CWE-610.

HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability

• HCL Software DRYiCE MyXalytics
• CWE-610

Arbitrary config values override in lam

• LDAPAccountManager lam
• CWE-610

Anonymous cache poisoning via XHR requests in Discourse

• discourse
• CWE-610

ThinManager® Code Execution Vulnerability

• Rockwell Automation ThinManager
• CWE-610

Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking

• CWE-610

>=0.6.1, <1.6.14 || >=1.7.0, <1.7.11 || >=1.8.0, <1.8.3 · fixed in 1.6.14, 1.7.11, 1.8.3

DLL Hijacking Vulnerability Exists in Rockwell Automation Emulate3D™

• Rockwell Automation Emulate3D™
• CWE-610

Dell Command | Update, Dell Update, and Alienware Update UWP, versions prior to 5.4, contain an Exposed Dangerous Method or Function vulnerability.

• Dell Update (DU)
• CWE-610

snapd failed to properly check the destination of symbolic links when extracting a snap

• Path traversal
• CWE-610

<2.62 · fixed in 2.62

CometBFT is unstability during blocksync when syncing from malicious peer

• CWE-610

>=0.37.0, <0.37.7 || >=0.38.0, <0.38.8 · fixed in 0.37.7, 0.38.8

Grafana Fine-grained access control vulnerability

• Broken access control
• CWE-610

>=8.0.0, <8.2.4 · fixed in 8.2.4

Spin applications with specific configuration vulnerable to potential network sandbox escape

• CWE-610

<2.4.3 · fixed in 2.4.3

EspoCRM weakness in "Forgot password"

• espocrm
• CWE-610

php-svg-lib lacks path validation on font through SVG inline styles

• Path traversal
• Insecure deserialization

<0.5.2 · fixed in 0.5.2

Micronaut management endpoints vulnerable to drive-by localhost attack

• CWE-15
• CWE-610

<3.8.3 · fixed in 3.8.3

HashiCorp Nomad vulnerable to symlink attacks

• Path traversal
• CWE-610

>=1.5.13, <1.5.14 || >=1.6.0, <1.6.7 || >=1.7.3, <1.7.4 · fixed in 1.5.14, 1.6.7, 1.7.4

Mailcow Docker Container Exposure to Local Network

• mailcow-dockerized
• CWE-610

External Control of File Name or Path in h2oai/h2o-3

• Path traversal
• CWE-610

<3.46.0.1 · fixed in 3.46.0.1

WAGO: Multiple products vulnerable to local file inclusion

• WAGO Compact Controller CC100
• WAGO Edge Controller
• CWE-610

Local privilege escalation due to improper soft link handling.

• Acronis Cyber Protect Cloud Agent
• Acronis Cyber Protect 17
• CWE-610

Local privilege escalation during installation due to improper soft link handling.

• Acronis Cyber Protect Home Office
• Acronis True Image OEM
• CWE-610

Local privilege escalation during recovery due to improper soft link handling.

• Acronis Cyber Protect Home Office
• CWE-610

PHOENIX CONTACT: Unauthorized read-access of root filesystem in WP 6xxx Web panels

• PHOENIX CONTACT WP 6070-WVPS
• PHOENIX CONTACT WP 6101-WXPS
• CWE-610

PHOENIX CONTACT: Unauthorized read-access of root filesystem in WP 6xxx Web panels

• PHOENIX CONTACT WP 6070-WVPS
• PHOENIX CONTACT WP 6101-WXPS
• CWE-610

PAN-OS: Read System Files and Resources During Configuration Commit

• Palo Alto Networks PAN-OS
• Palo Alto Networks Cloud NGFW
• CWE-610

Uncontrolled data used in content resolution

• federicoiosue Omni-Notes
• CWE-441
• CWE-610

in-toto vulnerable to Configuration Read From Local Directory

• CWE-15
• CWE-610

<2.0.0 · fixed in 2.0.0

Moodle External Control of File Name or Path vulnerability

• Path traversal
• CWE-610

<4.2.0-rc2 · fixed in 4.2.0-rc2

Incorrect indirect branch prediction barrier in the Linux Kernel

• Linux Kernel
• CWE-610

Android: In toUriInner of Intent.java, there is a possible way to launch an arbitrary activity due…

• Android
• CWE-610

An issue was discovered in Insyde InsydeH2O with kernel 5.2 through 5.5.

• CWE-610

Android: In multiple functions of MediaSessionRecord.java…

• Android
• CWE-610

Android: In Multiple Locations, there is a possibility to launch arbitrary protected activities…

• Android
• CWE-610

Android: In onPreferenceClick of AccountTypePreferenceLoader.java…

• Android
• CWE-610

Android: In multiple locations of NfcService.java…

• Android
• CWE-610

Local privilege escalation due to improper soft link handling.

• Acronis Cyber Protect Home Office
• CWE-610

Agent-to-controller security bypass vulnerabilities in Jenkins Compuware Topaz for Total Test Plugin

• CWE-610
• CWE-693

<2.4.9 · fixed in 2.4.9

Agent-to-controller security bypass vulnerability in Jenkins BMC Compuware Source Code Download for Endevor, PDS, and ISPW Plugin

• CWE-610
• CWE-693

<2.0.13 · fixed in 2.0.13

CI/CD Docker Escape in OneDev

• onedev
• CWE-610

DeadBolt Ransomware

• QNAP Systems Inc. Photo Station
• CWE-610

Externally Controlled Reference to a Resource in Another Sphere in ruby-mysql

• CWE-610

<2.10.0 · fixed in 2.10.0

phpBB Server-Side Request Forgery Vulnerability

• Server-side request forgery (SSRF)
• CWE-610

>=3.2.0, <3.2.10 || >=3.3.0, <3.3.1 · fixed in 3.2.10, 3.3.1

ingress-nginx component for Kubernetes allows file overwrite

• Path traversal
• CWE-610

<0.28.0 · fixed in 0.28.0

Shopware XXE Vulnerability

• CWE-610

<5.3.4 · fixed in 5.3.4

Database bypassing any permissions in Metabase via SQlite attach

• metabase
• CWE-610

Externally Controlled Reference to a Resource in Another Sphere in MSEdgeRedirect

• rcmaehl MSEdgeRedirect
• CWE-610

Anonymous user cache poisoning via development-mode header in Discourse

• discourse
• CWE-610

Confused Deputy in Kubernetes

• CWE-441
• CWE-610

<=1.22.2 · no fixed version yet

Confused Deputy in Kubernetes

• CWE-441
• CWE-610

<=1.22.2 · no fixed version yet

ExternalName Services can be used to gain access to Envoy's admin interface

• CWE-441
• CWE-610

<1.14.2 || >=1.15.0, <1.15.2 || >=1.16.0, <1.16.1 || >=1.17.0, <1.17.1 · fixed in 1.14.2, 1.15.2, 1.16.1, 1.17.1

Externally Controlled Reference to a Resource in Another Sphere and Confused Deputy in Spring Cloud Netflix

• CWE-441
• CWE-610

>=2.2.0, <2.2.4 || >=2.1.0, <2.1.6 · fixed in 2.2.4, 2.1.6

Synology Antivirus Essential: Externally controlled reference to a resource in another sphere in quarantine…

• Synology Antivirus Essential
• CWE-610

Externally Controlled Reference to a Resource in Another Sphere, Improper Input Validation, and External Control of File Name or Path in Ansible

• Path traversal
• Information disclosure

>=2.7.0a1, <2.7.16 || >=2.8.0a1, <2.8.8 || >=2.9.0a1, <2.9.3 · fixed in 2.7.16, 2.8.8, 2.9.3

obs-service-download_files allows downloading from localhost or intranet hosts

• openSUSE Open Build Service
• CWE-610

Upload whitelisted files to any directory in OctoberCMS

• Path traversal
• CWE-610

>=1.0.319, <1.0.466 · fixed in 1.0.466

Arbitrary File Deletion vulnerability in OctoberCMS

• Path traversal
• CWE-610

>=1.0.319, <1.0.466 · fixed in 1.0.466

Schneider Electric Modbus Serial Driver (For 64-bit Windows…: An Externally Controlled Reference to a Resource (CWE-610) vulnerability exists in…

• Schneider Electric Modbus Serial Driver (For 64-bit Windows OS:V3.17 IE 37 and prior , For 32-bit Windows OS:V2.17 IE 27 and prior, and as part of the Driver Suite version:V14.12 and prior)
• CWE-610

Sandbox Breakout in safe-eval

• CWE-610

<=0.3.0 · no fixed version yet