Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. Overlay: Wide "favorites" icon can overlay and obscure address bar. 2005-04-13. This information is often useful in understanding where a weakness fits within the context of external information sources. "The 2021 CWE Most Important Hardware Weaknesses is the first of its kind and the result of collaboration within the Hardware CWE Special Interest Group (SIG), a community forum for individuals representing organizations within hardware design, manufacturing, research, and security domains, as well as academia and government." reads the . This includes setting the appropriate access modifiers where applicable (public, private, protected, etc.) 1) The function/method was never intended to be exposed to outside actors. View - a subset of CWE entries that provides a way of examining CWE content. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. This MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. "filename.txt .exe"). 2003-03-03. that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. More information is available — Please select a different filter. Barco wePresent Admin Credential Exposure. Overview D-Link DIR-850L, firmware versions 1.14B07, 2.07.B05, and possibly others, contains a stack-based buffer overflow vulnerability in the web administration interface HNAP service. Adobe Experience Manager Information Disclosure via Apache Sling v2.3.6 vulnerability. Likely resultant. Use of the Common Weakness Enumeration (CWE) and the associated references from this website are subject to the Terms of Use. Common Weakness Enumeration (CWE) is a list of software weaknesses. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. The different Modes of Introduction provide information about how and when this weakness may be introduced. Miscellaneous -- Web browser allows remote attackers to misrepresent the source of a file in the File Download dialog box. Incorrect indicator: Lock icon displayed when an insecure page loads a binary file loaded from a trusted site. Category - a CWE entry that contains a set of other entries that share a common characteristic. Protect the administrative/restricted functionality with a strong authentication mechanism. Visual distinction: visual information might be presented in a way that makes it difficult for the user to quickly and correctly distinguish between critical and unimportant segments of the display. More specific than a Pillar Weakness, but more general than a Base Weakness. CWE-912: Hidden Functionality. Impact. CWE-16. This can be broken down into several different subtypes. Create a strategy for presenting information, and plan for how to display unusual characters. The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. (where the weakness exists independent of other weaknesses). Category - a CWE entry that contains a set of other entries that share a common characteristic. This weakness could appear in any technology, language, or framework that allows the programmer to provide a functional interface to external parties, but it is not heavily reported. This table shows the weaknesses and high level categories that are related to this weakness. Visual truncation: Null character in URL prevents entire URL from being displayed in web browser. . Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore. The administration web interface for the Arris Surfboard SB8200 lacks any protections against cross-site request forgery attacks. CVE-2016-0957. CWE. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. This table specifies different individual consequences associated with the weakness. If an attacker can cause the UI to display erroneous data, or to . CWE-1191: On-Chip Debug and Test Interface With Improper Access Control - the debug interface (JTAG) might be used to bypass on-chip protection to extract information. Crestron Electronics DM-TXRX-100-STR, version 1.2866.00026 and earlier, has a web management interface which contains multiple vulnerabilities, including authentication bypass, failure to restrict access to authorized users, use of hard-coded certificate, default credentials, and cross-site request forgery (CSRF). This weakness can lead to a wide variety of resultant weaknesses, depending on the behavior of the exposed method. Directory and file enumeration. From the CWE perspective, loss of confidentiality is a technical impact that can arise from dozens of different weaknesses, such as insecure file permissions or out-of-bounds read. CWE-451: User Interface (UI) Misrepresentation of Critical Information. Improper Restriction of Communication Channel to Intended Endpoints, OWASP Top Ten 2021 Category A04:2021 - Insecure Design, Cybersecurity and Infrastructure Security Agency, Homeland Security Systems Engineering and Development Institute. The software contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the software's users or administrators. CWE CWE Severity; Adobe ColdFusion 9 administrative login bypass: CVE-2013-0625 CVE-2013-0629 CVE-2013-0631 CVE-2013-0632. Vulnerability Description An attacker armed with hardcoded API credentials from KL-001-2020-004 (CVE-2020-28329) can issue an authenticated query to display the admin password for the main web user interface listening on port 443/tcp. Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated, remote attacker to perform the following actions: Log in with a default credential if the Telnet protocol is enabled Perform command injection Modify the configuration For more information about these . It is common practice to describe any loss of confidentiality as an "information exposure," but this can lead to overuse of CWE-200 in CWE mapping. Base - a weakness CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. Within Java this can be accomplished simply by declaring the method private thereby exposing it only to the enclosing class as in the following example. It can apply to any number of technologies and approaches, such as ActiveX controls, Java functions, IOCTLs, and so on. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore. In 2007, CVE began showing a notable increase in reports of exposed method vulnerabilities in ActiveX applications, as well as IOCTL access to OS-level resources. For example, if the UI is used to monitor the security state of a system or network, then omitting or obscuring an important indicator could prevent the user from detecting and reacting to a security-critical event. This entry should be broken down into more precise entries. Visual distinction: Chat client allows remote attackers to spoof encrypted, trusted messages with lines that begin with a special sequence, which makes the message appear legitimate. Incorrect indicator: incorrect information is displayed, which prevents the user from understanding the true state of the software or the environment the software is monitoring, especially of potentially-dangerous conditions or operations. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. Visual distinction: Product allows spoofing names of other users by registering with a username containing hex-encoded characters. More specific than a Base weakness. This table specifies different individual consequences associated with the weakness. The exposure can occur in a few different ways: Class: Language-Independent (Undetermined Prevalence), Technical Impact: Gain Privileges or Assume Identity; Read Application Data; Modify Application Data; Execute Unauthorized Code or Commands; Other. Josh Ferrell (@josh-ferrell) from VMware has reported that a specially crafted ExternalName type Service may be used to access Envoy's admin interface, which Contour normally prevents from access outside the Envoy container.This can be used to shut down Envoy remotely (a denial of service), or to expose the existence of any Secret that Envoy is using for its configuration, including . An administrative interface may be present but not visibly available to the tester. CWE-94 CWE-200. Overlay: an area of the display is intended to give critical information, but another process can modify the display by overlaying another element on top of it. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. Other models may also be affected. Harvesting Information via API Event Monitoring, updated Potential_Mitigations, Time_of_Introduction, updated Applicable_Platforms, Relationships, updated Modes_of_Introduction, Relationships. SQL injection vulnerability in Talariax sendQuick Alertplus server admin version 4.3 (CVE-2021-26795) From : refabrik sec <refabriksec () gmail com> Date : Thu, 11 Nov 2021 10:22:17 +0800 An attacker armed with hardcoded API credentials from KL-001-2020-004 (CVE-2020-28329) can issue an authenticated query to display the admin password for the main web user interface listening on port 443/tcp for Barco wePresent WiPG-1600W version 2.5.1.8. that is linked to a certain type of product, typically involving a specific language or technology. This MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). This table shows the weaknesses and high level categories that are related to this weakness. High. Incorrect indicator: Secure "lock" icon is presented for one channel, while an insecure page is being simultaneously loaded in another channel. The Phase identifies a point in the life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase. Incorrect indicator: Certain redirect sequences cause security lock icon to appear in web browser, even when page is not encrypted. After Android 4.2, only methods annotated with @JavascriptInterface are available in JavaScript, protecting usage of getClass() by default, as in this example: This code is not vulnerable to the above attack, but still may expose user info to malicious pages loaded in the WebView. In addition to gaining access to the device, an attacker could upload and download files with the built-in FTP server and can watch the RTSP video feed. "How to stop an ActiveX control from running in Internet Explorer". Visual truncation: important information could be truncated from the display, such as a long filename with a dangerous extension that is not displayed in the GUI because the malicious portion is truncated. The Phase identifies a point in the life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase. Use of the Common Weakness Enumeration (CWE) and the associated references from this website are subject to the Terms of Use. "Secure Programming for Linux and Unix HOWTO". IP filtering or 2FA are additional layers of security and, while they can be helpful, are not always possible or worthwhile. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact. This weakness could appear in any technology, language, or framework that allows the programmer to provide a functional interface to external parties, but it is not heavily reported. Identify which functionality may be: restricted to a small set of privileged users, prevented from being directly accessible at all. It's built with: Hogan.js (mustache.js), Express, mysql and Bootstrap. The method in this example is declared public and therefore is exposed to any class in the application. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. Homographs: letters from different character sets, fonts, or languages can appear very similar (i.e. Current Description. Misrepresentation problems are frequently studied in web browsers, but there are no known efforts for classifying these kinds of problems in terms of the shortcomings of the interface. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact. Incorrect indicator: web browser can be tricked into presenting the wrong URL. The Phase identifies a point in the life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase. More information is available — Please select a different filter. - By default interface is bound to 0.0.0.0, which means it's exposed to the world - The Content-Type set to 'application/json' during requests is not enforced, which means that even if eth JSON-RPC daemon is ran on machine behind a NAT the JSON-RPC APIs can still be easily triggered by CSRF or . In 2007, CVE began showing a notable increase in reports of exposed method vulnerabilities in ActiveX applications, as well as IOCTL access to OS-level resources. Even malicious iframes loaded within a trusted page may access the exposed interface: This malicious code within an iframe is able to access the interface object and steal the user's data. The software provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted. Under-reported and under-studied. An administrative interface may be present but not visibly available to the tester. Express Admin is a NodeJS tool for easy creation of user friendly administrative interface for MySQL, MariaDB, SQLite and PostgreSQL databases. Impact. If the JTAG interface on this device is not hidden by the manufacturer, the interface may be identified using tools such as JTAGulator. Identify all exposed functionality. Visual truncation: Special character in URL causes web browser to truncate the user portion of the ". WordPress Plugin Social Network Tabs Information Disclosure (1.7.1) CVE-2018-20555. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. Cisco CallManager versions prior to 4.3(1), 4.2(3), 4.1(3)SR4 and 3.3(5)SR3 contain a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary script in the user's browser session. Visual truncation: Visual truncation in chat client using whitespace to hide dangerous file extension. NSString *functionString = [URL resourceSpecifier]; window.location = examplescheme://method?parameter=value, public class WebViewGUI extends Activity {. CWE-451: User Interface (UI) Misrepresentation of Critical Information. may be visually equivalent) in a way that causes the human user to misread the text (for example, to conduct phishing attacks to trick a user into visiting a malicious web site with a visually-similar name as a trusted site). updated Applicable_Platforms, Description, Maintenance_Notes, Name, Observed_Examples, Other_Notes, References, Relationships, Research_Gaps, updated Observed_Examples, References, Relationships, Type, updated Maintenance_Notes, Observed_Examples. The software contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the software's users or administrators. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. Detail. For example, if the application has permission to send text messages: This malicious script can use the userInfoObject object to load the SmsManager object and send arbitrary text messages to any recipient. In addition, many misrepresentation issues are resultant. As a result this certainly isn't a vulnerability and a CVSS score is simply not applicable. Josh Ferrell (@josh-ferrell) from VMware has reported that a specially crafted ExternalName type Service may be used to access Envoy's admin interface, which Contour normally prevents from access outside the Envoy container.This can be used to shut down Envoy remotely (a denial of service), or to expose the existence of any Secret that Envoy is using for its configuration, including . If it is hidden but not disabled, it can be exposed by physically wiring to the board.By issuing ahaltcommand before the OS starts, the unauthorized user pauses the watchdog timer and prevents the router from .
Workers' Comp For Covid California,
Haiti Earthquake 2021 Cause,
Types Of Serological Tests Pdf,
Iceland Covid Vaccine Type,
Error: Error 1 Occurred Creating Conda Environment R-reticulate,
Primary Care Physician Pasadena,
Gammon Steak With Pineapple And Egg,
St Bernard Dog Breeders Near Hong Kong,
Job Dissatisfaction Examples,
Women's Doubles Us Open 2021 Schedule,