Externally Controlled Reference to a Resource in Another Sphere
CWE-610
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
We track 90 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 8.4. 2 have been exploited in real attacks.
Latest Externally Controlled Reference to a Resource in Another Sphere vulnerabilities
- 7.8 High severity
Acronis Cyber Protect Home Office: Improper Link Resolution Before File Access
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
- 9.9 Critical severity
onedev: Externally Controlled Reference to a Resource in Another Sphere
Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. When using Docker-based job executors, the Docker socket (e.g. /var/run/docker.sock on Linux) is mounted into each Docker step. Users that can define and trigger CI/CD jobs on a project co
- 9.1 Critical severity
QNAP Photo Station Externally Controlled Reference Exploited
An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS
- 8.2 High severity
All-in-One Video Gallery: Externally Controlled Reference to a Resource in Another Sphere
The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the ~/public/video.php file in versions up to, and including 2.6.0. This makes it possible for una
- 8.8 High severity
Download Manager: Externally Controlled Reference to a Resource in Another Sphere
The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to insufficient file type and path validation on the deleteFiles() function found in the ~/Admin/Menu/Packages.php file that
- 7.8 High severity
Android: Externally Controlled Reference to a Resource in Another Sphere
In DreamServices, there is a possible way to launch arbitrary protected activities due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: Androi
- 9.8 Critical severity
Android: Externally Controlled Reference to a Resource in Another Sphere
remap_pfn_range' here may map out of size kernel memory (for example, may map the kernel area), and because the 'vma->vm_page_prot' can also be controlled by userspace, so userspace may map the kernel area to be writable, which is easy to be exploitedProduct:
- 7.8 High severity
Android: Externally Controlled Reference to a Resource in Another Sphere
In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. Use
- 7.5 High severity
Aceweb Online Portal: Externally Controlled Reference to a Resource in Another Sphere
ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp.
- 8.8 High severity
metabase: Externally Controlled Reference to a Resource in Another Sphere
Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called `ATTACH DATABASE`, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least o