CWE-668

MantisBT is an open source bug tracker. Due to insufficient access-level checks on the Wiki redirection page, any user c

Archer Platform 6.x before 6.13 P2 HF2 (6.13.0.2.2) contains a sensitive information disclosure vulnerability. An authen

Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with lim

NVIDIA GeForce Now for Android contains a vulnerability in the game launcher component, where a malicious application on

Exposure of resource to wrong sphere in BIOS firmware for some Intel(R) Processors may allow a privileged user to potent

Improper access control vulnerabilities in Samsung Cloud prior to version 5.3.0.32 allows local attackers to access info

A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause all remote domains to access the r

XWiki Commons are technical libraries common to several other top level XWiki projects. It's possible to list some users

Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusti

Mattermost fails to check the "Show Full Name" setting when rendering the result for the /plugins/focalboard/api/v2/user

HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpecte

In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class w

Students in "Only see own membership" groups could see other students in the group, which should be hidden.

H5P metadata automatically populated the author with the user's username, which could be sensitive information.

A vulnerability has been identified in PT-G503 Series versions prior to v5.2, where the session cookies attribute is not

PowerPath Management Appliance with versions 3.3, 3.2*, 3.1 & 3.0* contains sensitive information disclosure vulnerabil

Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API en

SilverwareGames.io versions before 1.2.19 allow users with access to the game upload panel to edit download links for ga

Authenticated clients can read arbitrary files on the MAIN Computer system using the remote procedure call (RPC) of the

Nextcloud Talk is a fully on-premises audio/video and chat communication service. When cron jobs were misconfigured and

The issue was addressed with improved checks. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, tvOS 16.5, m

IBM Security Verify Governance 10.0, Identity Manager could allow a local privileged user to obtain sensitive informatio

Improper logic in HomeScreen prior to SMR Feb-2023 Release 1 allows physical attacker to access App preview protected by

File existence disclosure vulnerability in NetIQ Identity Manager plugin prior to version 4.8.5 allows attacker to deter

Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. V

Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace

seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The

Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from t

Dell PowerStore versions 2.0.0.x, 2.0.1.x and 2.1.0.x contains an open port vulnerability. A remote unauthenticated atta

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t

PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vul

SWHKD 1.1.5 unsafely uses the /tmp/swhkd.sock pathname. There can be an information leak or denial of service.

In a openshift node, there is a cron job to update mcollective facts that mishandles a temporary file. This may lead to

Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agents to invoke command-l

ToaruOS 1.99.2 is affected by incorrect access control via the kernel. Improper MMU management and having a low GDT addr

A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized i

A external control of file name or path in Fortinet FortiClientWindows version 7.0.2 and below, version 6.4.6 and below,

A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to

Ethermint is an Ethereum library. In Ethermint running versions before `v0.17.2`, the contract `selfdestruct` invocation

The Visual Voice Mail (VVM) application through 2022-02-24 for Android allows persistent access if an attacker temporari

A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vuln

Various Lexmark products through 2022-04-27 allow an attacker who has already compromised an affected Lexmark device to

PHPGurukul Blood Donor Management System 1.0 does not properly restrict access to admin/dashboard.php, which allows atta

CyberArk Endpoint Privilege Manager (EPM) through 11.5.3.328 before 2021-12-20 allows a local user to gain elevated priv

Splashtop Streamer through 3.4.8.3 creates a Temporary File in a Directory with Insecure Permissions.

Splashtop Remote Client (Personal Edition) through 3.4.6.1 creates a Temporary File in a Directory with Insecure Permiss

Splashtop Remote Client (Business Edition) through 3.4.8.3 creates a Temporary File in a Directory with Insecure Permiss

KDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename during an editing session.

spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerabilit