CWE-706 Use of Incorrectly-Resolved Name or Reference
classThe product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (191)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-24813US | critical9.8OT kritisch | KEV | ||
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Defau… | ||||
| CVE-2021-40539US | critical9.8OT kritisch | KEV | ||
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution. | ||||
| CVE-2020-15505US | critical9.8OT kritisch | KEV | ||
A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sen… | ||||
| CVE-2021-40856US | high7.5 | — | ||
Auerswald COMfortel 1400 IP and 2600 IP before 2.8G devices allow Authentication Bypass via the /about/../ substring. | ||||
| CVE-2019-0571US | high7.8 | Exploit | ||
An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elevation of Privilege Vu… | ||||
| CVE-2026-67602US | critical9.1 | Exploit | ||
phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object… | ||||
| CVE-2021-31933US | high7.2 | Exploit | ||
A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and improper file-extension filteri… | ||||
| CVE-2019-1351US | high7.5 | Exploit | ||
A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vulnerability'. | ||||
| CVE-2019-9901US | critical10.0 | — | ||
Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin.… | ||||
| CVE-2020-26233US | high7.3 | Exploit | ||
Git Credential Manager Core (GCM Core) is a secure Git credential helper built on .NET Core that runs on Windows and macOS. In Git Credential Manager Core before version 2.0.289, w… | ||||
| CVE-2020-12279US | critical9.8 | — | ||
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote co… | ||||
| CVE-2020-12278US | critical9.8 | — | ||
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow re… | ||||
| CVE-2019-8395US | critical9.8 | — | ||
An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment to a request. | ||||
| CVE-2026-92951US | critical9.9OT erhöht | — | ||
vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boun… | ||||
| CVE-2021-39156US | high7.5OT erhöht | Exploit | ||
Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. Is… | ||||
| CVE-2020-23448US | critical9.8OT erhöht | — | ||
newbee-mall all versions are affected by incorrect access control to remotely gain privileges through AdminLoginInterceptor.java. The authentication logic of the system's backgroun… | ||||
| CVE-2019-8908US | critical9.8 | — | ||
An issue was discovered in WTCMS 1.0. It allows remote attackers to execute arbitrary PHP code by going to the "Setting -> Mailbox configuration -> Registration email template" scr… | ||||
| CVE-2019-7731US | critical9.8 | — | ||
MyWebSQL 3.7 has a remote code execution (RCE) vulnerability after an attacker writes shell code into the database, and executes the Backup Database function with a .php filename f… | ||||
| CVE-2017-16521US | critical9.8 | — | ||
In Inedo BuildMaster before 5.8.2, XslTransform was used where XslCompiledTransform should have been used. | ||||
| CVE-2025-65474US | critical9.8 | — | ||
An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via renaming a PHP file to… | ||||
04
Angriffsmuster (4)
CAPEC-Angriffsmuster, die dies ausnutzen.
05
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan