← Back
CWE-668

763 CVEs • Abstraction: Class

Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

JSON object

Loading...

CVEs (763)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-41745
1Acronis
2Agent
Cyber Protect
Jun 17, 2026
Aug 31, 2023
N/A· v4
5.5 MEDIUM· v3
N/A· v2
Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 30991, Acronis Cyber Protect 15 (Linux, macOS, W...Show more
Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 30991, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.Show less
CVE-2023-41742
1Acronis
2Agent
Cyber Protect
Jun 17, 2026
Aug 31, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
Excessive attack surface due to binding to an unrestricted IP address. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 30430, Acronis Cyber Protect 15 (Linux, macOS, Windows) befor...Show more
Excessive attack surface due to binding to an unrestricted IP address. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 30430, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.Show less
CVE-2023-34725
1Jaycar
1La5570 Firmware
Jun 17, 2026
Aug 28, 2023
N/A· v4
6.8 MEDIUM· v3
N/A· v2
An issue was discovered in TechView LA-5570 Wireless Gateway 1.0.19_T53, allows physical attackers to gain escalated privileges via a telnet connection.
CVE-2023-4230
1Moxa
1Iologik E4200 Firmware
Jun 17, 2026
Aug 24, 2023
N/A· v4
5.3 MEDIUM· v3
N/A· v2
A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which has the potential to facilitate the collection of information on ioLogik 4000 Series devices. This vulner...Show more
A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which has the potential to facilitate the collection of information on ioLogik 4000 Series devices. This vulnerability may enable attackers to gather information for the purpose of assessing vulnerabilities and potential attack vectors.Show less
CVE-2023-39974
1Acymailing
1Acymailing
Jun 17, 2026
Aug 17, 2023
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Exposure of Sensitive Information vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized actors to get the number of subscribers in a specific list.
CVE-2023-39250
1Dell
3Replay Manager For Vmware
Storage Integration Tools For VmwareStorage Vsphere Client Plugin
Jun 17, 2026
Aug 16, 2023
N/A· v4
5.5 MEDIUM· v3
N/A· v2
Dell Storage Integration Tools for VMware (DSITV) and Dell Storage vSphere Client Plugin (DSVCP) versions prior to 6.1.1 and Replay Manager for VMware (RMSV) versions prior to 3.1.2 contain an information disclosure v...Show more
Dell Storage Integration Tools for VMware (DSITV) and Dell Storage vSphere Client Plugin (DSVCP) versions prior to 6.1.1 and Replay Manager for VMware (RMSV) versions prior to 3.1.2 contain an information disclosure vulnerability. A local low-privileged malicious user could potentially exploit this vulnerability to retrieve an encryption key that could aid in further attacks. Show less
CVE-2023-2916
1Revmakx
1Infinitewp Client
Jun 17, 2026
Aug 15, 2023
N/A· v4
5.3 MEDIUM· v3
N/A· v2
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. This can allow authenticated attackers with subscriber-...Show more
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including configuration. It can only be exploited if the plugin has not been configured yet. If combined with another arbitrary plugin installation and activation vulnerability, it may be possible to connect a site to InfiniteWP which would make remote management possible and allow for elevation of privileges.Show less
CVE-2023-39383
1Huawei
2Emui
Harmonyos
Jun 17, 2026
Aug 13, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
Vulnerability of input parameters being not strictly verified in the AMS module. Successful exploitation of this vulnerability may compromise apps' data security.
CVE-2023-38830
1Phpjabbers
1Yacht Listing Script
Jun 17, 2026
Aug 10, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
An information leak in PHPJabbers Yacht Listing Script v1.0 allows attackers to export clients' credit card numbers from the Reservations module.
CVE-2023-39214
1Zoom
3Meeting Software Development Kit
RoomsZoom
Jun 17, 2026
Aug 8, 2023
N/A· v4
8.1 HIGH· v3
N/A· v2
Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial of service via network access.
CVE-2023-38955
1Zkteco
1Bioaccess Ivs
Jul 9, 2026
Aug 3, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices, including their IP addresses and device names.
CVE-2023-33368
1Assaabloy
1Control Id Idsecure
Jun 17, 2026
Aug 3, 2023
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Some API routes exists in Control ID IDSecure 4.7.26.0 and prior, exfiltrating sensitive information and passwords to users accessing these API routes.
CVE-2023-3670
1Codesys
2Development System
Scripting
Jun 17, 2026
Jul 28, 2023
N/A· v4
7.3 HIGH· v3
N/A· v2
In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disgui...Show more
In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users.Show less
CVE-2023-39155
1Jenkins
1Chef Identity
Jun 17, 2026
Jul 26, 2023
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it.
CVE-2022-46901
1Vocera
2Report Server
Voice Server
Jun 17, 2026
Jul 25, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is an Access Control Violation for Database Operations. The Vocera Report Console contains a websocket interface that allows for the...Show more
An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is an Access Control Violation for Database Operations. The Vocera Report Console contains a websocket interface that allows for the unauthenticated execution of various tasks and database functions. This includes system tasks, and backing up, loading, and clearing of the database.Show less
CVE-2023-34189
1Apache
1Inlong
Jun 17, 2026
Jul 25, 2023
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The attacker could use general users to delete and update the pro...Show more
Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The attacker could use general users to delete and update the process, which only the admin can operate occurrences.  Users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8109  to solve it.Show less
CVE-2023-37645
1Eyoucms
1Eyoucms
Jun 17, 2026
Jul 20, 2023
N/A· v4
5.3 MEDIUM· v3
N/A· v2
eyoucms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom_model_path/recruit.filelist.txt.
CVE-2023-3299
1Hashicorp
1Nomad
Jun 17, 2026
Jul 20, 2023
N/A· v4
2.7 LOW· v3
N/A· v2
HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11.
CVE-2023-32760
1Archerirm
1Archer
Jun 17, 2026
Jul 14, 2023
N/A· v4
6.5 MEDIUM· v3
N/A· v2
An issue in Archer Platform before v.6.13 fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to obtain sensitive information via API calls related to data feeds and data publication.
CVE-2023-32759
1Archerirm
1Archer
Jun 17, 2026
Jul 14, 2023
N/A· v4
6.5 MEDIUM· v3
N/A· v2
An issue in Archer Platform before v.6.13 and fixed in 6.12.0.6 and 6.13.0 allows an authenticated attacker to obtain sensitive information via a crafted URL.