CWE-501 Trust Boundary Violation
baseThe product mixes trusted and untrusted data in the same data structure or structured message.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (56)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-61884US | —OT kritisch | KEV | ||
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vu… | ||||
| CVE-2018-7846US | critical9.8 | Exploit | ||
A CWE-501: Trust Boundary Violation vulnerability on connection to the Controller exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium whic… | ||||
| CVE-2024-3661US | high7.6OT erhöht | Exploit | ||
DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to l… | ||||
| CVE-2026-35051US | critical10.0OT erhöht | — | ||
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an authentication bypass vulnerability in Traefik's ForwardAuth midd… | ||||
| CVE-2026-25725US | critical10.0 | — | ||
Claude Code is an agentic coding tool. Prior to version 2.1.2, Claude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file… | ||||
| CVE-2020-4077US | critical9.9 | — | ||
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated… | ||||
| CVE-2025-48938US | critical9.8 | — | ||
go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-contr… | ||||
| CVE-2022-1799US | critical9.8 | — | ||
Incorrect signature trust exists within Google Play services SDK play-services-basement. A debug version of Google Play services is trusted by the SDK for devices that are non-GMS.… | ||||
| CVE-2011-5088US | high9.3 | — | ||
The GENESIS32 IcoSetServer ActiveX control in ICONICS GENESIS32 9.21 and BizViz 9.21 configures the trusted zone on the basis of user input, which allows remote attackers to execut… | ||||
| CVE-2020-4076US | critical9.0 | — | ||
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated… | ||||
| CVE-2025-64496US | high8.0 | — | ||
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct C… | ||||
| CVE-2026-4687US | high8.6 | — | ||
Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149,… | ||||
| CVE-2024-23682US | high8.2 | — | ||
Artemis Java Test Sandbox versions before 1.8.0 are vulnerable to a sandbox escape when an attacker includes class files in a package that Ares trusts. An attacker can abuse this i… | ||||
| CVE-2026-62146US | high7.8 | — | ||
A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted a… | ||||
| CVE-2023-0627US | high7.8 | — | ||
Docker Desktop 4.11.x allows --no-windows-containers flag bypass via IPC response spoofing which may lead to Local Privilege Escalation (LPE).This issue affects Docker Desktop: 4.1… | ||||
| CVE-2023-28597US | high7.5 | — | ||
Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. If a victim saves a local recording to an SMB location and later opens it using a link… | ||||
| CVE-2021-25836US | high7.5 | — | ||
Cosmos Network Ethermint <= v0.4.0 is affected by cache lifecycle inconsistency in the EVM module. The bytecode set in a FAILED transaction wrongfully remains in memory(stateObject… | ||||
| CVE-2018-20785US | high7.4OT erhöht | — | ||
Secure boot bypass and memory extraction can be achieved on Neato Botvac Connected 2.2.0 devices. During startup, the AM335x secure boot feature decrypts and executes firmware. Sec… | ||||
| CVE-2023-49788US | high7.2 | — | ||
Collabora Online is a collaborative online office suite based on LibreOffice technology. Unlike a standalone dedicated Collabora Online server, the Built-in CODE Server (richdocume… | ||||
| CVE-2002-1016US | medium4.6 | Exploit | ||
Adobe eBook Reader allows a user to bypass restrictions for copy, print, lend, and give operations by backing up key data files, performing the operations, and restoring the origin… | ||||
03
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan