Common Weakness Enumeration
CWE-668
DiscouragedExposure of Resource to Wrong Sphere
Abstraction: Class · Status: Draft
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
1286 vulnerabilities reference this CWE, most recent first.
GHSA-GWRJ-9V3P-9982
Vulnerability from github – Published: 2022-09-30 00:00 – Updated: 2022-10-04 00:00
VLAI
Details
In BigBlueButton before 2.2.7, lockSettingsProps.disablePrivateChat does not apply to already opened chats. This occurs in bigbluebutton-html5/imports/ui/components/chat/service.js.
Severity
{
"affected": [],
"aliases": [
"CVE-2020-27601"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-29T03:15:00Z",
"severity": "LOW"
},
"details": "In BigBlueButton before 2.2.7, lockSettingsProps.disablePrivateChat does not apply to already opened chats. This occurs in bigbluebutton-html5/imports/ui/components/chat/service.js.",
"id": "GHSA-gwrj-9v3p-9982",
"modified": "2022-10-04T00:00:19Z",
"published": "2022-09-30T00:00:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27601"
},
{
"type": "WEB",
"url": "https://github.com/bigbluebutton/bigbluebutton/commit/7dcdfb191373684bafa7b11cdd0128c9869040a1"
},
{
"type": "WEB",
"url": "https://github.com/bigbluebutton/bigbluebutton/compare/v2.2.6...v2.2.7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H238-V7R9-R6G7
Vulnerability from github – Published: 2023-09-18 21:30 – Updated: 2024-04-04 07:43
VLAI
Details
An information leak in Camp Style Project Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-39039"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-18T21:15:54Z",
"severity": "MODERATE"
},
"details": "An information leak in Camp Style Project Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.",
"id": "GHSA-h238-v7r9-r6g7",
"modified": "2024-04-04T07:43:24Z",
"published": "2023-09-18T21:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39039"
},
{
"type": "WEB",
"url": "https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39039.md"
},
{
"type": "WEB",
"url": "http://camp.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H29M-QM63-F57F
Vulnerability from github – Published: 2023-07-28 09:30 – Updated: 2024-04-04 06:24
VLAI
Details
In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users.
Severity
7.3 (High)
{
"affected": [],
"aliases": [
"CVE-2023-3670"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-28T08:15:10Z",
"severity": "HIGH"
},
"details": "In CODESYS Development System 3.5.9.0 to\u00a03.5.17.0 and\u00a0CODESYS Scripting\u00a04.0.0.0 to\u00a04.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users.",
"id": "GHSA-h29m-qm63-f57f",
"modified": "2024-04-04T06:24:57Z",
"published": "2023-07-28T09:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3670"
},
{
"type": "WEB",
"url": "https://cert.vde.com/en/advisories/VDE-2023-024"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H32Q-4PPH-8PGM
Vulnerability from github – Published: 2024-12-10 15:32 – Updated: 2024-12-16 15:31
VLAI
Details
Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on A77, A78, A78C, A78AE, A710, V1, V2, V3, V3AE, X1, X1C, X2, X3, X4, N2, X925 & Travis may permit bypass of Stage-2 translation and/or GPT protection
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2024-5660"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-10T14:30:47Z",
"severity": "CRITICAL"
},
"details": "Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on A77, A78, A78C, A78AE, A710, V1, V2, V3, V3AE, X1, X1C, X2, X3, X4, N2, X925 \u0026 Travis\u00a0may permit bypass of Stage-2 translation and/or GPT protection",
"id": "GHSA-h32q-4pph-8pgm",
"modified": "2024-12-16T15:31:34Z",
"published": "2024-12-10T15:32:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5660"
},
{
"type": "WEB",
"url": "https://developer.arm.com/Arm%20Security%20Center/Arm%20CPU%20Vulnerability%20CVE-2024-5660"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H3P7-G5CP-X5QF
Vulnerability from github – Published: 2022-10-07 18:15 – Updated: 2022-10-09 00:00
VLAI
Details
IBM QRadar SIEM 7.4 and 7.5 could disclose sensitive information via a local service to a privileged user. IBM X-Force ID: 227366.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-30613"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-07T17:15:00Z",
"severity": "MODERATE"
},
"details": "IBM QRadar SIEM 7.4 and 7.5 could disclose sensitive information via a local service to a privileged user. IBM X-Force ID: 227366.",
"id": "GHSA-h3p7-g5cp-x5qf",
"modified": "2022-10-09T00:00:19Z",
"published": "2022-10-07T18:15:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30613"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/227366"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6826693"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H4H4-7HV6-XJWJ
Vulnerability from github – Published: 2023-07-21 00:30 – Updated: 2024-04-04 06:18
VLAI
Details
eyoucms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom_model_path/recruit.filelist.txt.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-37645"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-20T22:15:10Z",
"severity": "MODERATE"
},
"details": "eyoucms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom_model_path/recruit.filelist.txt.",
"id": "GHSA-h4h4-7hv6-xjwj",
"modified": "2024-04-04T06:18:14Z",
"published": "2023-07-21T00:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37645"
