Externally Controlled Reference to a Resource in Another Sphere
CWE-610
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
We track 90 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 8.4. 2 have been exploited in real attacks.
Latest Externally Controlled Reference to a Resource in Another Sphere vulnerabilities
- 8.8 High severity
PostgreSQL: Externally Controlled Reference to a Resource in Another Sphere
Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database s
- 9.1 Critical severity
gaizhenbiao/chuanhuchatgpt: Externally Controlled Reference to a Resource in Another Sphere
A file overwrite vulnerability exists in gaizhenbiao/chuanhuchatgpt versions <= 20240410. This vulnerability allows an attacker to gain unauthorized access to overwrite critical configuration files within the system. Exploiting this vulnerability can lead to u
- 8.2 High severity
discourse: Externally Controlled Reference to a Resource in Another Sphere
Discourse is an open source platform for community discussion. An attacker can make several XHR requests until the cache is poisoned with a response without any preloaded data. This issue only affects anonymous visitors of the site. This problem has been patch
- 8.8 High severity
ThinManager: Externally Controlled Reference to a Resource in Another Sphere
CVE-2024-45826 IMPACT Due to improper input validation, a path traversal and remote code execution vulnerability exists when the ThinManager® processes a crafted POST request. If exploited, a user can install an executable file.
- 9.8 Critical severity
Simple Online Bidding System: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as critical. This affects an unknown part of the file /simple-online-bidding-system/bidding/index.php. The manipulation of the argument page leads to file incl
- 7.5 High severity
Dell Update (DU): Externally Controlled Reference to a Resource in Another Sphere
Dell Command | Update, Dell Update, and Alienware Update UWP, versions prior to 5.4, contain an Exposed Dangerous Method or Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial o
- 7.3 High severity
snapd: Improper Link Resolution Before File Access
In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the sn
- 8.6 High severity
Nomad: Externally Controlled Reference to a Resource in Another Sphere
HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to path escaping of the allocation directory. This vulnerability, CVE-2024-6717, is fixed in Nomad 1.6.13, 1.7.10, and 1.8.2.
- 7.8 High severity
Android: Externally Controlled Reference to a Resource in Another Sphere
In updateNotificationChannelFromPrivilegedListener of NotificationManagerService.java, there is a possible cross-user data leak due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User inte
- 8.1 High severity
Checkmk: Externally Controlled Reference to a Resource in Another Sphere
Improper restriction of local upload and download paths in check_sftp in Checkmk before 2.3.0p4, 2.2.0p27, 2.1.0p44, and in Checkmk 2.0.0 (EOL) allows attackers with sufficient permissions to configure the check to read and write local files on the Checkmk sit
- 9.1 Critical severity
spin: Externally Controlled Reference to a Resource in Another Sphere
Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to make requests to arb
- 7.8 High severity
Total Security: Externally Controlled Reference to a Resource in Another Sphere
A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender Antivirus Free allows an attacker to change the product's expected behavior and potentially load a thir
- 9.8 Critical severity
php-svg-lib: Externally Controlled Reference to a Resource in Another Sphere
php-svg-lib is a scalable vector graphics (SVG) file parsing/rendering library. Prior to version 0.5.2, php-svg-lib fails to validate that font-family doesn't contain a PHAR url, which might leads to RCE on PHP < 8.0, and doesn't validate if external reference
- 7.8 High severity
micronaut-core: External Control of System or Configuration Setting
Micronaut Framework is a modern, JVM-based, full stack Java framework designed for building modular, easily testable JVM applications with support for Java, Kotlin and the Groovy language. Enabled but unsecured management endpoints are susceptible to drive-by
- 7.5 High severity
Nomad: Externally Controlled Reference to a Resource in Another Sphere
HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. This vulnerability, CVE-2024-1329, is fixed in Nomad 1.7.4, 1.6.7, and 1.5.
