NetWorker server user with remote access to NetWorker clients may potentially exploit this vulnerability and may launch target-specific attacks.",
"id": "GHSA-rpjh-xm3c-r22w",
"modified": "2023-03-10T03:30:14Z",
"published": "2023-03-01T15:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25544"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000210471/dsa-2023-058-dell-networker-security-update-for-version-disclosure-vulnerability"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RQH4-X2V7-J34G
Vulnerability from github – Published: 2024-01-12 00:30 – Updated: 2024-05-20 12:30
VLAI
Details
A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem. When a cgroup is being destroyed, cgroup_rstat_flush() is only called at css_release_work_fn(), which is called when the blkcg reference count reaches 0. This circular dependency will prevent blkcg and some blkgs from being freed after they are made offline. This issue may allow an attacker with a local access to cause system instability, such as an out of memory error.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-0443"
],
"database_specific": {
"cwe_ids": [
"CWE-402",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-12T00:15:45Z",
"severity": "MODERATE"
},
"details": "A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem. When a cgroup is being destroyed, cgroup_rstat_flush() is only called at css_release_work_fn(), which is called when the blkcg reference count reaches 0. This circular dependency will prevent blkcg and some blkgs from being freed after they are made offline. This issue may allow an attacker with a local access to cause system instability, such as an out of memory error.",
"id": "GHSA-rqh4-x2v7-j34g",
"modified": "2024-05-20T12:30:27Z",
"published": "2024-01-12T00:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0443"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:6583"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7077"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7370"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-0443"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2257968"
},
{
"type": "WEB",
"url": "https://lore.kernel.org/linux-block/20221215033132.230023-3-longman@redhat.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RR7P-XGF7-GRW4
Vulnerability from github – Published: 2022-05-24 22:28 – Updated: 2022-08-31 00:00
VLAI
Details
A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third party with access to the device’s external storage to read cached TLS material.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2021-24027"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-06T17:15:00Z",
"severity": "HIGH"
},
"details": "A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third party with access to the device\u2019s external storage to read cached TLS material.",
"id": "GHSA-rr7p-xgf7-grw4",
"modified": "2022-08-31T00:00:19Z",
"published": "2022-05-24T22:28:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24027"
},
{
"type": "WEB",
"url": "https://www.whatsapp.com/security/advisories/2021"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RRX8-HRJ2-395Q
Vulnerability from github – Published: 2022-09-14 00:00 – Updated: 2022-09-14 00:00
VLAI
Details
Windows Graphics Component Information Disclosure Vulnerability. This CVE ID is unique from CVE-2022-34728, CVE-2022-35837.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-38006"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-13T19:15:00Z",
"severity": "MODERATE"
},
"details": "Windows Graphics Component Information Disclosure Vulnerability. This CVE ID is unique from CVE-2022-34728, CVE-2022-35837.",
"id": "GHSA-rrx8-hrj2-395q",
"modified": "2022-09-14T00:00:45Z",
"published": "2022-09-14T00:00:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38006"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38006"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-38006"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.