},
{
"type": "WEB",
"url": "https://github.com/weng-xianhu/eyoucms/issues/50"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H4JW-W55G-65GF
Vulnerability from github – Published: 2026-08-21 12:30 – Updated: 2026-08-21 12:30
VLAI
Details
In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts. Affected versions: Spring AI: 2.0.0
Severity
4.2 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-59308"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-21T12:16:30Z",
"severity": "MODERATE"
},
"details": "In Spring AI\u0027s Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts.\nAffected versions:\nSpring AI: 2.0.0",
"id": "GHSA-h4jw-w55g-65gf",
"modified": "2026-08-21T12:30:34Z",
"published": "2026-08-21T12:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59308"
},
{
"type": "WEB",
"url": "https://spring.io/security/cve-2026-59308"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H4M3-GMCR-5VQW
Vulnerability from github – Published: 2022-05-24 17:42 – Updated: 2022-05-24 17:42
VLAI
Details
An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. getfile.asp allows Unauthenticated Local File Inclusion, which can be leveraged to achieve Remote Code Execution.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2021-27236"
],
"database_specific": {
"cwe_ids": [
"CWE-668",
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-16T04:15:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. getfile.asp allows Unauthenticated Local File Inclusion, which can be leveraged to achieve Remote Code Execution.",
"id": "GHSA-h4m3-gmcr-5vqw",
"modified": "2022-05-24T17:42:23Z",
"published": "2022-05-24T17:42:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27236"
},
{
"type": "WEB",
"url": "https://www.mutare.com/security-adv-mutare-2021-001-mutare-voice"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H4M4-PGP4-WHGM
Vulnerability from github – Published: 2021-07-02 19:19 – Updated: 2022-10-25 20:25
VLAI
Summary
The reset password form reveal users email address
Details
Impact
The reset password form reveals the email address of users just by giving their username.
Patches
The problem has been patched on XWiki 13.2RC1.
Workarounds
It's possible to manually modify the resetpasswordinline.vm to perform the changes made in https://github.com/xwiki/xwiki-platform/commit/0cf716250b3645a5974c80d8336dcdf885749dff#diff-14a3132e3986b1f5606dd13d9d8a8bb8634bec9932123c5e49e9604cfd850fc2
References
https://jira.xwiki.org/browse/XWIKI-18400
For more information
If you have any questions or comments about this advisory: * Open an issue in Jira XWiki * Email us at Security ML
Severity
5.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.platform:xwiki-platform-web"
},
"ranges": [
{
"events": [
{
"introduced": "13.1"
},
{
"fixed": "13.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-32731"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-668"
],
"github_reviewed": true,
"github_reviewed_at": "2021-07-02T16:39:50Z",
"nvd_published_at": "2021-07-01T19:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\nThe reset password form reveals the email address of users just by giving their username.\n\n### Patches\nThe problem has been patched on XWiki 13.2RC1.\n\n### Workarounds\nIt\u0027s possible to manually modify the `resetpasswordinline.vm` to perform the changes made in https://github.com/xwiki/xwiki-platform/commit/0cf716250b3645a5974c80d8336dcdf885749dff#diff-14a3132e3986b1f5606dd13d9d8a8bb8634bec9932123c5e49e9604cfd850fc2\n\n### References\nhttps://jira.xwiki.org/browse/XWIKI-18400\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki](https://jira.xiwki.org)\n* Email us at [Security ML](mailto:security@xwiki.org)\n",
"id": "GHSA-h4m4-pgp4-whgm",
"modified": "2022-10-25T20:25:48Z",
"published": "2021-07-02T19:19:04Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h4m4-pgp4-whgm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32731"
},
{
"type": "WEB",
"url": "https://github.com/xwiki/xwiki-platform/commit/0cf716250b3645a5974c80d8336dcdf885749dff#diff-14a3132e3986b1f5606dd13d9d8a8bb8634bec9932123c5e49e9604cfd850fc2"
},
{
"type": "PACKAGE",
"url": "https://github.com/xwiki/xwiki-platform"
},
{
"type": "WEB",
"url": "https://jira.xwiki.org/browse/XWIKI-18400"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "The reset password form reveal users email address"
}
GHSA-H57H-9X5H-V7JM
Vulnerability from github – Published: 2022-09-10 00:00 – Updated: 2022-09-15 00:00
VLAI
Details
Improper restriction of broadcasting Intent in SaWebViewRelayActivity of?Waterplugin prior to version 2.2.11.22081151 allows attacker to access the file without permission.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-36875"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-09T15:15:00Z",
"severity": "MODERATE"
},
"details": "Improper restriction of broadcasting Intent in SaWebViewRelayActivity of?Waterplugin prior to version 2.2.11.22081151 allows attacker to access the file without permission.",
"id": "GHSA-h57h-9x5h-v7jm",
"modified": "2022-09-15T00:00:17Z",
"published": "2022-09-10T00:00:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36875"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2022\u0026month=09"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/serviceWeb.smsb?year==2022\u0026month=09"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.