# CWE-706. Every Advisory and CVE whose sources give the weakness CWE-706, newest first. ## Records, newest first (an older page) - [A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when \`--no-clobber\` is used together with \`--remove-on-error\`.](https://agentprime.io/advisories/CVE-2022-27778.md) `CVE-2022-27778` · CVE record: https\://github.com/curl/curl · No CVSS score · Not analysed yet · Published 1 Jun 2022 · Tags: CWE-706 - [EnvoyProxy Envoy Missing HTTP URL path normalization](https://agentprime.io/advisories/GHSA-2wmf-p7f8-w42h.md) `GHSA-2wmf-p7f8-w42h`, `CVE-2019-9901`, `GHSA-xcx5-93pw-jw2w` · Go `github.com/envoyproxy/envoy`: affected `<1.9.1`, fixed in `1.9.1` · CVSS 6.5 Medium · Not analysed yet · Published 24 May 2022 · Tags: CWE-706 - [WordPress Popup Box plugin <= 2.1.2 - Authenticated Local File Inclusion (LFI) vulnerability](https://agentprime.io/advisories/CVE-2022-29445.md) `CVE-2022-29445` · CVE record: Wow-Company Popup Box (WordPress plugin) · CVSS 6.8 Medium · Not analysed yet · Published 18 May 2022 · Tags: CWE-706 - [NVIDIA Omniverse Nucleus: NVIDIA Omniverse Nucleus and Cache contain a vulnerability in its configuration of…](https://agentprime.io/advisories/CVE-2022-28198.md) `CVE-2022-28198` · CVE record: NVIDIA NVIDIA Omniverse Nucleus and 1 more · CVSS 6.6 Medium · Not analysed yet · Published 29 Apr 2022 · Tags: CWE-706 - [Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.](https://agentprime.io/advisories/CVE-2021-40539.md) `CVE-2021-40539` · CVE record · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 0.99 · Not analysed yet · Published 7 Sept 2021 · Tags: CWE-706 - [Istio Fragments in Path May Lead to Authorization Policy Bypass](https://agentprime.io/advisories/GHSA-hqxw-mm44-gc4r.md) `GHSA-hqxw-mm44-gc4r`, `CVE-2021-39156` · Go `istio.io/istio`: affected `<1.9.8 || >=1.10.0, <1.10.4 || >=1.11.0, <1.11.1`, fixed in `1.9.8`, `1.10.4`, `1.11.1` · CVSS 8.1 High · Not analysed yet · Published 30 Aug 2021 · Tags: Broken access control, CWE-706 - [Unaligned references in Obstack](https://agentprime.io/advisories/GHSA-85j6-f8j6-q26x.md) `GHSA-85j6-f8j6-q26x`, `CVE-2020-35894`, `RUSTSEC-2020-0040` · crates.io `obstack`: affected `<0.1.4`, fixed in `0.1.4` · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2021 · Tags: CWE-706 - [Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-4](https://agentprime.io/advisories/CVE-2021-37215.md) `CVE-2021-37215` · CVE record: Larvata Digital Technology Co. Ltd. FLYGO · CVSS 4.3 Medium · Not analysed yet · Published 9 Aug 2021 · Tags: CWE-706 - [Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-3](https://agentprime.io/advisories/CVE-2021-37214.md) `CVE-2021-37214` · CVE record: Larvata Digital Technology Co. Ltd. FLYGO · CVSS 8.8 High · Not analysed yet · Published 9 Aug 2021 · Tags: CWE-706 - [Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-2](https://agentprime.io/advisories/CVE-2021-37213.md) `CVE-2021-37213` · CVE record: Larvata Digital Technology Co. Ltd. FLYGO · CVSS 4.3 Medium · Not analysed yet · Published 9 Aug 2021 · Tags: CWE-706 - [Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-1](https://agentprime.io/advisories/CVE-2021-37212.md) `CVE-2021-37212` · CVE record: Larvata Digital Technology Co. Ltd. FLYGO · CVSS 5.4 Medium · Not analysed yet · Published 9 Aug 2021 · Tags: CWE-706 - [opencontainers runc contains procfs race condition with a shared volume mount](https://agentprime.io/advisories/GHSA-fh74-hm69-rqjw.md) `GHSA-fh74-hm69-rqjw`, `CVE-2019-19921`, `GO-2021-0087` · Go `github.com/opencontainers/runc`: affected `<1.0.0-rc9.0.20200122160610-2fc03cc11c77`, fixed in `1.0.0-rc9.0.20200122160610-2fc03cc11c77` · CVSS 5.9 Medium · Not analysed yet · Published 27 May 2021 · Tags: Race condition, CWE-706 - [Information Disclosure in Apache Tomcat](https://agentprime.io/advisories/GHSA-2rvv-w9r2-rg7m.md) `GHSA-2rvv-w9r2-rg7m`, `BIT-tomcat-2021-24122`, `CVE-2021-24122` · Maven `org.apache.tomcat.embed:tomcat-embed-core`: affected `>=10.0.0-M1, <10.0.0-M10 || >=9.0.0, <9.0.40 || >=8.5.0, <8.5.60 || >=7.0.0, <7.0.107`, fixed in `10.0.0-M10`, `9.0.40`, `8.5.60`, `7.0.107` · CVSS 5.9 Medium · EPSS 0.23 · Not analysed yet · Published 13 May 2021 · Tags: Information disclosure, CWE-706 - [Remote Code Execution in Git Credential Manager Core](https://agentprime.io/advisories/CVE-2020-26233.md) `CVE-2020-26233` · CVE record: microsoft Git-Credential-Manager-Core · CVSS 7.3 High · Not analysed yet · Published 8 Dec 2020 · Tags: CWE-706 - [A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2…](https://agentprime.io/advisories/CVE-2020-15505.md) `CVE-2020-15505` · CVE record · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 1.00 · Not analysed yet · Published 7 Jul 2020 · Tags: CWE-706 Newest: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .