Improper Control of Resource Identifiers
CWE-99
The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended control sphere.
We track 21 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.5.
Latest Improper Control of Resource Identifiers vulnerabilities
- 8.1 High severity
Apache OFBiz: Improper Control of Resource Identifiers
Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz. An authenticate user with access to sfa component can override the service to use on vcard import and access to other service. This issue affects Apache OFBiz: befor
- 8.5 High severity
Webmail: Improper Control of Resource Identifiers
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image data URI without validating it, so a remote authenticated attac
- 8.5 High severity
Guardicore Platform Agent: Improper Control of Resource Identifiers
Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the
- 7.5 High severity
moquette: Improper Control of Resource Identifiers
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue_ plus the client ID and its metadata-map name as queue_ plus the client ID plus _meta. A durable session whose client ID ends in _meta
- 8.8 High severity
Microsoft Exchange Server 2016 Cumulative…: Improper Control of Resource Identifiers
Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
- 7.3 High severity
AgentChat: Improper Control of Resource Identifiers
A flaw has been found in Shy2593666979 AgentChat up to 2.3.0. This issue affects the function get_user_info/update_user_info of the file /src/backend/agentchat/api/v1/user.py of the component User Endpoint. This manipulation of the argument user_id causes impr
- 7.5 High severity
LearnHouse: Authorization Bypass Through User-Controlled Key
A vulnerability was determined in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. The impacted element is an unknown function of the file /api/v1/assignments/{assignment_id}/tasks/{task_id}/sub_file of the component Student Assignment Submission Han
- 9.8 Critical severity
Poly Lens: Improper Control of Resource Identifiers
A vulnerability in the Poly Lens Desktop application running on the Windows platform might allow modifications to the filesystem, which might lead to SYSTEM level privileges being granted.
- 9.1 Critical severity
ASPECT-Enterprise: Improper Control of Resource Identifiers
Port manipulation vulnerabilities in ASPECT provide attackers with the ability to con-trol TCP/IP port access if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX
- 9.1 Critical severity
Pentaho Data Integration & Analytics: Improper Control of Resource Identifiers
Overview The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. (CWE-99) Description Hitachi Vanta
- 7.5 High severity
ModernaNet: Improper Control of Resource Identifiers
A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been declared as critical. This vulnerability affects unknown code of the file /AGE0000700/GetImageMedico?fooId=1. The manipulation of the argument fooId leads to improper control of resource i
- 8.8 High severity
Pentaho Data Integration & Analytics: Improper Control of Resource Identifiers
The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. (CWE-99) Hitachi Vantara Pentaho Data Integ
- 9.1 Critical severity
KNOWAGE: Improper Control of Resource Identifiers
DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that java:comp/env/jdbc/ occurs at the beginning of a JNDI Name.
- 7.2 High severity
Ffmpeg: Improper Control of Resource Identifiers
A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs.
- 8.8 High severity
Online Laundry Management System: Authorization Bypass Through User-Controlled Key
A vulnerability has been found in Campcodes Online Laundry Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file manage_user.php of the component HTTP Request Parameter Handler. The manipulation of the argument i
- 8.8 High severity
Doctor Appointment Management System: Authorization Bypass Through User-Controlled Key
A vulnerability, which was classified as critical, has been found in PHPGurukul Doctor Appointment Management System 1.0. Affected by this issue is some unknown functionality of the file /doctor/view-appointment-detail.php. The manipulation of the argument edi
- 8.8 High severity
Pentaho Data Integration & Analytics: Improper Control of Resource Identifiers
Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including 8.3.x does not restrict JNDI identifiers during the creation of XActions, allowing control of system level data sources.
- 8.8 High severity
Pydio Cells: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical was found in Abstrium Pydio Cells 4.2.0. This vulnerability affects unknown code of the component User Creation Handler. The manipulation leads to improper control of resource identifiers. The attack can be initiated remo
- 8.0 High severity
phpCAS: Improper Control of Resource Identifiers
phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service (CAS) server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker
- 9.1 Critical severity
Train Scheduler App: Improper Control of Resource Identifiers
A vulnerability was found in SourceCodester Train Scheduler App 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /train_scheduler_app/?action=delete. The manipulation of the argument id leads to improper control
- 9.8 Critical severity
School Club Application System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical was found in School Club Application System 1.0. This vulnerability affects a request to the file /scas/classes/Users.php?f=save_user. The manipulation with a POST request leads to privilege escalation. The attack can be