CWE-668 · Access Control
Exposure of Resource to Wrong Sphere
500CVEs
0exploited
7with a public check
8likely (EPSS 10%+)
SortMost likely exploited
500 CVEs with CWE-668 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-37645CheckEyouCms v1.6.3 - Information DisclosureEyoucms · Eyoucms · 2023-07-20 | – | 25% | 2023-07-20 |
| CVE-2022-34047CheckWAVLINK WN530HG4 - Improper Access ControlWavlink · Wl-Wn530hg4 Firmware · 2022-07-20 | – | 22% | 2022-07-20 |
| CVE-2018-6910CheckDedeCMS 5.7 - Path DisclosureDedecms · Dedecms · 2018-02-13 | – | 19% | 2018-02-13 |
| CVE-2022-31845CheckWAVLINK WN535 G3 - Information DisclosureWavlink · Wn535g3 Firmware · 2022-06-14 | – | 8.7% | 2022-06-14 |
| CVE-2022-31846CheckWAVLINK WN535 G3 - Information DisclosureWavlink · Wn535g3 Firmware · 2022-06-14 | – | 7.4% | 2022-06-14 |
| CVE-2020-27361CheckAkkadian Provisioning Manager 4.50.02 - Sensitive Information DisclosureAkkadianlabs · Akkadian Provisioning Manager · 2021-07-01 | – | 6.8% | 2021-07-01 |
| CVE-2023-37599CheckIssabel PBX 4.0.0-6 - Directory ListingIssabel · Pbx · 2023-07-13 | – | 3.6% | 2023-07-13 |
| CVE-2017-0215Microsoft Windows 10 1607 and Windows Server 2016 allow an attacker to exploit a security feature bypass vulnerability in Device Guard that could allow the attacker to inject mali…Microsoft Corporation · Microsoft Windows · 2017-06-15 | – | 40% | 2017-06-15 |
| CVE-2022-25236xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.Libexpat Project · Libexpat · CVSS 9.8 · 2022-02-16 | 9.8 | 35% | 2022-02-16 |
| CVE-2018-7846A CWE-501: Trust Boundary Violation vulnerability on connection to the Controller exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium whi…Schneider-Electric · Modicon M580 Modicon M340 Modicon Quantum Modicon Premium · 2019-05-22 | – | 30% | 2019-05-22 |
| CVE-2011-1960Microsoft Internet Explorer 6 through 9 does not properly implement JavaScript event handlers, which allows remote attackers to access content from a different (1) domain or (2) z…Microsoft · Internet Explorer · 2011-08-10 | – | 18% | 2011-08-10 |
| CVE-2024-38368Trunk's 'Claim your pod' could be used to obtain un-used podsCocoaPods · CocoaPods · CVSS 9.3 · 2024-07-01 | 9.3 | 15% | 2024-07-01 |
| CVE-2011-1258Microsoft Internet Explorer 6 through 8 does not properly restrict web script, which allows user-assisted remote attackers to obtain sensitive information from a different (1) dom…Microsoft · Internet Explorer · 2011-06-16 | – | 15% | 2011-06-16 |
| CVE-2017-5648While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7…Apache Software Foundation · Apache Tomcat · 2017-04-17 | – | 13% | 2017-04-17 |
| CVE-2021-46354Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. The ability…Cybelesoft · Thinfinity Virtualui · 2022-02-09 | – | 13% | 2022-02-09 |
| CVE-2020-8449An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to access server resources prohibited by…Squid-Cache · Squid · 2020-02-04 | – | 8.3% | 2020-02-04 |
| CVE-2020-19155Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information and/or execute arbitrary code via the 'FileManager.rename()' funct…Jflyfox · Jfinal Cms · 2021-09-15 | – | 7.5% | 2021-09-15 |
| CVE-2018-8040Pages that are rendered using the ESI plugin can have access to the cookie header when the plugin is configured not to allow access. This affects Apache Traffic Server (ATS) versi…Apache Software Foundation · Apache Traffic Server · 2018-08-29 | – | 7.2% | 2018-08-29 |
| CVE-2021-43893Windows Encrypting File System (EFS) Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 7.5 · 2021-12-15 | 7.5 | 6.7% | 2021-12-15 |
| CVE-2012-5639LibreOffice and OpenOffice automatically open embedded contentLibreOffice; OpenOffice · LibreOffice, OpenOffice · 2019-12-20 | – | 5.8% | 2019-12-20 |
| CVE-2020-10238An issue was discovered in Joomla! before 3.9.16. Various actions in com_templates lack the required ACL checks, leading to various potential attack vectors.Joomla · Joomla! · 2020-03-16 | – | 4.9% | 2020-03-16 |
| CVE-2019-9186In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute code when the configuration is running, b…Jetbrains · Intellij Idea · 2019-07-03 | – | 4.5% | 2019-07-03 |
| CVE-2024-40725Apache HTTP Server: source code disclosure with handlers configured via AddTypeApache Software Foundation · Apache HTTP Server · CVSS 5.3 · 2024-07-18 | 5.3 | 4.4% | 2024-07-18 |
| CVE-2017-16660Cacti 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Path under the web root, and then making a remote_agent.php req…Cacti · Cacti · 2017-11-08 | – | 4.2% | 2017-11-08 |
| CVE-2020-15816In Western Digital WD Discovery before 4.0.251.0, a malicious application running with standard user permissions could potentially execute code in the application's process throug…Westerndigital · Wd Discovery · 2020-07-17 | – | 4.1% | 2020-07-17 |
| CVE-2012-1846Google Chrome 17.0.963.66 and earlier allows remote attackers to bypass the sandbox protection mechanism by leveraging access to a sandboxed process, as demonstrated by VUPEN duri…Google · Chrome · 2012-03-22 | – | 4.1% | 2012-03-22 |
| CVE-2021-43216Microsoft Local Security Authority (LSA) Server Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 6.5 · 2021-12-15 | 6.5 | 3.4% | 2021-12-15 |
| CVE-2018-18068The ARM-based hardware debugging feature on Raspberry Pi 3 module B+ and possibly other devices allows non-secure EL1 code to read/write any EL3 (the highest privilege level in AR…Raspberrypi · Raspberry Pi 3 Model B+ Firmware · 2019-04-04 | – | 3.3% | 2019-04-04 |
| CVE-2019-19015An issue was discovered in TitanHQ WebTitan before 5.18. The proxy service (which is typically exposed to all users) allows connections to the internal PostgreSQL database of the…Titanhq · Webtitan · 2019-12-02 | – | 3.3% | 2019-12-02 |
| CVE-2018-7072A remote bypass of security restrictions vulnerability was identified in HPE Moonshot Provisioning Manager prior to v1.24.Hewlett Packard Enterprise · HPE Moonshot Provisioning Manager · 2018-08-06 | – | 3.1% | 2018-08-06 |
| CVE-2020-13946In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access to the Apache Cassandra process or conf…Apache · Apache Cassandra · 2020-09-01 | – | 3.0% | 2020-09-01 |
| CVE-2019-13379On AVTECH Room Alert 3E devices before 2.2.5, an attacker with access to the device's web interface may escalate privileges from an unauthenticated user to administrator by perfor…Avtech · Room Alert 3e Firmware · 2019-07-07 | – | 2.9% | 2019-07-07 |
| CVE-2022-24975The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security risk if information…Git-Scm · Git · 2022-02-11 | – | 2.6% | 2022-02-11 |
| CVE-2001-0893Acme mini_httpd before 1.16 allows remote attackers to view sensitive files under the document root (such as .htpasswd) via a GET request with a trailing /.Acme · Mini Httpd · 2002-02-02 | – | 2.5% | 2002-02-02 |
| CVE-2017-11382Denial of Service vulnerability in Trend Micro Deep Discovery Email Inspector 2.5.1 allows remote attackers to delete arbitrary files on vulnerable installations, thus disabling t…Trend Micro · Trend Micro Deep Discovery Email Inspector · 2017-08-03 | – | 2.5% | 2017-08-03 |
| CVE-2025-34119EasyCafe Server 2.2.14 Remote File Disclosure via Opcode 0x43Tinasoft · EasyCafe Server · CVSS 8.8 · 2025-07-16 | 8.8 | 2.4% | 2025-07-16 |
| CVE-2019-20149ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbo…Kind-Of Project · Kind-Of · 2019-12-30 | – | 2.3% | 2019-12-30 |
| CVE-2019-20853An issue was discovered in Mattermost Packages before 5.16.3. A Droplet could allow Internet access to a service that has a remote code execution problem.Mattermost · Mattermost Packages · 2020-06-19 | – | 2.2% | 2020-06-19 |
| CVE-2021-27236An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. getfile.asp allows Unauthenticated Local File Inclusion, which can be leveraged to achieve Remote Code Execution.Mutare · Voice · 2021-02-16 | – | 2.2% | 2021-02-16 |
| CVE-2020-10867An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to bypass intended acces…Avast · Antivirus · 2020-04-01 | – | 2.2% | 2020-04-01 |
| CVE-2019-12904In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C impleme…Gnupg · Libgcrypt · 2019-06-19 | – | 2.2% | 2019-06-19 |
| CVE-2017-12576An issue was discovered on the PLANEX CS-QR20 1.30. A hidden and undocumented management page allows an attacker to execute arbitrary code on the device when the user is authentic…Planex · Cs-Qr20 Firmware · 2018-08-24 | – | 2.2% | 2018-08-24 |
| CVE-2020-25073FreedomBox through 20.13 allows remote attackers to obtain sensitive information from the /server-status page of the Apache HTTP Server, because a connection from the Tor onion se…Debian · Freedombox · 2020-09-02 | – | 2.1% | 2020-09-02 |
| CVE-2018-1840IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to gain elevated privileges on the system, caused when a security domain is configured to use a federate…IBM · WebSphere Application Server · CVSS 6 · 2018-12-03 | 6.0 | 2.1% | 2018-12-03 |
| CVE-2016-5334VMware Identity Manager 2.x before 2.7.1 and vRealize Automation 7.x before 7.2.0 allow remote attackers to read /SAAS/WEB-INF and /SAAS/META-INF files via unspecified vectors.Vmware · Identity Manager · 2016-12-29 | – | 2.1% | 2016-12-29 |
| CVE-2022-25643seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The attack vector is a user-supplied socket pathname.Seatd Project · Seatd · 2022-02-22 | – | 2.1% | 2022-02-22 |
| CVE-2013-4480Red Hat Satellite 5.6 and earlier does not disable the web interface that is used to create the first user for a satellite, which allows remote attackers to create administrator a…Redhat · Satellite · 2013-11-15 | – | 2.1% | 2013-11-15 |
| CVE-2016-10840cPanel before 11.54.0.4 allows arbitrary code execution during locale duplication (SEC-72).Cpanel · Cpanel · 2019-08-01 | – | 2.1% | 2019-08-01 |
| CVE-2021-42641PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticated attacker to discl…Printerlogic · Web Stack · 2022-02-02 | – | 2.0% | 2022-02-02 |
| CVE-2021-42640PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticated attacker to reass…Printerlogic · Web Stack · 2022-02-02 | – | 2.0% | 2022-02-02 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.