Advisories · Weakness
CWE-706.
Every Advisory and CVE whose sources give the weakness CWE-706, newest first.
-
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.
- https://github.com/curl/curl
- CWE-706
- CVSS 6.5 Medium
EnvoyProxy Envoy Missing HTTP URL path normalization
- CWE-706
<1.9.1 · fixed in 1.9.1
GHSA-2wmf-p7f8-w42h · CVE-2019-9901 - CVSS 6.8 Medium
WordPress Popup Box plugin <= 2.1.2 - Authenticated Local File Inclusion (LFI) vulnerability
- Wow-Company Popup Box (WordPress plugin)
- CWE-706
- CVSS 6.6 Medium
NVIDIA Omniverse Nucleus: NVIDIA Omniverse Nucleus and Cache contain a vulnerability in its configuration of…
- NVIDIA Omniverse Nucleus
- NVIDIA Omniverse Cache
- CWE-706
- CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
- CWE-706
- CVSS 8.1 High
Istio Fragments in Path May Lead to Authorization Policy Bypass
- Broken access control
- CWE-706
<1.9.8 || >=1.10.0, <1.10.4 || >=1.11.0, <1.11.1 · fixed in 1.9.8, 1.10.4, 1.11.1
GHSA-hqxw-mm44-gc4r · CVE-2021-39156 - CVSS 7.5 High
Unaligned references in Obstack
- CWE-706
<0.1.4 · fixed in 0.1.4
GHSA-85j6-f8j6-q26x · CVE-2020-35894 - CVSS 4.3 Medium
Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-4
- Larvata Digital Technology Co. Ltd. FLYGO
- CWE-706
- CVSS 8.8 High
Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-3
- Larvata Digital Technology Co. Ltd. FLYGO
- CWE-706
- CVSS 4.3 Medium
Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-2
- Larvata Digital Technology Co. Ltd. FLYGO
- CWE-706
- CVSS 5.4 Medium
Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-1
- Larvata Digital Technology Co. Ltd. FLYGO
- CWE-706
- CVSS 5.9 Medium
opencontainers runc contains procfs race condition with a shared volume mount
- Race condition
- CWE-706
<1.0.0-rc9.0.20200122160610-2fc03cc11c77 · fixed in 1.0.0-rc9.0.20200122160610-2fc03cc11c77
GHSA-fh74-hm69-rqjw · CVE-2019-19921 - CVSS 5.9 Medium
Information Disclosure in Apache Tomcat
- Information disclosure
- CWE-706
>=10.0.0-M1, <10.0.0-M10 || >=9.0.0, <9.0.40 || >=8.5.0, <8.5.60 || >=7.0.0, <7.0.107 · fixed in 10.0.0-M10, 9.0.40, 8.5.60, 7.0.107
GHSA-2rvv-w9r2-rg7m · CVE-2021-24122 - CVSS 7.3 High
Remote Code Execution in Git Credential Manager Core
- microsoft Git-Credential-Manager-Core
- CWE-706
- CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2…
- CWE-706