← Back
CWE-668

763 CVEs • Abstraction: Class

Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

JSON object

Loading...

CVEs (763)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-39628
1Google
1Android
Jun 17, 2026
Jan 14, 2022
N/A· v4
3.3 LOW· v3
2.1 LOW· v2
In StatusBar.java, there is a possible disclosure of notification content on the lockscreen due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed...Show more
In StatusBar.java, there is a possible disclosure of notification content on the lockscreen due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-189575031Show less
CVE-2022-23118
1Jenkins
1Debian Package Builder
Jun 17, 2026
Jan 12, 2022
N/A· v4
8.8 HIGH· v3
9.0 HIGH· v2
Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agents to invoke command-line `git` at an attacker-specified path on the controller, allowing attackers able to control agent...Show more
Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agents to invoke command-line `git` at an attacker-specified path on the controller, allowing attackers able to control agent processes to invoke arbitrary OS commands on the controller.Show less
CVE-2022-21964
1Microsoft
1Windows 10
Jun 17, 2026
Jan 11, 2022
N/A· v4
5.5 MEDIUM· v3
4.9 MEDIUM· v2
Remote Desktop Licensing Diagnoser Information Disclosure Vulnerability
CVE-2021-42749
1Fastlinemedia
1Beaver Themer
Jun 17, 2026
Jan 10, 2022
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
In Beaver Themer, attackers can bypass conditional logic controls (for hiding content) when viewing the post archives. Exploitation requires that a Themer layout is applied to the archives, and that the post excerpt fiel...Show more
In Beaver Themer, attackers can bypass conditional logic controls (for hiding content) when viewing the post archives. Exploitation requires that a Themer layout is applied to the archives, and that the post excerpt field is not set.Show less
CVE-2021-39971
1Huawei
1Harmonyos
Jun 17, 2026
Jan 3, 2022
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Password vault has a External Control of System or Configuration Setting vulnerability.Successful exploitation of this vulnerability could compromise confidentiality.
CVE-2021-37112
1Huawei
1Harmonyos
Jun 17, 2026
Jan 3, 2022
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
Hisuite module has a External Control of System or Configuration Setting vulnerability.Successful exploitation of this vulnerability may lead to Firmware leak.
CVE-2021-1918
1Qualcomm
30Qca6391 Firmware
Qcm6490 FirmwareQcs6490 Firmware+27 more
Jun 17, 2026
Jan 3, 2022
N/A· v4
6.5 MEDIUM· v3
2.1 LOW· v2
Improper handling of resource allocation in virtual machines can lead to information exposure in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
CVE-2020-20948
1Jeecg
1Jeecg
Jun 17, 2026
Dec 27, 2021
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
An arbitrary file download vulnerability in jeecg v3.8 allows attackers to access sensitive files via modification of the "localPath" variable.
CVE-2021-45708
1Abomonation Project
1Abomonation
Jun 17, 2026
Dec 27, 2021
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
An issue was discovered in the abomonation crate through 2021-10-17 for Rust. Because transmute operations are insufficiently constrained, there can be an information leak or ASLR bypass.
CVE-2019-8702
1Apple
3Iphone Os
Mac Os XTvos
Jun 17, 2026
Dec 23, 2021
N/A· v4
5.5 MEDIUM· v3
2.1 LOW· v2
This issue was addressed with a new entitlement. This issue is fixed in macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra, iOS 12.4, tvOS 12.4. A local user may be able to read a...Show more
This issue was addressed with a new entitlement. This issue is fixed in macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra, iOS 12.4, tvOS 12.4. A local user may be able to read a persistent account identifier.Show less
CVE-2021-21878
1Lantronix
1Premierwave 2050 Firmware
Jun 17, 2026
Dec 22, 2021
N/A· v4
4.9 MEDIUM· v3
6.8 MEDIUM· v2
A local file inclusion vulnerability exists in the Web Manager Applications and FsBrowse functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted series of HTTP requests can lead to local file inclusion...Show more
A local file inclusion vulnerability exists in the Web Manager Applications and FsBrowse functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted series of HTTP requests can lead to local file inclusion. An attacker can make a series of authenticated HTTP requests to trigger this vulnerability.Show less
CVE-2020-35215
1Atomix
1Atomix
Jun 17, 2026
Dec 16, 2021
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
An issue in Atomix v3.1.5 allows attackers to access sensitive information when a malicious Atomix node queries distributed variable primitives which contain the entire primitive lists that ONOS nodes use to share import...Show more
An issue in Atomix v3.1.5 allows attackers to access sensitive information when a malicious Atomix node queries distributed variable primitives which contain the entire primitive lists that ONOS nodes use to share important states.Show less
CVE-2021-43893
1Microsoft
10Windows 10
Windows 11Windows 7+7 more
Jun 17, 2026
Dec 15, 2021
N/A· v4
7.5 HIGH· v3
6.0 MEDIUM· v2
Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability
CVE-2021-43216
1Microsoft
10Windows 10
Windows 11Windows 7+7 more
Jun 17, 2026
Dec 15, 2021
N/A· v4
6.5 MEDIUM· v3
6.8 MEDIUM· v2
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
CVE-2021-41065
1Bopsoft
1Listary
Jun 17, 2026
Dec 14, 2021
N/A· v4
7.3 HIGH· v3
4.4 MEDIUM· v2
An issue was discovered in Listary through 6. An attacker can create a \\.\pipe\Listary.listaryService named pipe and wait for a privileged user to open a session on the Listary installed host. Listary will automatically...Show more
An issue was discovered in Listary through 6. An attacker can create a \\.\pipe\Listary.listaryService named pipe and wait for a privileged user to open a session on the Listary installed host. Listary will automatically access the named pipe and the attacker will be able to duplicate the victim's token to impersonate him. This exploit is valid in certain Windows versions (Microsoft has patched the issue in later Windows 10 builds).Show less
CVE-2021-44524
1Siemens
2Sipass Integrated
Siveillance Identity
Jun 17, 2026
Dec 14, 2021
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All versions), Siveillance Identit...Show more
A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All versions), Siveillance Identity V1.6 (All versions < V1.6.284.0). Affected applications insufficiently limit the access to the internal user authentication service. This could allow an unauthenticated remote attacker to trigger several actions on behalf of valid user accounts.Show less
CVE-2021-44523
1Siemens
2Sipass Integrated
Siveillance Identity
Jun 17, 2026
Dec 14, 2021
N/A· v4
9.1 CRITICAL· v3
6.4 MEDIUM· v2
A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All versions), Siveillance Identit...Show more
A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All versions), Siveillance Identity V1.6 (All versions < V1.6.284.0). Affected applications insufficiently limit the access to the internal activity feed database. This could allow an unauthenticated remote attacker to read, modify or delete activity feed entries.Show less
CVE-2021-44522
1Siemens
2Sipass Integrated
Siveillance Identity
Jun 17, 2026
Dec 14, 2021
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All versions), Siveillance Identit...Show more
A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All versions), Siveillance Identity V1.6 (All versions < V1.6.284.0). Affected applications insufficiently limit the access to the internal message broker system. This could allow an unauthenticated remote attacker to subscribe to arbitrary message queues.Show less
CVE-2021-39915
1Gitlab
1Gitlab
Jun 17, 2026
Dec 13, 2021
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an...Show more
Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to see the names of project access tokens on arbitrary projectsShow less
CVE-2021-38931
2Ibm
Netapp
2Db2
Oncommand Insight
Jun 17, 2026
Dec 9, 2021
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1, and 11.5 is vulnerable to an information disclosure as a result of a connected user having indirect read access to a table where they are not author...Show more
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1, and 11.5 is vulnerable to an information disclosure as a result of a connected user having indirect read access to a table where they are not authorized to select from. IBM X-Force ID: 210418.Show less