Common Weakness Enumeration

CWE-269

Discouraged

Improper Privilege Management

Abstraction: Class · Status: Draft

API response cwe.mitre.org

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

6487 vulnerabilities reference this CWE, most recent first.

GHSA-VR2G-RHM5-Q4JR

Vulnerability from github – Published: 2026-04-03 04:00 – Updated: 2026-05-05 18:48
VLAI
Summary
CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Details

Summary

Vulnerability 1: Stored DOM XSS via Profile Name Update (Persistent Payload Injection)

  • Stored Cross-Site Scripting via Unsanitized User Name in Profile Management

Description

The application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side.

This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS).

Affected Functionality

  • Profile name / full name update functionality (both the 2 user inputs)
  • User profile storage and retrieval logic

Attack Scenario

  • An attacker updates their profile name to include a malicious XSS payload.
  • The application stores this value without sanitization or encoding.
  • The payload persists and executes whenever the name is rendered in affected views.

Impact

  • Persistent Stored XSS
  • Execution of arbitrary JavaScript in victims’ browsers
  • Foundation for privilege escalation and account takeover when viewed by privileged users & normal ones across blogs and public facing pages that show user profiles full names

Endpoint: /backend/users/profile/

Vulnerability 2: Stored XSS via User Name Rendering Across Multiple Endpoints (Privilege Escalation)

(Required for the chain) - Stored XSS via Unsafe Rendering of User Names Across Administrative and Public Interfaces

Description

User-controlled profile fields (specifically the username / full name) are rendered unsafely across multiple application endpoints, including administrative and content-related interfaces. The application fails to apply proper output encoding when displaying these values.

When an administrator accesses affected pages, the stored XSS payload executes in the administrator’s browser context, resulting in administrative privilege escalation and potential full admin account takeover.

This issue is not limited to a single endpoint and affects all areas where the username is rendered, including but not limited to: - User management interfaces - Blog pages - Other content or UI components displaying usernames

Attack Scenario

  • Attacker injects a malicious payload via the profile name update functionality.
  • The payload is stored persistently.
  • An administrator views the user management page or any affected interface.
  • The payload executes automatically in the admin’s browser.
  • Attacker hijacks the admin session, performs privileged actions, or fully compromises the admin account.

Impact

  • Stored XSS
  • Administrative privilege escalation
  • Full admin account takeover (including other roles)
  • Full compromise of the entire application

Endpoint Example: /backend/users/ of User Management Page

Steps To Reproduce (POC)

  1. Go to Profile Management page of the User
  2. In the 2 user inputs of the Full Name, put in any field of them a XSS Payload such as: <img src=x onerror=alert(document.domain)>
  3. Save the edit
  4. Go to User Management page as an Admin or any other role
  5. Notice the XSS alert popping up that confirms it
  6. Other endpoints aswell can execute such as blogs in the public facing one

Recommended Remediation

  1. Eliminate Unsafe DOM Sinks: Remove all usage of .html(), innerHTML, and similar unsafe DOM manipulation methods throughout the application. These sinks should be replaced with safe alternatives such as .text() or textContent, which do not interpret HTML markup.

  2. Implement Output Encoding: Apply context-appropriate HTML entity encoding to all user-controlled data before rendering it in the DOM. This ensures that any special characters (e.g., <, >, ", ') are rendered as literal text rather than interpreted as executable markup.

  3. Implement Server-Side Input Sanitization: Enforce strict input validation and sanitization on all user-controlled fields — particularly the profile name fields — at the server level before storing values in the database. Currently, no sanitization is applied to these inputs.

  4. Apply Defense in Depth: Even in cases where user input does not appear to flow directly into a dangerous sink, it should still be treated as untrusted. Attackers can and will leverage indirect data flows to exploit the application. A layered approach combining input validation, output encoding, and Content Security Policy (CSP) headers is strongly recommended.

Ready Video POC:

https://mega.nz/file/iEVEyT4Y#f046o6ZwYBfS1kK0HNKOCFm6tL_8_SbLtWWKC1hYC4M

Severity
9.0 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
9.4 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.28.6.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "ci4-cms-erp/ci4ms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "31.0.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34989"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-03T04:00:57Z",
    "nvd_published_at": "2026-04-06T17:17:12Z",
    "severity": "CRITICAL"
  },
  "details": "## Summary\n### **Vulnerability 1: Stored DOM XSS via Profile Name Update (Persistent Payload Injection)**\n- Stored Cross-Site Scripting via Unsanitized User Name in Profile Management\n\n### Description\nThe application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side.\n\nThis stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS).\n\n### Affected Functionality\n- Profile name / full name update functionality (both the 2 user inputs)\n- User profile storage and retrieval logic\n\n### Attack Scenario\n- An attacker updates their profile name to include a malicious XSS payload.\n- The application stores this value without sanitization or encoding.\n- The payload persists and executes whenever the name is rendered in affected views.\n\n### Impact\n- Persistent Stored XSS\n- Execution of arbitrary JavaScript in victims\u2019 browsers\n- Foundation for privilege escalation and account takeover when viewed by privileged users \u0026 normal ones across blogs and public facing pages that show user profiles full names\n\nEndpoint: `/backend/users/profile/`\n\n### **Vulnerability 2: Stored XSS via User Name Rendering Across Multiple Endpoints (Privilege Escalation)**\n(Required for the chain)\n- Stored XSS via Unsafe Rendering of User Names Across Administrative and Public Interfaces\n\n### Description\nUser-controlled profile fields (specifically the username / full name) are rendered unsafely across multiple application endpoints, including administrative and content-related interfaces. The application fails to apply proper output encoding when displaying these values.\n\nWhen an administrator accesses affected pages, the stored XSS payload executes in the administrator\u2019s browser context, resulting in administrative privilege escalation and potential full admin account takeover.\n\nThis issue is not limited to a single endpoint and affects all areas where the username is rendered, including but not limited to:\n- User management interfaces\n- Blog pages\n- Other content or UI components displaying usernames\n\n### Attack Scenario\n- Attacker injects a malicious payload via the profile name update functionality.\n- The payload is stored persistently.\n- An administrator views the user management page or any affected interface.\n- The payload executes automatically in the admin\u2019s browser.\n- Attacker hijacks the admin session, performs privileged actions, or fully compromises the admin account.\n\n### Impact\n- Stored XSS\n- Administrative privilege escalation\n- Full admin account takeover (including other roles)\n- Full compromise of the entire application\n\nEndpoint Example: `/backend/users/` of User Management Page\n\n## Steps To Reproduce (POC)\n1. Go to Profile Management page of the User\n2. In the 2 user inputs of the Full Name, put in any field of them a XSS Payload such as:\n`\u003cimg src=x onerror=alert(document.domain)\u003e`\n3. Save the edit\n4. Go to User Management page as an Admin or any other role\n5. Notice the XSS alert popping up that confirms it\n6. Other endpoints aswell can execute such as blogs in the public facing one \n\n### Recommended Remediation\n\n1. **Eliminate Unsafe DOM Sinks:** Remove all usage of `.html()`, `innerHTML`, and similar unsafe DOM manipulation methods throughout the application. These sinks should be replaced with safe alternatives such as `.text()` or `textContent`, which do not interpret HTML markup.\n\n2. **Implement Output Encoding:** Apply context-appropriate HTML entity encoding to all user-controlled data before rendering it in the DOM. This ensures that any special characters (e.g., `\u003c`, `\u003e`, `\"`, `\u0027`) are rendered as literal text rather than interpreted as executable markup.\n\n3. **Implement Server-Side Input Sanitization:** Enforce strict input validation and sanitization on all user-controlled fields \u2014 particularly the profile name fields \u2014 at the server level before storing values in the database. Currently, no sanitization is applied to these inputs.\n\n4. **Apply Defense in Depth:** Even in cases where user input does not appear to flow directly into a dangerous sink, it should still be treated as untrusted. Attackers can and will leverage indirect data flows to exploit the application. A layered approach combining input validation, output encoding, and Content Security Policy (CSP) headers is strongly recommended.\n# Ready Video POC:\nhttps://mega.nz/file/iEVEyT4Y#f046o6ZwYBfS1kK0HNKOCFm6tL_8_SbLtWWKC1hYC4M",
  "id": "GHSA-vr2g-rhm5-q4jr",
  "modified": "2026-05-05T18:48:46Z",
  "published": "2026-04-03T04:00:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-vr2g-rhm5-q4jr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34989"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ci4-cms-erp/ci4ms"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "CI4MS: Profile \u0026 User Management Full Account Takeover for All-Roles \u0026 Privilege-Escalation via Stored DOM XSS"
}

GHSA-VR33-265G-QGJ3

Vulnerability from github – Published: 2022-12-05 15:30 – Updated: 2022-12-06 21:30
VLAI
Details

In Wi-Fi, there is a possible memory access violation due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07441637; Issue ID: ALPS07441637.

Severity
6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-32633"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-05T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In Wi-Fi, there is a possible memory access violation due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07441637; Issue ID: ALPS07441637.",
  "id": "GHSA-vr33-265g-qgj3",
  "modified": "2022-12-06T21:30:46Z",
  "published": "2022-12-05T15:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32633"
    },
    {
      "type": "WEB",
      "url": "https://corp.mediatek.com/product-security-bulletin/December-2022"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VR53-QRQQ-G8VW

Vulnerability from github – Published: 2026-07-22 00:32 – Updated: 2026-07-22 00:32
VLAI
Details

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform). Supported versions that are affected are 15.0.0.0.0-15.0.1.0.0 and 15.1.0.0.0-15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability can result in takeover of Oracle Communications Billing and Revenue Management. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-61126"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-21T22:18:43Z",
    "severity": "HIGH"
  },
  "details": "Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform).  Supported versions that are affected are 15.0.0.0.0-15.0.1.0.0 and  15.1.0.0.0-15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Billing and Revenue Management. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
  "id": "GHSA-vr53-qrqq-g8vw",
  "modified": "2026-07-22T00:32:17Z",
  "published": "2026-07-22T00:32:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61126"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VR5H-VJ63-Q73M

Vulnerability from github – Published: 2022-05-24 17:32 – Updated: 2022-05-24 17:32
VLAI
Details

An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.3 and iPadOS 13.3. An application may be able to execute arbitrary code with kernel privileges.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-8841"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-10-27T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.3 and iPadOS 13.3. An application may be able to execute arbitrary code with kernel privileges.",
  "id": "GHSA-vr5h-vj63-q73m",
  "modified": "2022-05-24T17:32:26Z",
  "published": "2022-05-24T17:32:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8841"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT210785"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-VR6P-MMXJ-PHM2

Vulnerability from github – Published: 2024-03-13 18:31 – Updated: 2024-03-13 18:31
VLAI
Details

An issue in the Palo Alto Networks GlobalProtect app enables a non-privileged user to disable the GlobalProtect app in configurations that allow a user to disable GlobalProtect with a passcode.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-2431"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-13T18:15:08Z",
    "severity": "MODERATE"
  },
  "details": "An issue in the Palo Alto Networks GlobalProtect app enables a non-privileged user to disable the GlobalProtect app in configurations that allow a user to disable GlobalProtect with a passcode.",
  "id": "GHSA-vr6p-mmxj-phm2",
  "modified": "2024-03-13T18:31:36Z",
  "published": "2024-03-13T18:31:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2431"
    },
    {
      "type": "WEB",
      "url": "https://security.paloaltonetworks.com/CVE-2024-2431"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VRC8-R74G-RHJV

Vulnerability from github – Published: 2026-07-22 00:32 – Updated: 2026-07-22 00:32
VLAI
Details

Vulnerability in the Oracle Advanced Collections product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Collections. Successful attacks of this vulnerability can result in takeover of Oracle Advanced Collections. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-60989"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-21T22:18:32Z",
    "severity": "HIGH"
  },
  "details": "Vulnerability in the Oracle Advanced Collections product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Collections.  Successful attacks of this vulnerability can result in takeover of Oracle Advanced Collections. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
  "id": "GHSA-vrc8-r74g-rhjv",
  "modified": "2026-07-22T00:32:09Z",
  "published": "2026-07-22T00:32:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60989"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VRG4-FFX9-CFHG

Vulnerability from github – Published: 2026-08-02 06:30 – Updated: 2026-08-05 18:31
VLAI
Details

The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new administrator account and take over the site.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-16256"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-02T06:16:39Z",
    "severity": "CRITICAL"
  },
  "details": "The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new administrator account and take over the site.",
  "id": "GHSA-vrg4-ffx9-cfhg",
  "modified": "2026-08-05T18:31:28Z",
  "published": "2026-08-02T06:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16256"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/c7442f47-7263-4cbb-8157-a4ac69953c95"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VRHW-9HF2-47JC

Vulnerability from github – Published: 2026-09-15 15:32 – Updated: 2026-09-16 15:30
VLAI
Details

Privilege escalation in the Session Restore component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-92062"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-15T13:17:00Z",
    "severity": "HIGH"
  },
  "details": "Privilege escalation in the Session Restore component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.",
  "id": "GHSA-vrhw-9hf2-47jc",
  "modified": "2026-09-16T15:30:55Z",
  "published": "2026-09-15T15:32:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92062"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2054670"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2026-90"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2026-93"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2026-94"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2026-96"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VRMR-FJXH-FM4G

Vulnerability from github – Published: 2022-05-24 17:30 – Updated: 2022-05-24 17:30
VLAI
Details

Faulkner Wildlife Issues in the New Millennium 18.0.160 on Windows allows local, low-privileged users to gain privileges by creating a malicious "%SYSTEMDRIVE%\Course Software Material 18.0.1.9\cmd.exe" file.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-26894"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-10-08T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "Faulkner Wildlife Issues in the New Millennium 18.0.160 on Windows allows local, low-privileged users to gain privileges by creating a malicious \"%SYSTEMDRIVE%\\Course Software Material 18.0.1.9\\cmd.exe\" file.",
  "id": "GHSA-vrmr-fjxh-fm4g",
  "modified": "2022-05-24T17:30:21Z",
  "published": "2022-05-24T17:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26894"
    },
    {
      "type": "WEB",
      "url": "https://github.com/livecode/livecode/pull/7454"
    },
    {
      "type": "WEB",
      "url": "https://john-woodman.com/posts/LiveCode-Privilege-Escalation-Vulnerability"
    },
    {
      "type": "WEB",
      "url": "https://john-woodman.com/posts/Privilege-Escalation-Vulnerability-Faulkner-Press"
    },
    {
      "type": "WEB",
      "url": "https://quality.livecode.com/show_bug.cgi?id=22942"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-VRR3-M9RH-W6RG

Vulnerability from github – Published: 2022-05-24 16:44 – Updated: 2023-02-03 15:31
VLAI
Details

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 could allow an authenticated user to view process definition of a business process without permission. IBM X-Force ID: 159231.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-4222"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-04-25T15:29:00Z",
    "severity": "MODERATE"
  },
  "details": "IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 could allow an authenticated user to view process definition of a business process without permission. IBM X-Force ID: 159231.",
  "id": "GHSA-vrr3-m9rh-w6rg",
  "modified": "2023-02-03T15:31:18Z",
  "published": "2022-05-24T16:44:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-4222"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/159231"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/docview.wss?uid=ibm10880595"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/108110"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation MIT-1
Architecture and Design Operation

Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

Mitigation MIT-48
Architecture and Design

Strategy: Separation of Privilege

Follow the principle of least privilege when assigning access rights to entities in a software system.

Mitigation MIT-49
Architecture and Design

Strategy: Separation of Privilege

Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

CAPEC-122: Privilege Abuse

An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.

CAPEC-233: Privilege Escalation

An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.

CAPEC-58: Restful Privilege Elevation

An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.

← Back to the CWE list