Externally Controlled Reference to a Resource in Another Sphere
CWE-610
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
We track 90 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 8.4. 2 have been exploited in real attacks.
Latest Externally Controlled Reference to a Resource in Another Sphere vulnerabilities
- 8.0 High severity
Chrome: Externally Controlled Reference to a Resource in Another Sphere
Externally controlled reference in DevTools in Google Chrome prior to 154.0.8037.57 allowed an adjacent attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)
- 8.3 High severity
Application Integration: Externally Controlled Reference to a Resource in Another Sphere
A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attac
- 8.3 High severity
Chrome: Externally Controlled Reference to a Resource in Another Sphere
Externally controlled reference in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium sec
- 7.4 High severity
git: Exposure of Sensitive Information to an Unauthorized Actor
Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file() in bundle-uri.c during clone or
- 7.5 High severity
datamodel-code-generator: Improper Limitation of a Pathname to a Restricted Directory
datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodel_code_generator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:
- 7.5 High severity
datamodel-code-generator: Improper Limitation of a Pathname to a Restricted Directory
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.62.0, datamodel-code-generator resolves JSON Schema $ref targets in src
- 8.6 High severity
Grafana MCP Server: Externally Controlled Reference to a Resource in Another Sphere
A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary
- 7.5 High severity
ADC: Externally Controlled Reference to a Resource in Another Sphere
Arbitrary File Read (Unauthenticated) in NetScaler ADC and NetScaler Gateway if the access to NSIP, Cluster Management IP or SNIP with management access is enabled
- 8.8 High severity
Jenkins OWASP ZAP Plugin: Externally Controlled Reference to a Resource in Another Sphere
Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.
- 8.1 High severity
Apache Camel K: Externally Controlled Reference to a Resource in Another Sphere
(Externally Controlled Reference to a Resource in Another Sphere), (Authorization Bypass Through User-Controlled Key) vulnerability in Apache Camel K. Authorized users in a Kubernetes namespace can create a Build resource, controlling the Pod generation in a n
- 8.6 High severity
Terrascan: Server-Side Request Forgery
Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via external URL resolution in uploaded IaC templates when running in server mode. When Terrascan parses uploaded ARM templates or CloudFormation templates, it resolves external U
- 8.6 High severity
Terrascan: Server-Side Request Forgery
Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the remote_url parameter in the remote directory scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/remote/dir/scan) when running in server mode. An unauthenticated remote att
- 7.8 High severity
Zoom Workplace VDI Plugin: Externally Controlled Reference to a Resource in Another Sphere
External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to conduct an escalation of privilege via local access.
- 8.2 High severity
Microsoft Partner Center: Externally Controlled Reference to a Resource in Another Sphere
Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized attacker to perform spoofing over a network.
- 8.8 High severity
VertiGIS FM: Externally Controlled Reference to a Resource in Another Sphere
A local file inclusion vulnerability in the upload/download flow of the VertiGIS FM application allows authenticated attackers to read arbitrary files from the server by manipulating a file's path during its upload. When the file is subsequently downloaded, th
- 9.8 Critical severity
Zoom Workplace: Externally Controlled Reference to a Resource in Another Sphere
External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via network access.
- 7.3 High severity
Acronis Cyber Protect 17: Externally Controlled Reference to a Resource in Another Sphere
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.
- 7.3 High severity
Acronis Cyber Protect 17: Externally Controlled Reference to a Resource in Another Sphere
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.
- 7.8 High severity
Android: Externally Controlled Reference to a Resource in Another Sphere
In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploita
- 8.1 High severity
JeeSite: Improper Restriction of XML External Entity Reference
A flaw has been found in thinkgem JeeSite up to 5.15.1. Impacted is an unknown function of the file /com/jeesite/common/shiro/cas/CasOutHandler.java of the component Endpoint. Executing a manipulation can lead to xml external entity reference. The attack may b
- 7.1 High severity
langflow: Externally Controlled Reference to a Resource in Another Sphere
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, if an arbitrary path is specified in the request body's `fs_path`, the server serializes the Flow object into JSON and creates/overwrites a file at that path
- 9.8 Critical severity
OA: Improper Restriction of XML External Entity Reference
A security flaw has been discovered in Jinher OA up to 2.0. This affects an unknown function of the file /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx/?type=SystemUserInfo&style=1. Performing manipulation results in xml external entity reference. Remote explo
- 9.8 Critical severity
Zhiyou ERP: Improper Restriction of XML External Entity Reference
A vulnerability was identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this vulnerability is the function openForm of the component com.artery.richclient.RichClientService. Such manipulation of the argument contentString leads to xml external entity refer
- 9.8 Critical severity
OA: Improper Restriction of XML External Entity Reference
A vulnerability was determined in Jinher OA 2.0. The impacted element is an unknown function of the file /c6/Jhsoft.Web.module/ToolBar/ManageWord.aspx/?text=GetUrl&style=1. This manipulation causes xml external entity reference. The attack can be initiated rem
- 9.8 Critical severity
OA: Improper Restriction of XML External Entity Reference
A security flaw has been discovered in Jinher OA 2.0. This affects an unknown part of the file /c6/Jhsoft.Web.module/ToolBar/GetWordFileName.aspx/?text=GetUrl&style=add of the component XML Handler. Performing manipulation results in xml external entity refere
- 8.8 High severity
ThinManager: Server-Side Request Forgery
A server-side request forgery security issue exists within Rockwell Automation ThinManager® software due to the lack of input sanitization. Authenticated attackers can exploit this vulnerability by specifying external SMB paths, exposing the ThinServer® servic
- 9.8 Critical severity
OA: Improper Restriction of XML External Entity Reference
A vulnerability was found in Jinher OA up to 1.2. This impacts an unknown function of the file /c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx/?Type=add of the component XML Handler. The manipulation results in xml external entity reference. The attack ca
- 9.8 Critical severity
OA: Improper Restriction of XML External Entity Reference
A vulnerability has been found in Jinher OA up to 1.2. This affects an unknown function of the file /c6/Jhsoft.Web.projectmanage/ProjectManage/XmlHttp.aspx/?Type=add of the component XML Handler. The manipulation leads to xml external entity reference. Remote
- 7.3 High severity
Acronis Cyber Protect Cloud Agent: Externally Controlled Reference to a Resource in Another Sphere
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40296.
- 9.8 Critical severity
OA: Improper Restriction of XML External Entity Reference
A vulnerability was found in Jinher OA 1.1. It has been rated as problematic. This issue affects some unknown processing of the file XmlHttp.aspx. The manipulation leads to xml external entity reference. The attack may be initiated remotely. The exploit has be
- 9.8 Critical severity
OA: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability was found in Jinher OA 1.2. It has been declared as problematic. This vulnerability affects unknown code of the file ProjectScheduleDelete.aspx. The manipulation leads to xml external entity reference. The attack can be initiated remotely. The
- 9.8 Critical severity
OA: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability was found in Jinher OA 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx. The manipulation leads to xml external entity reference. The attack may be l
- 8.1 High severity
SureForms – Drag and Drop Form Builder for…: Externally Controlled Reference to a Resource in Another Sphere
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.7.3. This makes it poss
- 8.1 High severity
Feng Office: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability, which was classified as problematic, has been found in Fengoffice Feng Office 3.2.2.1. Affected by this issue is some unknown functionality of the file /application/models/ApplicationDataObject.class.php of the component Document Upload Handle
- 7.5 High severity
Modicon Controllers M241 / M251: Externally Controlled Reference to a Resource in Another Sphere
CWE-610: Externally Controlled Reference to a Resource in Another Sphere vulnerability exists that could cause a loss of confidentiality when an unauthenticated attacker manipulates controller’s webserver URL to access resources.
- 9.8 Critical severity
youkefu: Improper Restriction of XML External Entity Reference
A vulnerability, which was classified as problematic, was found in zhangyanbo2007 youkefu up to 4.2.0. This affects an unknown part of the file src/main/java/com/ukefu/webim/web/handler/admin/callcenter/CallCenterRouterController.java of the component XML Docu
- 7.5 High severity
ArcGIS Server: Externally Controlled Reference to a Resource in Another Sphere
There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files from the remote server.
- 6.5 Medium severity
Palo Alto Networks PAN-OS File Read Exploited
An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can grea
- 9.8 Critical severity
Nameless: Weak Password Recovery Mechanism for Forgotten Password
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. A user with admincp.core.emails or admincp.users.edit permissions can validate users and an attacker can reset their password. When the account is successfully approved by ema
- 9.4 Critical severity
DRYiCE MyXalytics: Server-Side Request Forgery
HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability. An attacker can deploy a web server that returns malicious content, and then induce the application to retrieve and process that content.