Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

CVEs (763)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-32550 1Canonical 1Landscape Jun 17, 2026 Jun 6, 2023 N/A· v4 8.2 HIGH· v3 N/A· v2 Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further information from the Landscape API.
CVE-2022-40525 1Qualcomm 31Csr8811 Firmware Ipq6000 FirmwareIpq6005 Firmware+28 more Jun 17, 2026 Jun 6, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 Information disclosure in Linux Networking Firmware due to unauthorized information leak during side channel analysis.
CVE-2022-40523 1Qualcomm 1859205 Lte Modem Firmware Aqt1000 FirmwareAr8031 Firmware+182 more Jun 17, 2026 Jun 6, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 Information disclosure in Kernel due to indirect branch misprediction.
CVE-2023-33518 1Emoncms 1Emoncms Jun 17, 2026 Jun 5, 2023 N/A· v4 5.3 MEDIUM· v3 N/A· v2 emoncms v11 and later was discovered to contain an information disclosure vulnerability which allows attackers to obtain the web directory path and other information leaked by the server via a crafted web request.
CVE-2023-29538 1Mozilla 3Firefox Firefox MobileFocus Aug 19, 2026 Jun 2, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-extension:///</code> URI during a load request. This leaked directory paths on the user's machine. This...Show more Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-extension:///</code> URI during a load request. This leaked directory paths on the user's machine. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.Show less
CVE-2023-25750 1Mozilla 1Firefox Jun 17, 2026 Jun 2, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Under certain circumstances, a ServiceWorker's offline cache may have leaked to the file system when using private browsing mode. This vulnerability affects Firefox < 111.
CVE-2023-2062 1Mitsubishielectric 4Fx5 Enet/ip Firmware Rj71eip91 FirmwareSw1dnn Eipct Bd Firmware+1 more Jun 17, 2026 Jun 2, 2023 N/A· v4 6.2 MEDIUM· v3 N/A· v2 Missing Password Field Masking vulnerability in Mitsubishi Electric Corporation EtherNet/IP configuration tools SW1DNN-EIPCT-BD and SW1DNN-EIPCTFX5-BD allows a remote unauthenticated attacker to know the password for MEL...Show more Missing Password Field Masking vulnerability in Mitsubishi Electric Corporation EtherNet/IP configuration tools SW1DNN-EIPCT-BD and SW1DNN-EIPCTFX5-BD allows a remote unauthenticated attacker to know the password for MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP. This vulnerability results in authentication bypass vulnerability, which allows the attacker to access MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP via FTP.Show less
CVE-2023-28344 1Faronics 1Insight Jun 17, 2026 May 31, 2023 N/A· v4 7.1 HIGH· v3 N/A· v2 An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application allows unauthenticated attackers to view constantly updated screenshots of student desktops and to submit falsifi...Show more An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application allows unauthenticated attackers to view constantly updated screenshots of student desktops and to submit falsified screenshots on behalf of students. Attackers are able to view screenshots of student desktops without their consent. These screenshots may potentially contain sensitive/personal data. Attackers can also rapidly submit falsified images, hiding the actual contents of student desktops from the Teacher Console.Show less
CVE-2023-2703 1Finexmedia 1Competition Management System Jun 17, 2026 May 23, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Finex Media Competition Management System allows Retrieve Embedded Sensitive Data, Collect Data as Provided by Users. This issue affects...Show more Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Finex Media Competition Management System allows Retrieve Embedded Sensitive Data, Collect Data as Provided by Users. This issue affects Competition Management System: before 23.07.Show less
CVE-2023-33293 1Kaiostech 1Kaios Jun 17, 2026 May 22, 2023 N/A· v4 5.3 MEDIUM· v3 N/A· v2 An issue was discovered in KaiOS 3.0 and 3.1. The binary /system/kaios/api-daemon exposes a local web server on .localhost with subdomains for each installed applications, e.g., myapp.localhost. An attacker can make fet...Show more An issue was discovered in KaiOS 3.0 and 3.1. The binary /system/kaios/api-daemon exposes a local web server on .localhost with subdomains for each installed applications, e.g., myapp.localhost. An attacker can make fetch requests to api-deamon to determine if a given app is installed and read the manifest.webmanifest contents, including the app version.Show less
CVE-2023-31103 1Apache 1Inlong Jun 17, 2026 May 22, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers can change the immutable name and type of cluster of I...Show more Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers can change the immutable name and type of cluster of InLong. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7891 https://github.com/apache/inlong/pull/7891 to solve it. Show less
CVE-2023-31206 1Apache 1Inlong Jun 17, 2026 May 22, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers can change the immutable name and type of nodes of InLo...Show more Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers can change the immutable name and type of nodes of InLong. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick [1] to solve it. [1] https://cveprocess.apache.org/cve5/[1]%C2%A0https://github.com/apache/inlong/pull/7891 https://github.com/apache/inlong/pull/7891 https://github.com/apache/inlong/pull/7891 Show less
CVE-2023-2025 1Johnsoncontrols 1Openblue Enterprise Manager Data Collector Jun 17, 2026 May 18, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 may expose sensitive information to an unauthorized user under certain circumstances.
CVE-2023-23448 1Sick 7Ftmg Esd15axx Firmware Ftmg Esd20axx FirmwareFtmg Esd25axx Firmware+4 more Jun 17, 2026 May 15, 2023 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Inclusion of Sensitive Information in Source Code in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote attacker to gain information about valid usern...Show more Inclusion of Sensitive Information in Source Code in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote attacker to gain information about valid usernames via analysis of source code.Show less
CVE-2023-29820 1Webroot 1Secureanywhere Jul 9, 2026 May 12, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to access sensitive information via the EXE installer. NOTE: the vendor's perspective is that this is no...Show more An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to access sensitive information via the EXE installer. NOTE: the vendor's perspective is that this is not a separate vulnerability relative to CVE-2023-29818 and CVE-2023-29819.Show less
CVE-2023-27564 1N8n 1N8n Jun 17, 2026 May 10, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 The n8n package 0.218.0 for Node.js allows Information Disclosure.
CVE-2022-40210 1Intel 1Data Center Manager Jun 17, 2026 May 10, 2023 N/A· v4 7.8 HIGH· v3 N/A· v2 Exposure of data element to wrong session in the Intel DCM software before version 5.0.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2022-38087 1Intel 467Core I3 1000g1 Firmware Core I3 1000g4 FirmwareCore I3 1005g1 Firmware+464 more Jun 17, 2026 May 10, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 Exposure of resource to wrong sphere in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
CVE-2023-2069 1Gitlab 1Gitlab Jun 17, 2026 May 3, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.10.7, all versions starting from 13.0 before 13.0.1. A user with the role of deve...Show more An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.10.7, all versions starting from 13.0 before 13.0.1. A user with the role of developer could use the import project feature to leak CI/CD variables.Show less
CVE-2023-0485 1Gitlab 1Gitlab Jun 17, 2026 May 3, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 An issue has been discovered in GitLab affecting all versions starting from 13.11 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible that a proj...Show more An issue has been discovered in GitLab affecting all versions starting from 13.11 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible that a project member demoted to a user role to read project updates by doing a diff with a pre-existing fork.Show less

Previous 1...131415...39 Next