Common Weakness Enumeration
CWE-668
DiscouragedExposure of Resource to Wrong Sphere
Abstraction: Class · Status: Draft
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
1277 vulnerabilities reference this CWE, most recent first.
GHSA-VW84-HPRM-CXMM
Vulnerability from github – Published: 2025-10-31 21:24 – Updated: 2025-10-31 21:24
VLAI
Summary
Agno session state overwrites between different sessions/users
Details
Impact
Under certain conditions (under high concurrency), when session_state is passed to an Agent or Team during run or arun calls, a race condition can occur, causing a session_state to be assigned and persisted to the incorrect session. This may result in user data from one session being exposed to another user.
Patches
This has been patched in version 2.2.2. Upgrade with pip install -U agno.
Severity
7.1 (High)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "agno"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-64168"
],
"database_specific": {
"cwe_ids": [
"CWE-362",
"CWE-668"
],
"github_reviewed": true,
"github_reviewed_at": "2025-10-31T21:24:53Z",
"nvd_published_at": "2025-10-31T15:15:43Z",
"severity": "HIGH"
},
"details": "### Impact\nUnder certain conditions (under high concurrency), when `session_state` is passed to an Agent or Team during run or arun calls, a race condition can occur, causing a `session_state` to be assigned and persisted to the incorrect session. This may result in user data from one session being exposed to another user.\n\n### Patches\nThis has been patched in version 2.2.2. Upgrade with `pip install -U agno`.",
"id": "GHSA-vw84-hprm-cxmm",
"modified": "2025-10-31T21:24:53Z",
"published": "2025-10-31T21:24:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/agno-agi/agno/security/advisories/GHSA-vw84-hprm-cxmm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64168"
},
{
"type": "PACKAGE",
"url": "https://github.com/agno-agi/agno"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Agno session state overwrites between different sessions/users"
}
GHSA-VWFH-HRM2-8Q9H
Vulnerability from github – Published: 2022-08-19 00:00 – Updated: 2022-08-20 00:00
VLAI
Details
Browse restriction bypass vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Scheduler.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-25986"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-18T08:15:00Z",
"severity": "MODERATE"
},
"details": "Browse restriction bypass vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Scheduler.",
"id": "GHSA-vwfh-hrm2-8q9h",
"modified": "2022-08-20T00:00:57Z",
"published": "2022-08-19T00:00:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25986"
},
{
"type": "WEB",
"url": "https://cs.cybozu.co.jp/2022/007584.html"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN20573662/index.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VWXH-HR5C-V523
Vulnerability from github – Published: 2022-05-24 19:06 – Updated: 2022-05-24 19:06
VLAI
Details
An Arbitrary Address Write issue in the Autodesk DWG application can allow a malicious user to leverage the application to write in unexpected paths. In order to exploit this the attacker would need the victim to enable full page heap in the application.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-27043"
],
"database_specific": {
"cwe_ids": [
"CWE-668",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-25T13:15:00Z",
"severity": "MODERATE"
},
"details": "An Arbitrary Address Write issue in the Autodesk DWG application can allow a malicious user to leverage the application to write in unexpected paths. In order to exploit this the attacker would need the victim to enable full page heap in the application.",
"id": "GHSA-vwxh-hr5c-v523",
"modified": "2022-05-24T19:06:19Z",
"published": "2022-05-24T19:06:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27043"
},
{
"type": "WEB",
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0004"
},
{
"type": "WEB",
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0007"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-470"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VX2P-M3J3-FJ93
Vulnerability from github – Published: 2022-05-13 00:00 – Updated: 2022-06-02 00:00
VLAI
Details
A malicious or compromised User Application (UApp) or AGESA Boot Loader (ABL) could be used by an attacker to exfiltrate arbitrary memory from the ASP stage 2 bootloader potentially leading to information disclosure.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-26361"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-12T18:16:00Z",
"severity": "MODERATE"
},
"details": "A malicious or compromised User Application (UApp) or AGESA Boot Loader (ABL) could be used by an attacker to exfiltrate arbitrary memory from the ASP stage 2 bootloader potentially leading to information disclosure.",
"id": "GHSA-vx2p-m3j3-fj93",
"modified": "2022-06-02T00:00:26Z",
"published": "2022-05-13T00:00:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26361"
},
{
"type": "WEB",
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VXF8-WWPW-PHXG
Vulnerability from github – Published: 2023-05-12 12:30 – Updated: 2024-03-21 03:35
VLAI
Details
An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to access sensitive information via the EXE installer.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-29820"
],
"database_specific": {
"cwe_ids": [
"CWE-552",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-12T11:15:12Z",
"severity": "MODERATE"
},
"details": "An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to access sensitive information via the EXE installer.",
"id": "GHSA-vxf8-wwpw-phxg",
"modified": "2024-03-21T03:35:15Z",
"published": "2023-05-12T12:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29820"
},
{
"type": "WEB",
"url": "https://www.spenceralessi.com/CVEs/2023-05-10-Webroot-SecureAnywhere"
},
{
"type": "WEB",
"url": "http://secureanywhere.com"
},
{
"type": "WEB",
"url": "http://webroot.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VXJH-JV72-7244
Vulnerability from github – Published: 2023-08-31 18:30 – Updated: 2023-08-31 18:30
VLAI
Details
Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 30991, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.
Severity
6.1 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-41745"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-31T18:15:09Z",
"severity": "MODERATE"
},
"details": "Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 30991, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.",
"id": "GHSA-vxjh-jv72-7244",
"modified": "2023-08-31T18:30:28Z",
"published": "2023-08-31T18:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41745"
},
{
"type": "WEB",
"url": "https://security-advisory.acronis.com/advisories/SEC-2008"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VXJX-P5M9-Q5FR
Vulnerability from github – Published: 2021-11-25 00:00 – Updated: 2026-08-19 18:31
VLAI
Details
Azure Active Directory Information Disclosure Vulnerability
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-42306"
],
"database_specific": {
"cwe_ids": [
"CWE-522",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-24T01:15:00Z",
"severity": "MODERATE"
},
"details": "Azure Active Directory Information Disclosure Vulnerability",
"id": "GHSA-vxjx-p5m9-q5fr",
"modified": "2026-08-19T18:31:44Z",
"published": "2021-11-25T00:00:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42306"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42306"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42306"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VXMC-QG5X-PVFX
Vulnerability from github – Published: 2022-12-14 21:30 – Updated: 2025-04-21 22:51
VLAI
Summary
"Newsletter subscriber management" (fp_newsletter) TYPO3 extension leaks subscriber data
Details
An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Data about subscribers may be obtained via createAction operations.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "fixpunkt/fp-newsletter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "fixpunkt/fp-newsletter"
},
"ranges": [
{
"events": [
{
"introduced": "1.2.0"
},
{
"fixed": "2.1.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "fixpunkt/fp-newsletter"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.2.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-47410"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-668"
],
"github_reviewed": true,
"github_reviewed_at": "2025-04-21T22:51:49Z",
"nvd_published_at": "2022-12-14T21:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Data about subscribers may be obtained via createAction operations.",
"id": "GHSA-vxmc-qg5x-pvfx",
"modified": "2025-04-21T22:51:49Z",
"published": "2022-12-14T21:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47410"
},
{
"type": "PACKAGE",
"url": "https://github.com/bihor/fp_newsletter"
},
{
"type": "WEB",
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2022-017"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": " \"Newsletter subscriber management\" (fp_newsletter) TYPO3 extension leaks subscriber data"
}
GHSA-VXMX-VJ5X-4642
Vulnerability from github – Published: 2022-07-18 00:00 – Updated: 2022-07-19 00:00
VLAI
Details
Pexip Infinity 27.x before 27.2 has Improper Access Control. An attacker can sometimes join a conference (call join) if it has a lock but not a PIN.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-25357"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-17T21:15:00Z",
"severity": "MODERATE"
},
"details": "Pexip Infinity 27.x before 27.2 has Improper Access Control. An attacker can sometimes join a conference (call join) if it has a lock but not a PIN.",
"id": "GHSA-vxmx-vj5x-4642",
"modified": "2022-07-19T00:00:28Z",
"published": "2022-07-18T00:00:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25357"
},
{
"type": "WEB",
"url": "https://docs.pexip.com/admin/security_bulletins.htm#CVE-2022-25357"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VXP2-RM45-4PJG
Vulnerability from github – Published: 2021-11-17 19:13 – Updated: 2022-05-12 00:01
VLAI
Details
PSP protection against improperly configured side channels may lead to potential information disclosure. This issue affects: AMD 1st Gen AMD EPYC™ versions prior to NaplesPI-SP3_1.0.0.G. AMD 2nd Gen AMD EPYC™ versions prior to RomePI-SP3_1.0.0.C. AMD 3rd Gen AMD EPYC™ versions prior to MilanPI-SP3_1.0.0.4.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-26312"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-16T18:15:00Z",
"severity": "MODERATE"
},
"details": "PSP protection against improperly configured side channels may lead to potential information disclosure. This issue affects: AMD 1st Gen AMD EPYC\u2122 versions prior to NaplesPI-SP3_1.0.0.G. AMD 2nd Gen AMD EPYC\u2122 versions prior to RomePI-SP3_1.0.0.C. AMD 3rd Gen AMD EPYC\u2122 versions prior to MilanPI-SP3_1.0.0.4.",
"id": "GHSA-vxp2-rm45-4pjg",
"modified": "2022-05-12T00:01:44Z",
"published": "2021-11-17T19:13:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26312"
},
{
"type": "WEB",
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1021"
},
{
"type": "WEB",
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027"
},
{
"type": "WEB",
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.