Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

CVEs (763)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-22568 1Dart 1Dart Software Development Kit Jun 17, 2026 Dec 9, 2021 N/A· v4 8.8 HIGH· v3 6.0 MEDIUM· v2 When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 access_token that is valid for publishing on pub.dev. Using these obtained c...Show more When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 access_token that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend upgrading past https://github.com/dart-lang/sdk/commit/d787e78d21e12ec1ef712d229940b1172aafcdf8 or beyond version 2.15.0Show less
CVE-2021-38505 1Mozilla 3Firefox Firefox EsrThunderbird Jun 17, 2026 Dec 8, 2021 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to the clipboard to the cloud, and make it available on other computers in certain scenarios. Applicati...Show more Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to the clipboard to the cloud, and make it available on other computers in certain scenarios. Applications that wish to prevent copied data from being recorded in Cloud History must use specific clipboard formats; and Firefox before versions 94 and ESR 91.3 did not implement them. This could have caused sensitive data to be recorded to a user's Microsoft account. This bug only affects Firefox for Windows 10+ with Cloud Clipboard enabled. Other operating systems are unaffected.. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.Show less
CVE-2021-25515 1Google 1Android Jun 17, 2026 Dec 8, 2021 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 An improper usage of implicit intent in SemRewardManager prior to SMR Dec-2021 Release 1 allows attackers to access BSSID.
CVE-2021-29115 1Esri 1Arcgis Enterprise Jun 17, 2026 Dec 7, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to view hidden field names in feature layers. This issue may reveal...Show more An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to view hidden field names in feature layers. This issue may reveal field names, but not not disclose features.Show less
CVE-2021-36198 1Johnsoncontrols 1Kantech Entrapass Jun 17, 2026 Dec 6, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Successful exploitation of this vulnerability could allow an unauthorized user to access sensitive data.
CVE-2021-23264 1Craftercms 1Crafter Cms Jun 17, 2026 Dec 2, 2021 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.
CVE-2021-23263 1Craftercms 1Crafter Cms Jun 17, 2026 Dec 2, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/, /templates/ and some of the files in /.git/* (non-binary).
CVE-2021-38004 2Debian Google 2Chrome Debian Linux Jun 17, 2026 Nov 23, 2021 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Insufficient policy enforcement in Autofill in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVE-2021-43560 2Fedoraproject Moodle 3Extra Packages For Enterprise Linux FedoraMoodle Jun 17, 2026 Nov 22, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.
CVE-2021-36319 1Dell 1Networking Os10 Jun 17, 2026 Nov 20, 2021 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 Dell Networking OS10 versions 10.4.3.x, 10.5.0.x and 10.5.1.x contain an information exposure vulnerability. A low privileged authenticated malicious user can gain access to SNMP authentication failure messages.
CVE-2021-42254 1Beyondtrust 1Privilege Management For Windows Jun 17, 2026 Nov 19, 2021 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 BeyondTrust Privilege Management prior to version 21.6 creates a Temporary File in a Directory with Insecure Permissions.
CVE-2021-26327 1Amd 20Epyc 7003 Firmware Epyc 72f3 FirmwareEpyc 7313 Firmware+17 more Jun 17, 2026 Nov 16, 2021 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 Insufficient validation of guest context in the SNP Firmware could lead to a potential loss of guest confidentiality.
CVE-2021-26312 1Amd 57Epyc 7232p Firmware Epyc 7251 FirmwareEpyc 7252 Firmware+54 more Jun 17, 2026 Nov 16, 2021 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory it should not be able to access, resulting in a potential loss of integrity.
CVE-2020-12488 1Vivo 1Jovi Smart Scene Jun 17, 2026 Nov 10, 2021 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 The attacker can access the sensitive information stored within the jovi Smart Scene module by entering carefully constructed commands without requesting permission.
CVE-2021-22047 1Vmware 1Spring Data Rest Jun 17, 2026 Oct 28, 2021 N/A· v4 5.3 MEDIUM· v3 4.3 MEDIUM· v2 In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping ar...Show more In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for unauthorized access depending on the Spring Security configuration.Show less
CVE-2021-22044 1Vmware 1Spring Cloud Openfeign Jun 17, 2026 Oct 28, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older unsupported versions, applications using type-level `@RequestMapping`annotations over Feign client interfaces, can be involuntarily expo...Show more In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older unsupported versions, applications using type-level `@RequestMapping`annotations over Feign client interfaces, can be involuntarily exposing endpoints corresponding to `@RequestMapping`-annotated interface methods.Show less
CVE-2021-22468 1Huawei 1Harmonyos Jun 17, 2026 Oct 28, 2021 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 A component of the HarmonyOS has a Exposure of Sensitive Information to an Unauthorized Actor vulnerability. Local attackers may exploit this vulnerability to cause kernel address leakage.
CVE-2021-22454 1Huawei 1Harmonyos Jun 17, 2026 Oct 28, 2021 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 A component of the HarmonyOS has a External Control of System or Configuration Setting vulnerability. Local attackers may exploit this vulnerability to cause core dump.
CVE-2021-34761 1Cisco 4Firepower Management Center Virtual Appliance Firepower Threat DefenseSecure Firewall Threat Defense+1 more Aug 11, 2026 Oct 27, 2021 N/A· v4 6.0 MEDIUM· v3 6.6 MEDIUM· v2 A vulnerability in Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to overwrite or append arbitrary data to system files using root-level privileges. The attacker must have admi...Show more A vulnerability in Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to overwrite or append arbitrary data to system files using root-level privileges. The attacker must have administrative credentials on the device. This vulnerability is due to incomplete validation of user input for a specific CLI command. An attacker could exploit this vulnerability by authenticating to the device with administrative privileges and issuing a CLI command with crafted user parameters. A successful exploit could allow the attacker to overwrite or append arbitrary data to system files using root-level privileges.Show less
CVE-2021-42536 1Emerson 3Wireless 1410 Gateway Firmware Wireless 1410d Gateway FirmwareWireless 1420 Gateway Firmware Jun 17, 2026 Oct 22, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 The affected product is vulnerable to a disclosure of peer username and password by allowing all users access to read global variables.

Previous 1...252627...39 Next