# CWE-749.

Every Advisory and CVE whose sources give the weakness CWE-749, newest first.

## Records, newest first (an older page)

- [EisBaer Scada - CWE-749: Exposed Dangerous Method or Function](https://agentprime.io/advisories/CVE-2023-42494.md)
  `CVE-2023-42494` · CVE record: EisBaer Scada v3.0.6433.1964 · CVSS 7.5 High · Not analysed yet · Published 25 Oct 2023 · Tags: CWE-749
- [Unauthenticated Remote Database Exfiltration](https://agentprime.io/advisories/CVE-2023-3655.md)
  `CVE-2023-3655` · CVE record: PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH cashIT! - serving solutions. · CVSS 7.5 High · Not analysed yet · Published 3 Oct 2023 · Tags: CWE-749
- [Unauthenticated Remote Code Execution](https://agentprime.io/advisories/CVE-2023-3656.md)
  `CVE-2023-3656` · CVE record: PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH cashIT! - serving solutions. · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Oct 2023 · Tags: Code injection, CWE-749
- [Softneta MedDream PACS Exposed Dangerous Method or Function](https://agentprime.io/advisories/CVE-2023-40150.md)
  `CVE-2023-40150` · CVE record: Softneta MedDream PACS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2023 · Tags: CWE-749
- [Unprotected WebView access in Govee Home App](https://agentprime.io/advisories/CVE-2023-3612.md)
  `CVE-2023-3612` · CVE record: Govee Govee Home · CVSS 8.2 High · Not analysed yet · Published 11 Sept 2023 · Tags: CWE-749
- [Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial of service via network access.](https://agentprime.io/advisories/CVE-2023-39214.md)
  `CVE-2023-39214` · CVE record: Zoom Video Communications, Inc. Zoom SDK's · CVSS 7.6 High · Not analysed yet · Published 8 Aug 2023 · Tags: CWE-749
- [Keysight Geolocation Server Exposed Dangerous Method or Function](https://agentprime.io/advisories/CVE-2023-36853.md)
  `CVE-2023-36853` · CVE record: Keysight Technologies N6845A Geolocation Server · CVSS 7.8 High · Not analysed yet · Published 19 Jul 2023 · Tags: CWE-749
- [Siemens CP-8031 MASTER MODULE: A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05)…](https://agentprime.io/advisories/CVE-2023-33921.md)
  `CVE-2023-33921` · CVE record: Siemens CP-8031 MASTER MODULE and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 13 Jun 2023 · Tags: CWE-749
- [In JetBrains TeamCity before 2023.05 a specific endpoint was vulnerable to brute force attacks](https://agentprime.io/advisories/CVE-2023-34227.md)
  `CVE-2023-34227` · CVE record: JetBrains TeamCity · CVSS 5.3 Medium · Not analysed yet · Published 31 May 2023 · Tags: CWE-749
- [PDF-XChange Editor: This vulnerability allows remote attackers to execute arbitrary code on affected…](https://agentprime.io/advisories/CVE-2022-37365.md)
  `CVE-2022-37365` · CVE record: PDF-XChange PDF-XChange Editor · CVSS 7.8 High · Not analysed yet · Published 29 Mar 2023 · Tags: CWE-749
- [REMAP cmd of SVM driver can be used to remap read only memory as read-write, then cause read only memory/file modified.](https://agentprime.io/advisories/CVE-2021-33639.md)
  `CVE-2021-33639` · CVE record: kernel · CVSS 7.5 High · Not analysed yet · Published 8 Mar 2023 · Tags: CWE-749
- [xwiki contains Exposed Dangerous Method or Function](https://agentprime.io/advisories/GHSA-8692-g6g9-gm5p.md)
  `GHSA-8692-g6g9-gm5p`, `CVE-2023-26478` · Maven `org.xwiki.platform:xwiki-platform-store-filesystem-oldcore`: affected `>=14.3-rc-1, <14.4.6 || >=14.5, <14.9-rc-1`, fixed in `14.4.6`, `14.9-rc-1` · CVSS 6.6 Medium · Not analysed yet · Published 3 Mar 2023 · Tags: CWE-749
- [Exposed Dangerous Method or Function in qmpaas/leadshop](https://agentprime.io/advisories/CVE-2022-4136.md)
  `CVE-2022-4136` · CVE record: qmpaas qmpaas/leadshop · CVSS 8.6 High · Not analysed yet · Published 24 Nov 2022 · Tags: CWE-749
- [Cobbler has Exposed Dangerous Method or Function](https://agentprime.io/advisories/GHSA-8787-63px-3m23.md)
  `GHSA-8787-63px-3m23`, `CVE-2018-10931`, `PYSEC-2026-313` · PyPI `cobbler`: affected `>=2.6.0, <3.0.0`, fixed in `3.0.0` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.68 · Not analysed yet · Published 13 May 2022 · Tags: CWE-749
- [Improper Input Validation in Apache Struts](https://agentprime.io/advisories/GHSA-7qwv-cwgj-c8rj.md)
  `GHSA-7qwv-cwgj-c8rj`, `CVE-2006-1547` · Maven `struts:struts`: affected `<1.2.9`, fixed in `1.2.9` · CVSS 7.5 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.55 · Not analysed yet · Published 1 May 2022 · Tags: CWE-20, CWE-749
- [Commvault CommCell: This vulnerability allows remote attackers to execute arbitrary code on affected…](https://agentprime.io/advisories/CVE-2021-34996.md)
  `CVE-2021-34996` · CVE record: Commvault CommCell · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.82 · Not analysed yet · Published 13 Jan 2022 · Tags: CWE-749
- [HTTP PUT & DELETE Methods Enabled](https://agentprime.io/advisories/CVE-2021-35243.md)
  `CVE-2021-35243` · CVE record: SolarWinds Web Help Desk · CVSS 5.3 Medium · Not analysed yet · Published 23 Dec 2021 · Tags: CWE-749
- [Ivanti Avalanche: An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 using…](https://agentprime.io/advisories/CVE-2021-42128.md)
  `CVE-2021-42128` · CVE record: Ivanti Avalanche · No CVSS score · Not analysed yet · Published 7 Dec 2021 · Tags: CWE-749
- [IpTime C200 IP camera remote code execution vulnerability](https://agentprime.io/advisories/CVE-2021-26614.md)
  `CVE-2021-26614` · CVE record: EFM networks & multimedia ipTIME C200 IP Camera · CVSS 7.5 High · Not analysed yet · Published 22 Nov 2021 · Tags: CWE-749
- [Missing Authentication for Critical Function in RTRR Server in HBS3](https://agentprime.io/advisories/CVE-2021-28809.md)
  `CVE-2021-28809` · CVE record: QNAP Systems Inc. HBS 3 · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.16 · Not analysed yet · Published 8 Jul 2021 · Tags: Broken access control, Authentication bypass, CWE-749
- [Stored cross-site scripting vulnerability in QES](https://agentprime.io/advisories/CVE-2020-2503.md)
  `CVE-2020-2503` · CVE record: QNAP Systems Inc. QES · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Dec 2020 · Tags: Cross-site scripting (XSS), CWE-749
- [Crash while handling internal Javascript exception types](https://agentprime.io/advisories/CVE-2019-20923.md)
  `CVE-2019-20923` · CVE record: MongoDB Inc. MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 23 Nov 2020 · Tags: CWE-749
- [AMD VBIOS Flash Tool SDK: A potential vulnerability in a dynamically loaded AMD driver in AMD VBIOS Flash Tool SDK…](https://agentprime.io/advisories/CVE-2020-12927.md)
  `CVE-2020-12927` · CVE record: AMD VBIOS Flash Tool SDK · No CVSS score · Not analysed yet · Published 12 Nov 2020 · Tags: CWE-749
- [A potential vulnerability in the AMD extension to Linux "hwmon" service may allow an attacker to use the Linux-based Running Average Power Limit (RAPL) interface to show various side channel attacks.](https://agentprime.io/advisories/CVE-2020-12912.md)
  `CVE-2020-12912` · CVE record: AMD extension to Linux "hwmon" for Zen1 platforms · No CVSS score · Not analysed yet · Published 12 Nov 2020 · Tags: CWE-749
- [Cisco AnyConnect Secure Mobility Client for Windows Arbitrary File Read Vulnerability](https://agentprime.io/advisories/CVE-2020-27123.md)
  `CVE-2020-27123` · CVE record: Cisco Cisco AnyConnect Secure Mobility Client · CVSS 5.5 Medium · Not analysed yet · Published 6 Nov 2020 · Tags: CWE-749
- [AMD Ryzen Master: A vulnerability in a dynamically loaded AMD driver in AMD Ryzen Master V15 may allow any…](https://agentprime.io/advisories/CVE-2020-12928.md)
  `CVE-2020-12928` · CVE record: AMD Ryzen Master · No CVSS score · Not analysed yet · Published 13 Oct 2020 · Tags: CWE-749
- [Cisco IOS XE Software for Cisco ASR 900 Series Route Switch Processor 3 Arbitrary Code Execution Vulnerabilities](https://agentprime.io/advisories/CVE-2020-3416.md)
  `CVE-2020-3416` · CVE record: Cisco Cisco IOS XE Software · CVSS 6.7 Medium · Not analysed yet · Published 24 Sept 2020 · Tags: CWE-749
- [Cisco IOS XE Software for Cisco ASR 900 Series Route Switch Processor 3 Arbitrary Code Execution Vulnerabilities](https://agentprime.io/advisories/CVE-2020-3513.md)
  `CVE-2020-3513` · CVE record: Cisco Cisco IOS XE Software · CVSS 6.7 Medium · Not analysed yet · Published 24 Sept 2020 · Tags: CWE-749
- [Marvell QConvergeConsole: This vulnerability allows remote attackers to execute arbitrary code on affected…](https://agentprime.io/advisories/CVE-2020-17388.md)
  `CVE-2020-17388` · CVE record: Marvell QConvergeConsole · CVSS 8.8 High · Not analysed yet · Published 25 Aug 2020 · Tags: CWE-749
- [Parallels Desktop: This vulnerability allows local attackers to disclose information on affected…](https://agentprime.io/advisories/CVE-2020-17391.md)
  `CVE-2020-17391` · CVE record: Parallels Desktop · CVSS 6.5 Medium · Not analysed yet · Published 25 Aug 2020 · Tags: CWE-749
- [Citrix XenMobile Server: Improper access control in Citrix XenMobile Server 10.12 before RP3…](https://agentprime.io/advisories/CVE-2020-8212.md)
  `CVE-2020-8212` · CVE record: Citrix XenMobile Server · No CVSS score · Not analysed yet · Published 17 Aug 2020 · Tags: CWE-749
- [CentOS Web Panel: This vulnerability allows remote attackers to write arbitrary files on affected…](https://agentprime.io/advisories/CVE-2020-15623.md)
  `CVE-2020-15623` · CVE record: CentOS Web Panel CentOS Web Panel · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Jul 2020 · Tags: CWE-749
- [RVD#2550: Terminate Critical Services in KUKA controller KR C4](https://agentprime.io/advisories/CVE-2020-10268.md)
  `CVE-2020-10268` · CVE record: KUKA Roboter GmbH KR3R540, KRC4, KSS8.5.7HF1, Win7_Embedded · No CVSS score · Not analysed yet · Published 16 Jun 2020 · Tags: CWE-749
- [A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0).](https://agentprime.io/advisories/CVE-2019-18342.md)
