CWE-706 Use of Incorrectly-Resolved Name or Reference
classThe product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (191)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-24813US | critical9.8OT critical | KEV | ||
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Defau… | ||||
| CVE-2021-40539US | critical9.8OT critical | KEV | ||
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution. | ||||
| CVE-2020-15505US | critical9.8OT critical | KEV | ||
A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sen… | ||||
| CVE-2021-40856US | high7.5 | — | ||
Auerswald COMfortel 1400 IP and 2600 IP before 2.8G devices allow Authentication Bypass via the /about/../ substring. | ||||
| CVE-2019-0571US | high7.8 | Exploit | ||
An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elevation of Privilege Vu… | ||||
| CVE-2026-67602US | critical9.1 | Exploit | ||
phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object… | ||||
| CVE-2021-31933US | high7.2 | Exploit | ||
A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and improper file-extension filteri… | ||||
| CVE-2019-1351US | high7.5 | Exploit | ||
A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vulnerability'. | ||||
| CVE-2019-9901US | critical10.0 | — | ||
Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin.… | ||||
| CVE-2020-26233US | high7.3 | Exploit | ||
Git Credential Manager Core (GCM Core) is a secure Git credential helper built on .NET Core that runs on Windows and macOS. In Git Credential Manager Core before version 2.0.289, w… | ||||
| CVE-2020-12279US | critical9.8 | — | ||
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote co… | ||||
| CVE-2020-12278US | critical9.8 | — | ||
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow re… | ||||
| CVE-2019-8395US | critical9.8 | — | ||
An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment to a request. | ||||
| CVE-2026-92951US | critical9.9OT elevated | — | ||
vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boun… | ||||
| CVE-2021-39156US | high7.5OT elevated | Exploit | ||
Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. Is… | ||||
| CVE-2020-23448US | critical9.8OT elevated | — | ||
newbee-mall all versions are affected by incorrect access control to remotely gain privileges through AdminLoginInterceptor.java. The authentication logic of the system's backgroun… | ||||
| CVE-2019-8908US | critical9.8 | — | ||
An issue was discovered in WTCMS 1.0. It allows remote attackers to execute arbitrary PHP code by going to the "Setting -> Mailbox configuration -> Registration email template" scr… | ||||
| CVE-2019-7731US | critical9.8 | — | ||
MyWebSQL 3.7 has a remote code execution (RCE) vulnerability after an attacker writes shell code into the database, and executes the Backup Database function with a .php filename f… | ||||
| CVE-2017-16521US | critical9.8 | — | ||
In Inedo BuildMaster before 5.8.2, XslTransform was used where XslCompiledTransform should have been used. | ||||
| CVE-2025-65474US | critical9.8 | — | ||
An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via renaming a PHP file to… | ||||
04
attack patterns (4)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan