Common Weakness Enumeration
CWE-668
DiscouragedExposure of Resource to Wrong Sphere
Abstraction: Class · Status: Draft
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
1277 vulnerabilities reference this CWE, most recent first.
GHSA-V3V9-3JF4-5PXX
Vulnerability from github – Published: 2023-06-07 21:30 – Updated: 2023-06-16 17:55
VLAI
Summary
Jeecg P3 Biz Chat allows remote attackers to read arbitrary files
Details
Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jeecgframework.p3:jeecg-p3-biz-chat"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-33510"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": true,
"github_reviewed_at": "2023-06-09T22:54:03Z",
"nvd_published_at": "2023-06-07T20:15:09Z",
"severity": "HIGH"
},
"details": "Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters.",
"id": "GHSA-v3v9-3jf4-5pxx",
"modified": "2023-06-16T17:55:54Z",
"published": "2023-06-07T21:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33510"
},
{
"type": "WEB",
"url": "https://carl1l.github.io/2023/05/08/jeecg-p3-biz-chat-1-0-5-jar-has-arbitrary-file-read-vulnerability"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jeecg P3 Biz Chat allows remote attackers to read arbitrary files"
}
GHSA-V46M-W3JC-VMR2
Vulnerability from github – Published: 2022-04-15 00:00 – Updated: 2022-04-22 00:00
VLAI
Details
An issue was discovered in Amazon AWS VPN Client 2.0.0. A TOCTOU race condition exists during the validation of VPN configuration files. This allows parameters outside of the AWS VPN Client allow list to be injected into the configuration file prior to the AWS VPN Client service (running as SYSTEM) processing the file. Dangerous arguments can be injected by a low-level user such as log, which allows an arbitrary destination to be specified for writing log files. This leads to an arbitrary file write as SYSTEM with partial control over the files content. This can be abused to cause an elevation of privilege or denial of service.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-25165"
],
"database_specific": {
"cwe_ids": [
"CWE-367",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-14T16:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Amazon AWS VPN Client 2.0.0. A TOCTOU race condition exists during the validation of VPN configuration files. This allows parameters outside of the AWS VPN Client allow list to be injected into the configuration file prior to the AWS VPN Client service (running as SYSTEM) processing the file. Dangerous arguments can be injected by a low-level user such as log, which allows an arbitrary destination to be specified for writing log files. This leads to an arbitrary file write as SYSTEM with partial control over the files content. This can be abused to cause an elevation of privilege or denial of service.",
"id": "GHSA-v46m-w3jc-vmr2",
"modified": "2022-04-22T00:00:53Z",
"published": "2022-04-15T00:00:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25165"
},
{
"type": "WEB",
"url": "https://github.com/RhinoSecurityLabs/CVEs"
},
{
"type": "WEB",
"url": "https://rhinosecuritylabs.com/aws/cve-2022-25165-aws-vpn-client"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-V4JR-7W4C-HG9P
Vulnerability from github – Published: 2022-08-13 00:00 – Updated: 2022-08-16 00:00
VLAI
Details
Insufficient policy enforcement in Background Fetch in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-2610"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-12T20:15:00Z",
"severity": "MODERATE"
},
"details": "Insufficient policy enforcement in Background Fetch in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page.",
"id": "GHSA-v4jr-7w4c-hg9p",
"modified": "2022-08-16T00:00:23Z",
"published": "2022-08-13T00:00:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2610"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html"
},
{
"type": "WEB",
"url": "https://crbug.com/1278255"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202208-35"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-V4P3-H3RX-Q79H
Vulnerability from github – Published: 2022-04-08 00:00 – Updated: 2022-04-19 00:01
VLAI
Details
A remote, unauthenticated attacker could utilize the control programmer of the CODESYS Control runtime system to use the vulnerability in order to read and modify the configuration file(s) of the affected products.