  `CVE-2019-18342` · CVE record: Siemens Control Center Server (CCS) · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Dec 2019 · Tags: CWE-749
- [A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl.](https://agentprime.io/advisories/CVE-2019-13945.md)
  `CVE-2019-13945` · CVE record: Siemens AG SIMATIC S7-1200 CPU family (incl. SIPLUS variants) and 4 more · No CVSS score · Not analysed yet · Published 12 Dec 2019 · Tags: CWE-749
- [Siemens AG SIMATIC PCS 7 V8.0 and earlier: A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions)…](https://agentprime.io/advisories/CVE-2019-10918.md)
  `CVE-2019-10918` · CVE record: Siemens AG SIMATIC PCS 7 V8.0 and earlier and 4 more · No CVSS score · Not analysed yet · Published 14 May 2019 · Tags: CWE-749
- [Talos Pixar Renderman: A local privilege escalation vulnerability exists in the Mac OS X version of Pixar…](https://agentprime.io/advisories/CVE-2019-5015.md)
  `CVE-2019-5015` · CVE record: Talos Pixar Renderman · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Mar 2019 · Tags: CWE-749
- [Medtronic MyCareLink Patient Monitor Exposed Dangerous Method or Function](https://agentprime.io/advisories/CVE-2018-8868.md)
  `CVE-2018-8868` · CVE record: Medtronic 24950 MyCareLink Monitor and 1 more · CVSS 6.2 Medium · Not analysed yet · Published 2 Jul 2018 · Tags: CWE-749
- [Multiple versions of GitLab expose a dangerous method to any authenticated user that could lead to the deletion of all Issue and MergeRequest objects on a GitLab instance.](https://agentprime.io/advisories/CVE-2016-9469.md)
  `CVE-2016-9469` · CVE record: GitLab Community Edition & GitLab Enterprise Edition 8.13.0, 8.13.0-ee, 8.13.1, 8.13.1-ee, 8.13.2, 8.13.2-ee, 8.13.3, 8.13.3-ee, 8.13.4, 8.13.4-ee, 8.13.5, 8.13.5-ee, 8.13.6, 8.13.6-ee, 8.13.7, 8.14.0, 8.14.0-ee, 8.14.1 · No CVSS score · Not analysed yet · Published 28 Mar 2017 · Tags: CWE-749
- [Beckhoff Embedded PC Images and TwinCAT Components Exposed Dangerous Method or Function](https://agentprime.io/advisories/CVE-2014-5415.md)
  `CVE-2014-5415` · CVE record: Beckhoff Embedded PC Images and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2016 · Tags: CWE-749
- [ICONICS GENESIS32 Exposed Dangerous Method or Function](https://agentprime.io/advisories/CVE-2014-0758.md)
  `CVE-2014-0758` · CVE record: ICONICS GENESIS32 · CVSS 9.3 High · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2014 · Tags: CWE-749
- [The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for…](https://agentprime.io/advisories/CVE-2010-1428.md)
  `CVE-2010-1428` · CVE record · CVSS 5.9 Medium · Critical (KEV) · In CISA KEV, ransomware · EPSS 0.53 · Not analysed yet · Published 28 Apr 2010 · Tags: CWE-749
- [The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for t…](https://agentprime.io/advisories/CVE-2010-0738.md)
  `CVE-2010-0738` · CVE record · CVSS 3.7 Low · Critical (KEV) · In CISA KEV, ransomware · EPSS 0.74 · Not analysed yet · Published 28 Apr 2010 · Tags: CWE-749

Newest: <https://agentprime.io/advisories/tag/cwe-749.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-749&cursor=WyIyMDIzLTExLTIxVDAwOjExOjEwLjA4MTAwMFoiLCJDVkUtMjAyMy00MDE1MSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-749/?cursor=WyIyMDIzLTExLTIxVDAwOjExOjEwLjA4MTAwMFoiLCJDVkUtMjAyMy00MDE1MSJd>. Everything for agents: <https://agentprime.io/llms.txt>.