CWE-610: CWE-610

HCL MyXalytics has an out-of-band resource load vulnerability where attackers can host malicious web content and trick the application into fetching a...

This CVE describes a server-side request forgery (SSRF) vulnerability in Rockwell Automation ThinManager software where authenticated attackers can fo...

MSEdgeRedirect versions before 0.5.0.1 are vulnerable to remote code execution via crafted URLs that bypass URL validation. Attackers can execute mali...

This vulnerability in Metabase allows attackers with SQL permissions on one SQLite database to attach and query across multiple SQLite databases if th...

This Android vulnerability allows a malicious app to leak data between user profiles on the same device due to a confused deputy flaw in the notificat...

This vulnerability allows local attackers to escalate privileges by exploiting improper handling of symbolic links in Acronis Agent. Attackers with lo...

This vulnerability allows local attackers to escalate privileges during installation of Acronis Cyber Protect Home Office on Windows systems. Attacker...

This vulnerability in Insyde InsydeH2O UEFI firmware allows attackers to corrupt System Management RAM (SMRAM) due to insufficient validation of save ...

This vulnerability in Android's SystemUI allows attackers to launch arbitrary activities through a confused deputy attack, potentially leading to loca...

This vulnerability allows local privilege escalation on Android devices through an intent redirection flaw in the System UI. An attacker could trick t...

This vulnerability allows local attackers to bypass Bluetooth permission checks in Android's settings interface, potentially gaining elevated privileg...

CVE-2021-0708 is a local privilege escalation vulnerability in Android's ActivityManagerShellCommand that allows attackers to delete system files with...

This vulnerability in Android's WiFiInstaller allows a malicious app to delete files accessible to CertInstaller due to a confused deputy attack. It e...

This vulnerability allows malicious apps to gain WRITE_EXTERNAL_STORAGE permissions without user consent through a confused deputy attack in Android's...

This vulnerability allows attackers to escape the intended directory structure during archive unpacking in Nomad migrations, potentially writing files...

This vulnerability allows unauthenticated attackers to manipulate a controller's webserver URL to access resources they shouldn't have access to, pote...

ACEweb Online Portal 3.5.065 contains a path traversal vulnerability in the txtFilePath parameter of attachments.awp that allows attackers to read arb...

This CVE describes a local privilege escalation vulnerability in Acronis Cyber Protect 17 for Windows due to improper handling of symbolic links. Atta...

This CVE describes a local privilege escalation vulnerability in Acronis Cyber Protect 17 for Windows due to improper handling of symbolic links. An a...

This vulnerability allows remote attackers to execute XML External Entity (XXE) attacks against Bjskzy Zhiyou ERP systems up to version 11.0. By manip...

This is an XML External Entity (XXE) vulnerability in Jinher OA 2.0 that allows remote attackers to read arbitrary files from the server or potentiall...

This CVE describes an XML External Entity (XXE) vulnerability in Jinher OA software up to version 1.2. Attackers can exploit this to read sensitive fi...

This vulnerability in Jinher OA allows attackers to perform XML External Entity (XXE) attacks through the XML Handler component. Remote exploitation c...

This vulnerability in Jinher OA 1.2 allows remote attackers to perform XML External Entity (XXE) attacks via the ProjectScheduleDelete.aspx file. This...

This vulnerability in Jinher OA 1.0 allows attackers to perform XML External Entity (XXE) attacks through the /c6/Jhsoft.Web.message/ToolBar/DelTemp.a...

This vulnerability allows a malicious app on an Android device to send privileged broadcast intents, potentially gaining elevated permissions. It affe...

This vulnerability in MDaemon email server allows administrators with Remote Administration access to write arbitrary files anywhere on the filesystem...

CVE-2024-45826 is a path traversal and remote code execution vulnerability in ThinManager® that allows attackers to install executable files via craf...

This vulnerability allows an attacker to modify the primary user's face unlock settings without authentication through a confused deputy attack. It af...

Dell Command | Update, Dell Update, and Alienware Update UWP applications contain an exposed dangerous method vulnerability in versions prior to 5.4. ...

This vulnerability in opencc JFlow's workflow engine allows XML External Entity (XXE) attacks through manipulation of file arguments. Attackers can re...

This XXE vulnerability in O2OA allows attackers to read arbitrary files from the server by sending specially crafted XML payloads to the vulnerable en...

This CVE describes an XML External Entity (XXE) vulnerability in bestfeng oa_git_free software up to version 9.5. Attackers can exploit this remotely ...

This XXE vulnerability in YoukeFu allows attackers to read arbitrary files from the server by exploiting XML parsing in the call center router compone...

This vulnerability allows remote attackers to perform XML External Entity (XXE) attacks through the webHook function in crmeb_java's WeChatMessageCont...

This XXE vulnerability in ywoa's WXCallBack Interface allows attackers to read arbitrary files from the server by exploiting XML parsing. It affects a...

This vulnerability allows an attacker with access to a Nomad client agent to write files outside the intended allocation directory during archive unpa...

This vulnerability allows a malicious app on an Android device to access media files from other user profiles without permission. It affects Android d...

This Android vulnerability allows one user's images to be accessed by another user through confused deputy attacks in StatusHint.java and TelecomServi...

This CVE describes an XML External Entity (XXE) vulnerability in thinkgem JeeSite's CAS authentication component. Attackers can exploit this flaw to r...

A symbolic link vulnerability in snapd versions before 2.62 allows attackers to write privileged information to world-readable directories. Attackers ...

This vulnerability allows attackers to poison web caches by sending crafted HTTP requests with malicious Host headers to Fortinet devices. Attackers c...

This vulnerability allows malicious apps to bypass user consent checks when accessing files in shared storage on Android devices. It enables local inf...