Severity
8.1 (High)
{
"affected": [],
"aliases": [
"CVE-2022-22515"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-07T19:15:00Z",
"severity": "HIGH"
},
"details": "A remote, unauthenticated attacker could utilize the control programmer of the CODESYS Control runtime system to use the vulnerability in order to read and modify the configuration file(s) of the affected products.",
"id": "GHSA-v4p3-h3rx-q79h",
"modified": "2022-04-19T00:01:33Z",
"published": "2022-04-08T00:00:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22515"
},
{
"type": "WEB",
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17089\u0026token=cc5041e24fc744a397a6f6e3b78200a40e6fcd53\u0026download="
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-V4QW-4358-7WH4
Vulnerability from github – Published: 2021-12-14 00:00 – Updated: 2021-12-17 00:00
VLAI
Details
Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to see the names of project access tokens on arbitrary projects
{
"affected": [],
"aliases": [
"CVE-2021-39915"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-13T16:15:00Z",
"severity": "MODERATE"
},
"details": "Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to see the names of project access tokens on arbitrary projects",
"id": "GHSA-v4qw-4358-7wh4",
"modified": "2021-12-17T00:00:54Z",
"published": "2021-12-14T00:00:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39915"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/1336059"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39915.json"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/340803"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-V4VG-CX5M-VC5G
Vulnerability from github – Published: 2021-12-24 00:00 – Updated: 2022-10-22 12:00
VLAI
Details
An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exposing configuration meta-data.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2021-20050"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-23T02:15:00Z",
"severity": "HIGH"
},
"details": "An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exposing configuration meta-data.",
"id": "GHSA-v4vg-cx5m-vc5g",
"modified": "2022-10-22T12:00:28Z",
"published": "2021-12-24T00:00:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20050"
},
{
"type": "WEB",
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0031"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-V583-7M9J-97CW
Vulnerability from github – Published: 2022-05-24 19:21 – Updated: 2022-07-13 00:01
VLAI
Details
OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-38376"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-22T09:15:00Z",
"severity": "MODERATE"
},
"details": "OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call.",
"id": "GHSA-v583-7m9j-97cw",
"modified": "2022-07-13T00:01:34Z",
"published": "2022-05-24T19:21:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38376"
},
{
"type": "WEB",
"url": "https://seclists.org/fulldisclosure/2021/Nov/43"
},
{
"type": "WEB",
"url": "https://www.open-xchange.com"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/165038/OX-App-Suite-7.10.5-Cross-Site-Scripting-Information-Disclosure.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-V5Q9-W576-R6PH
Vulnerability from github – Published: 2022-12-06 09:30 – Updated: 2022-12-07 21:30
VLAI
Details
In wlan driver, there is a possible missing permission check, This could lead to local information disclosure.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-42766"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-668",
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-06T07:15:00Z",
"severity": "MODERATE"
},
"details": "In wlan driver, there is a possible missing permission check, This could lead to local information disclosure.",
"id": "GHSA-v5q9-w576-r6ph",
"modified": "2022-12-07T21:30:30Z",
"published": "2022-12-06T09:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42766"
},
{
"type": "WEB",
"url": "https://www.unisoc.com/en_us/secy/announcementDetail/1599588060988411006"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-V63V-32VM-PX2M
Vulnerability from github – Published: 2022-01-31 00:00 – Updated: 2023-08-08 15:31
VLAI
Details
Adenza AxiomSL ControllerView through 10.8.1 is vulnerable to user enumeration. An attacker can identify valid usernames on the platform because a failed login attempt produces a different error message when the username is valid.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-24032"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-30T01:15:00Z",
"severity": "MODERATE"
},
"details": "Adenza AxiomSL ControllerView through 10.8.1 is vulnerable to user enumeration. An attacker can identify valid usernames on the platform because a failed login attempt produces a different error message when the username is valid.",
"id": "GHSA-v63v-32vm-px2m",
"modified": "2023-08-08T15:31:37Z",
"published": "2022-01-31T00:00:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24032"
},
{
"type": "WEB",
"url": "https://github.com/jdordonezn/CVE-2022-24032/issues/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-V642-MH27-8J6M
Vulnerability from github – Published: 2023-10-17 14:20 – Updated: 2025-08-11 14:48
VLAI
Summary
MantisBT may disclose project names to unauthorized users
Details
Impact
Due to insufficient access-level checks on the Wiki redirection page, any user can reveal private Projects' names, by accessing wiki.php with sequentially incremented IDs.
Patches
The vulnerability has been fixed in MantisBT version 2.25.8 (https://github.com/mantisbt/mantisbt/commit/65c44883f9d24f3ccef066fb523c93d8fdd7afc1).
Workarounds
Disable wiki integration ( $g_wiki_enable = OFF;)
References
- https://mantisbt.org/bugs/view.php?id=32981
Severity
4.3 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.25.7"
},
"package": {
"ecosystem": "Packagist",
"name": "mantisbt/mantisbt"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.25.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-44394"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-668"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-17T14:20:36Z",
"nvd_published_at": "2023-10-16T22:15:12Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nDue to insufficient access-level checks on the Wiki redirection page, any user can reveal private Projects\u0027 names, by accessing wiki.php with sequentially incremented IDs.\n\n### Patches\nThe vulnerability has been fixed in MantisBT version 2.25.8 (https://github.com/mantisbt/mantisbt/commit/65c44883f9d24f3ccef066fb523c93d8fdd7afc1).\n\n### Workarounds\nDisable wiki integration ( `$g_wiki_enable = OFF;`)\n\n### References\n- https://mantisbt.org/bugs/view.php?id=32981",
"id": "GHSA-v642-mh27-8j6m",
"modified": "2025-08-11T14:48:38Z",
"published": "2023-10-17T14:20:36Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-v642-mh27-8j6m"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44394"
},
{
"type": "WEB",
"url": "https://github.com/mantisbt/mantisbt/commit/65c44883f9d24f3ccef066fb523c93d8fdd7afc1"
},
{
"type": "PACKAGE",
"url": "https://github.com/mantisbt/mantisbt"
},
{
"type": "WEB",
"url": "https://mantisbt.org/bugs/view.php?id=32981"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "MantisBT may disclose project names to unauthorized users "
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.