Vulnerabilities > Externally Controlled Reference to a Resource in Another Sphere
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-11-14 | CVE-2019-15394 | Externally Controlled Reference to a Resource in Another Sphere vulnerability in Asus Zenfone 5 Selfie Firmware The Asus ZenFone 5 Selfie Android device with a build fingerprint of asus/WW_Phone/ASUS_X017D_1:7.1.1/NMF26F/14.0400.1810.061-20181107:user/release-keys contains a pre-installed app with a package name of com.asus.atd.smmitest app (versionCode=1, versionName=1) that allows unauthorized wireless settings modification via a confused deputy attack. | 7.8 |
| 2019-11-14 | CVE-2019-15393 | Externally Controlled Reference to a Resource in Another Sphere vulnerability in Asus Zenfone Live (L1) Firmware The Asus ZenFone Live Android device with a build fingerprint of asus/WW_Phone/ASUS_X00LD_3:7.1.1/NMF26F/14.0400.1806.203-20180720:user/release-keys contains a pre-installed app with a package name of com.asus.atd.smmitest app (versionCode=1, versionName=1) that allows unauthorized wireless settings modification via a confused deputy attack. | 3.3 |
| 2019-05-22 | CVE-2018-7824 | Externally Controlled Reference to a Resource in Another Sphere vulnerability in Schneider-Electric Driver Suite and Modbus Serial Driver An Externally Controlled Reference to a Resource (CWE-610) vulnerability exists in Schneider Electric Modbus Serial Driver (For 64-bit Windows OS:V3.17 IE 37 and prior , For 32-bit Windows OS:V2.17 IE 27 and prior, and as part of the Driver Suite version:V14.12 and prior) which could allow write access to system files available only to users with SYSTEM privilege or other important user files. | 4.9 |
| 2019-02-11 | CVE-2018-9582 | Externally Controlled Reference to a Resource in Another Sphere vulnerability in Google Android 8.0/8.1/9.0 In package installer in Android-8.0, Android-8.1 and Android-9, there is a possible bypass of the unknown source warning due to a confused deputy scenario. | 7.8 |
| 2019-01-15 | CVE-2017-18357 | Externally Controlled Reference to a Resource in Another Sphere vulnerability in Shopware Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller, with resultant XXE via instantiation of a SimpleXMLElement object. | 6.5 |
| 2018-10-18 | CVE-2018-12381 | Externally Controlled Reference to a Resource in Another Sphere vulnerability in Mozilla Firefox Manually dragging and dropping an Outlook email message into the browser will trigger a page navigation when the message's mail columns are incorrectly interpreted as a URL. | 5.3 |
| 2017-11-15 | CVE-2017-15269 | Externally Controlled Reference to a Resource in Another Sphere vulnerability in Psftp Psftpd 10.0.4 The PSFTPd 10.0.4 Build 729 server does not prevent FTP bounce scans by default. | 4.3 |
| 2017-04-12 | CVE-2017-0211 | Externally Controlled Reference to a Resource in Another Sphere vulnerability in Microsoft products An elevation of privilege vulnerability exists in Windows 10, Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 versions of Microsoft Windows OLE when it fails an integrity-level check, aka "Windows OLE Elevation of Privilege Vulnerability." | 5.5 |