← Back
CWE-402

23 CVEs • Abstraction: Class

Transmission of Private Resources into a New Sphere ('Resource Leak')

The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product.

JSON object

Loading...

CVEs (23)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-31410
1Vaadin
1Designer
Jun 17, 2026
Apr 23, 2021
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Overly relaxed configuration of frontend resources server in Vaadin Designer versions 4.3.0 through 4.6.3 allows remote attackers to access project sources via crafted HTTP request.
CVE-2021-31407
1Vaadin
2Flow
Vaadin
Jun 17, 2026
Apr 23, 2021
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources...Show more
Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.Show less
CVE-2017-8442
1Elastic
1X Pack
May 13, 2026
Jul 7, 2017
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch _nodes API leaking sensitive configuration information, such as the paths and passphrases of SSL keys that were configu...Show more
Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch _nodes API leaking sensitive configuration information, such as the paths and passphrases of SSL keys that were configured as part of an authentication realm. This could allow an authenticated Elasticsearch user to improperly view these details.Show less