- 7.3 High severity
mailcow-dockerized: Externally Controlled Reference to a Resource in Another Sphere
mailcow is a dockerized email package, with multiple containers linked in one bridged network. A security vulnerability has been identified in mailcow affecting versions < 2024-01c. This vulnerability potentially allows attackers on the same subnet to connect
- 9.8 Critical severity
CMS: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability classified as problematic was found in ForU CMS up to 2020-06-23. Affected by this vulnerability is an unknown functionality of the file channel.php. The manipulation of the argument c_cmodel leads to file inclusion. The attack can be launched
- 8.8 High severity
Simple Student Attendance System: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument page leads to file inclusi
- 7.8 High severity
GX Works3: Externally Controlled Reference to a Resource in Another Sphere
Malicious Code Execution Vulnerability due to External Control of File Name or Path in multiple Mitsubishi Electric FA Engineering Software Products allows a malicious attacker to execute a malicious code by having legitimate users open a specially crafted pro
- 8.8 High severity
Foxit Reader: Externally Controlled Reference to a Resource in Another Sphere
An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to mistreatment of whitespace characters. A specially crafted malicious file can create files at arbitrary locations, which can lead to arbi
- 8.8 High severity
Foxit Reader: Externally Controlled Reference to a Resource in Another Sphere
A code execution vulnerability exists in the Javascript saveAs API of Foxit Reader 12.1.3.15356. A specially crafted malformed file can create arbitrary files, which can lead to remote code execution. An attacker needs to trick the user into opening the malici
- 8.8 High severity
Foxit Reader: Externally Controlled Reference to a Resource in Another Sphere
An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to a failure to properly validate a dangerous extension. A specially crafted malicious file can create files at arbitrary locations, which c
- 7.1 High severity
SystemPlatform: Externally Controlled Reference to a Resource in Another Sphere
This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System privilege on the machine where these products are installed, resulting in denial of service.
- 7.8 High severity
Acronis Cyber Protect Cloud Agent: Externally Controlled Reference to a Resource in Another Sphere
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 29051, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
- 8.1 High severity
OAS Platform: Externally Controlled Reference to a Resource in Another Sphere
A file write vulnerability exists in the OAS Engine configuration functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to arbitrary file creation or overwrite. An attacker can send a sequen
- 7.8 High severity
Acronis Cyber Protect Home Office: Improper Link Resolution Before File Access
Local privilege escalation during installation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40278, Acronis True Image OEM (Windows) before build 42575.
- 7.8 High severity
Acronis Cyber Protect Home Office: Externally Controlled Reference to a Resource in Another Sphere
Local privilege escalation during recovery due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40173.
- 7.5 High severity
Linux Kernel: Externally Controlled Reference to a Resource in Another Sphere
The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update, b
- 7.8 High severity
Android: Externally Controlled Reference to a Resource in Another Sphere
In toUriInner of Intent.java, there is a possible way to launch an arbitrary activity due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Pro
- 9.8 Critical severity
Student Study Center Desk Management System: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability has been found in SourceCodester Student Study Center Desk Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument page leads to file i
- 7.8 High severity
Insydeh2o: Externally Controlled Reference to a Resource in Another Sphere
An issue was discovered in Insyde InsydeH2O with kernel 5.2 through 5.5. The Save State register is not checked before use. The IhisiSmm driver does not check the value of a save state register before use. Due to insufficient input validation, an attacker can
- 7.8 High severity
Android: Externally Controlled Reference to a Resource in Another Sphere
In multiple functions of MediaSessionRecord.java, there is a possible Intent rebroadcast due to a confused deputy. This could lead to local denial of service or escalation of privilege with no additional execution privileges needed. User interaction is not nee
- 7.5 High severity
Automation License Manager V5: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 Upd4), TeleControl Server Basic V3 (All versions < V3.1.2). The affected components allow to rename license files with u
- 7.8 High severity
vGPU software (guest driver) - Windows, NVIDIA…: Externally Controlled Reference to a Resource in Another Sphere
NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can access or modify system files or other files that are critical to the application, which may lead to code execution, denial of service
- 7.8 High severity
Android: Externally Controlled Reference to a Resource in Another Sphere
In Multiple Locations, there is a possibility to launch arbitrary protected activities due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: An
- 7.5 High severity
syngo Dynamics: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow to write data in any folder accessible to the accoun
- 7.5 High severity
syngo Dynamics: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow to write data in any folder accessible to the accoun
- 7.5 High severity
syngo Dynamics: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow to write data in any folder accessible to the accoun
- 7.5 High severity
syngo Dynamics: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper read access control that could allow files to be retrieved from any folder accessible to t
- 7.5 High severity
syngo Dynamics: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper read access control that could allow files to be retrieved from any folder accessible to t