CWE-749 Exposed Dangerous Method or Function
baseThe product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (271)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-21529US | —OT critical | KEV | ||
Microsoft Exchange Server Remote Code Execution Vulnerability | ||||
| CVE-2021-38000US | medium6.1OT critical | KEV | ||
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a cr… | ||||
| CVE-2018-19322US | high7.8OT critical | KEV | ||
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose… | ||||
| CVE-2014-3120US | high8.1OT critical | KEV | ||
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source pa… | ||||
| CVE-2010-1428US | high7.5OT critical | KEV | ||
The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs acce… | ||||
| CVE-2010-0738US | medium5.3OT critical | KEV | ||
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access… | ||||
| CVE-2006-1547US | high7.5OT critical | KEV | ||
ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form wi… | ||||
| CVE-2019-7276US | critical9.8 | Exploit | ||
Optergy Proton/Enterprise devices allow Remote Root Code Execution via a Backdoor Console. | ||||
| CVE-2023-7102US | critical9.8 | Exploit | ||
Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Applian… | ||||
| CVE-2021-34996US | high8.8 | — | ||
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this v… | ||||
| CVE-2018-10931US | critical9.8 | — | ||
It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privile… | ||||
| CVE-2013-2827US | high7.5 | Exploit | ||
An unspecified ActiveX control in WellinTech KingSCADA before 3.1.2, KingAlarm&Event before 3.1, and KingGraphic before 3.1.2 allows remote attackers to download arbitrary DLL code… | ||||
| CVE-2023-38124US | high8.8 | — | ||
Inductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exec… | ||||
| CVE-2013-2817US | high9.3 | Exploit | ||
An ActiveX control in IcoLaunch.dll in Mitsubishi Electric Automation MC-WorX Suite 8.02 allows user-assisted remote attackers to execute arbitrary programs via a crafted HTML docu… | ||||
| CVE-2021-28809US | critical9.8OT high | — | ||
An improper access control vulnerability has been reported to affect certain legacy versions of HBS 3. If exploited, this vulnerability allows attackers to compromise the security… | ||||
| CVE-2020-15623US | critical9.8 | — | ||
This vulnerability allows remote attackers to write arbitrary files on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this… | ||||
| CVE-2024-23469US | high8.8 | — | ||
SolarWinds Access Rights Manager (ARM) is susceptible to a Remote Code Execution vulnerability. If exploited, this vulnerability allows an unauthenticated user to perform the actio… | ||||
| CVE-2021-42128US | critical9.8 | — | ||
An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 using inforail Service allows Privilege Escalation via Enterprise Server Service. | ||||
| CVE-2020-12928US | high7.8 | Exploit | ||
A vulnerability in a dynamically loaded AMD driver in AMD Ryzen Master V15 may allow any authenticated user to escalate privileges to NT authority system. | ||||
| CVE-2026-89110US | critical9.9 | — | ||
SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on… | ||||
04
attack patterns (1)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan