CWE-767
Access to Critical Private Variable via Public Method
Description
The product defines a public method that reads or modifies a private variable.
Hierarchy (View 1000)
Parents
Children
none
CVEs mapped to this weakness (4)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-8380 | Hig | 0.51 | 7.3 | 0.11 | Apr 5, 2018 | The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication. | ||
| CVE-2020-26868 | Hig | 0.49 | 7.5 | 0.02 | Oct 12, 2020 | ARC Informatique PcVue prior to version 12.0.17 is vulnerable to a denial-of-service attack due to the ability of an unauthorized user to modify information used to validate messages sent by legitimate web clients. This issue also affects third-party systems based on the Web… | ||
| CVE-2024-36463 | Med | 0.42 | 6.5 | 0.01 | Nov 26, 2024 | The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects. | ||
| CVE-2024-34162 | Med | 0.35 | 5.3 | 0.01 | Nov 26, 2024 | The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP authentication to "SIMPLE", the device communicates with the LDAP server in clear-text. The LDAP password can be retrieved from this clear-text… |
- risk 0.51cvss 7.3epss 0.11
The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication.
- risk 0.49cvss 7.5epss 0.02
ARC Informatique PcVue prior to version 12.0.17 is vulnerable to a denial-of-service attack due to the ability of an unauthorized user to modify information used to validate messages sent by legitimate web clients. This issue also affects third-party systems based on the Web…
- risk 0.42cvss 6.5epss 0.01
The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects.
- risk 0.35cvss 5.3epss 0.01
The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP authentication to "SIMPLE", the device communicates with the LDAP server in clear-text. The LDAP password can be retrieved from this clear-text…