CWE-939 Improper Authorization in Handler for Custom URL Scheme
baseThe product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (79)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-1999-1053US | high7.5 | Exploit | ||
guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl… | ||||
| CVE-2019-14809US | critical9.8 | — | ||
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field w… | ||||
| CVE-2001-0520US | high7.5 | Exploit | ||
Aladdin eSafe Gateway versions 3.0 and earlier allows a remote attacker to circumvent filtering of SCRIPT tags by embedding the scripts within certain HTML tags including (1) onloa… | ||||
| CVE-2021-31384US | critical10.0OT erhöht | — | ||
Due to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in Juniper Networks Junos OS on SR… | ||||
| CVE-2013-0840US | high10.0 | — | ||
Google Chrome before 24.0.1312.56 does not validate URLs during the opening of new windows, which has unspecified impact and remote attack vectors. | ||||
| CVE-2026-53407US | critical9.8 | — | ||
Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an… | ||||
| CVE-2023-42580US | critical9.8OT erhöht | — | ||
Improper URL validation from MCSLaunch deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute JavaScript API to install APK from Galaxy Store. | ||||
| CVE-2009-2963US | high9.3 | — | ||
Unspecified vulnerability in the update feature in Toolbar Uninstaller 1.0.2 allows remote attackers to force the download and execution of arbitrary files via attack vectors relat… | ||||
| CVE-2006-6919US | medium6.8 | Exploit | ||
Firefox Sage extension 1.3.8 and earlier allows remote attackers to execute arbitrary Javascript in the local context via an RSS feed with an img tag containing the script followed… | ||||
| CVE-2006-4560US | high7.5 | — | ||
Internet Explorer 6 on Windows XP SP2 allows remote attackers to execute arbitrary JavaScript in the context of the browser's session with an arbitrary intranet web server, by host… | ||||
| CVE-2021-37915US | high8.8 | — | ||
An issue was discovered on the Grandstream HT801 Analog Telephone Adaptor before 1.0.29.8. From the limited configuration shell, it is possible to set the malicious gdb_debug_serve… | ||||
| CVE-2026-35394US | high8.8 | — | ||
Mobile Next is an MCP server for mobile development and automation. Prior to 0.0.50, the mobile_open_url tool in mobile-mcp passes user-supplied URLs directly to Android's intent s… | ||||
| CVE-2024-33606US | high8.8OT erhöht | — | ||
An attacker could retrieve sensitive files (medical images) as well as plant new medical images or overwrite existing medical images on a MicroDicom DICOM Viewer system. User inter… | ||||
| CVE-2023-43582US | high8.8 | — | ||
Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access. | ||||
| CVE-2022-22758US | high8.8OT erhöht | — | ||
When clicking on a tel: link, USSD codes, specified after a <code>\*</code> character, would be included in the phone number. On certain phones, or on certain carriers, if the numb… | ||||
| CVE-2002-2101US | high7.5 | — | ||
Microsoft Outlook 2002 allows remote attackers to execute arbitrary JavaScript code, even when scripting is disabled, via an "about:" or "javascript:" URI in the href attribute of… | ||||
| CVE-2026-33335US | high8.0 | — | ||
Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper passes URLs from `window… | ||||
| CVE-2007-2742US | high7.5 | — | ||
Unrestricted file upload vulnerability in labs.beffa.org w2box 4.0.0 Beta4 allows remote attackers to upload arbitrary PHP code via a filename with a double extension such as .php.… | ||||
| CVE-2007-2025US | high7.5 | — | ||
Unrestricted file upload vulnerability in the UpLoad feature (lib/plugin/UpLoad.php) in PhpWiki 1.3.11p1 allows remote attackers to upload arbitrary PHP files with a double extensi… | ||||
| CVE-2007-0705US | high7.5 | — | ||
Cross-zone scripting vulnerability in Sleipnir 2.49 and earlier, and Portable Sleipnir 2.45 and earlier, allows remote attackers to bypass Web content zone restrictions via certain… | ||||
03
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan