CWE-668

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-web"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "13.1"
            },
            {
              "fixed": "13.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-32731"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-668"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-07-02T16:39:50Z",
    "nvd_published_at": "2021-07-01T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nThe reset password form reveals the email address of users just by giving their username.\n\n### Patches\nThe problem has been patched on XWiki 13.2RC1.\n\n### Workarounds\nIt\u0027s possible to manually modify the `resetpasswordinline.vm` to perform the changes made in https://github.com/xwiki/xwiki-platform/commit/0cf716250b3645a5974c80d8336dcdf885749dff#diff-14a3132e3986b1f5606dd13d9d8a8bb8634bec9932123c5e49e9604cfd850fc2\n\n### References\nhttps://jira.xwiki.org/browse/XWIKI-18400\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki](https://jira.xiwki.org)\n* Email us at [Security ML](mailto:security@xwiki.org)\n",
  "id": "GHSA-h4m4-pgp4-whgm",
  "modified": "2022-10-25T20:25:48Z",
  "published": "2021-07-02T19:19:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h4m4-pgp4-whgm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32731"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/commit/0cf716250b3645a5974c80d8336dcdf885749dff#diff-14a3132e3986b1f5606dd13d9d8a8bb8634bec9932123c5e49e9604cfd850fc2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/xwiki/xwiki-platform"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-18400"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "The reset password form reveal users email address"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-36875"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-668"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-09T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Improper restriction of broadcasting Intent in SaWebViewRelayActivity of?Waterplugin prior to version 2.2.11.22081151 allows attacker to access the file without permission.",
  "id": "GHSA-h57h-9x5h-v7jm",
  "modified": "2022-09-15T00:00:17Z",
  "published": "2022-09-10T00:00:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36875"
    },
    {
      "type": "WEB",
      "url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2022\u0026month=09"
    },
    {
      "type": "WEB",
      "url": "https://security.samsungmobile.com/serviceWeb.smsb?year==2022\u0026month=09"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-53392"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-668"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-18T14:15:42Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: intel-ish-hid: Fix kernel panic during warm reset\n\nDuring warm reset device-\u003efw_client is set to NULL. If a bus driver is\nregistered after this NULL setting and before new firmware clients are\nenumerated by ISHTP, kernel panic will result in the function\nishtp_cl_bus_match(). This is because of reference to\ndevice-\u003efw_client-\u003eprops.protocol_name.\n\nISH firmware after getting successfully loaded, sends a warm reset\nnotification to remove all clients from the bus and sets\ndevice-\u003efw_client to NULL. Until kernel v5.15, all enabled ISHTP kernel\nmodule drivers were loaded right after any of the first ISHTP device was\nregistered, regardless of whether it was a matched or an unmatched\ndevice. This resulted in all drivers getting registered much before the\nwarm reset notification from ISH.\n\nStarting kernel v5.16, this issue got exposed after the change was\nintroduced to load only bus drivers for the respective matching devices.\nIn this scenario, cros_ec_ishtp device and cros_ec_ishtp driver are\nregistered after the warm reset device fw_client NULL setting.\ncros_ec_ishtp driver_register() triggers the callback to\nishtp_cl_bus_match() to match ISHTP driver to the device and causes kernel\npanic in guid_equal() when dereferencing fw_client NULL pointer to get\nprotocol_name.",
  "id": "GHSA-h5fg-gggq-x5vh",
  "modified": "2026-01-27T21:31:33Z",
  "published": "2025-09-18T15:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53392"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/38518593ec55e897abda4b4be77b2ec8ec4447d1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/45b9055a3a3ff6e8c08faad82ea36a8644a81587"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6c8cc40c588f8080a164d88336b1490279e0f1da"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-42749"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-668"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-01-10T14:10:00Z",
    "severity": "MODERATE"
  },
  "details": "In Beaver Themer, attackers can bypass conditional logic controls (for hiding content) when viewing the post archives. Exploitation requires that a Themer layout is applied to the archives, and that the post excerpt field is not set.",
  "id": "GHSA-h5m9-c2h6-x3rp",
  "modified": "2022-01-15T00:03:32Z",
  "published": "2022-01-11T00:01:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42749"
    },
    {
      "type": "WEB",
      "url": "https://docs.wpbeaverbuilder.com/beaver-builder/developer/conditionally-hidden-content"
    },
    {
      "type": "WEB",
      "url": "https://tekfused.com/tek/vulnerability-research/beaver-builder-vulnerabilities-visibility-conditional-logic-cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "Simple-Wayland-HotKey-Daemon"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.1.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-27817"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-668"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-04-26T13:04:22Z",
    "nvd_published_at": "2022-04-14T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "SWHKD 1.1.5 consumes the keyboard events of unintended users. This could potentially cause an information leak, but is usually a denial of functionality.",
  "id": "GHSA-h5wh-7h2j-h999",
  "modified": "2022-04-26T13:04:22Z",
  "published": "2022-04-15T00:00:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27817"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/waycrate/swhkd"
    },
    {
      "type": "WEB",
      "url": "https://github.com/waycrate/swhkd/releases"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2022/04/14/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Exposure of Resource to Wrong Sphere in Simple-Wayland-HotKey-Daemon"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-37601"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-668"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-30T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat room) in some common configurations.",
  "id": "GHSA-h6g2-mc2x-j8wm",
  "modified": "2022-07-13T00:01:34Z",
  "published": "2022-05-24T19:09:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37601"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BZRRPCNOETB4MN4XSYPRBBKDIHO27DY"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EMKIOEP2CYWHVVUCNWISPE4AGH4IR7O2"
    },
    {
      "type": "WEB",
      "url": "https://prosody.im"
    },
    {
      "type": "WEB",
      "url": "https://prosody.im/security/advisory_20210722"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2021/07/28/4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-52543"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-378",
      "CWE-668"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-25T16:15:22Z",
    "severity": "MODERATE"
  },
  "details": "Dell NativeEdge, version(s) 2.1.0.0, contain(s) a Creation of Temporary File With Insecure Permissions vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.",
  "id": "GHSA-h732-87v7-7449",
  "modified": "2024-12-25T18:30:45Z",
  "published": "2024-12-25T18:30:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52543"
    },
    {
      "type": "WEB",
      "url": "https://www.dell.com/support/kbdoc/en-us/000258904/dsa-2024-488-security-update-for-dell-nativeedge-multiple-vulnerabilities"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.11.6"
      },
      "package": {
        "ecosystem": "npm",
        "name": "vm2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.11.3"
            },
            {
              "fixed": "3.11.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-92940"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-668"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-01T15:38:26Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "Summary\n\nvm2 3.11.6 exposes the host process\u0027s real `https.globalAgent` when a `NodeVM` is explicitly allowed to require `https`. The module is wrapped as read-only, but calls to methods on the shared agent still mutate the host object. Sandbox code can register a `free` listener and receive host request options and the host TLS socket whenever an unrelated host HTTPS request releases a pooled connection.\n\nIn a contained test, sandbox code allowed only the `https` builtin:\n\n- read the host request\u0027s bearer token from the agent event;\n- attached a data listener to the released host TLS socket and read the next host response body in plaintext;\n- learned the private service host and port;\n- sent an attacker-chosen authenticated POST using the stolen host token; and\n- received confirmation that the service accepted the action.\n\nThe host application never passed its credentials, request, response, socket, or destination into the sandbox. They crossed the boundary solely because vm2 exposes the process-global HTTPS agent instead of a sandbox-local network module instance.\n\n### Details\n\nThe vulnerable boundary is the default builtin loader in `lib/builtin.js`:\n\n```js\nbuiltins.set(key, special ? special : vm =\u003e vm.readonly(hostRequire(key)));\n```\n\nThe wrapper recursively exposes properties of the actual host module. For ordinary constants, a read-only proxy can be sufficient. It is not sufficient for process-global EventEmitter objects whose methods mutate internal state.\n\n`https.globalAgent` is the default agent used by host HTTPS requests when the host does not supply a separate `agent`. The agent is shared by the entire Node.js thread. Its `free` event supplies both:\n\n- the `TLSSocket` that has just completed a request and is available for reuse; and\n- the connection/request options used to place that socket in the pool.\n\nThe following sandbox code registers directly on that host singleton:\n\n```js\nconst https = require(\u0027https\u0027);\n\nhttps.globalAgent.on(\u0027free\u0027, (socket, options) =\u003e {\n  const token = options.headers.Authorization;\n  const destination = {host: options.host, port: options.port};\n\n  socket.on(\u0027data\u0027, chunk =\u003e {\n    capturedHostTraffic += chunk.toString(\u0027utf8\u0027);\n  });\n\n  const req = https.request({\n    hostname: destination.host,\n    port: destination.port,\n    path: \u0027/sandbox-action\u0027,\n    method: \u0027POST\u0027,\n    headers: {Authorization: token},\n    agent: false,\n  });\n  req.end(attackerChosenBody);\n});\n```\n\nCalling `.on()` is not a property assignment, so the read-only handler forwards it to the real host Agent. When the host later emits `free`, vm2 invokes the sandbox callback with bridged views of the live options and socket. Reading nested header values succeeds. Calling `socket.on()` also forwards to the real socket, letting the sandbox observe the decrypted bytes emitted during a later request on that connection.\n\nThe complete exploit flow is:\n\n```text\nattacker-controlled NodeVM program with https allowed\n  -\u003e subscribe to the real host https.globalAgent\n  -\u003e unrelated host HTTPS request completes\n  -\u003e shared Agent emits live socket and request options into sandbox callback\n  -\u003e sandbox reads host Authorization token and private destination\n  -\u003e sandbox attaches to the released TLSSocket\n  -\u003e next host response is exposed in plaintext\n  -\u003e sandbox reuses stolen token for attacker-chosen authenticated request\n```\n\nThis is a distinct residual of the same process-wide observability class for which other host builtins are rejected. The current dangerous-builtin filter does not classify `https` as process-global because the module also has legitimate sandbox network APIs. A safe implementation must avoid exposing the host singleton, such as by providing a sandbox-local module facade and sandbox-local Agent.\n\n### PoC\n\nThe attached PoC uses only a temporary certificate and a loopback HTTPS server.\n\n1. Install Node.js and OpenSSL.\n2. In the attached `poc` directory, run:\n\n   ```bash\n   npm install --ignore-scripts\n   node poc.js\n   ```\n\n3. A vulnerable result includes all of the following markers:\n\n   - leaked host token: `Bearer VM2_HOST_AUTHORIZATION_f7952a`;\n   - captured host response: `VM2_PRIVATE_HOST_RESPONSE_47b2d6`;\n   - attacker-chosen authenticated action: `VM2_SANDBOX_ACTION_8d14c3`;\n   - server decision: `ACTION_ACCEPTED`.\n\nThe first host request carries the token. After it completes, the sandbox callback receives the token and independently sends the action request. The second host request reuses the pooled TLS connection; the sandbox\u0027s listener reads that response from the live socket. The PoC fails unless both confidentiality and integrity effects occur.\n\n### Impact\n\nThis is cross-boundary exposure and misuse of a process-global authenticated network resource.\n\nAn attacker who can submit code to a `NodeVM` with `https` allowed can, when the host uses the default HTTPS agent:\n\n- steal Authorization, Cookie, API-key, proxy-authorization, and other sensitive request options;\n- discover private service hostnames and ports used only by host code;\n- read plaintext response headers and bodies on reused TLS connections;\n- steal client-certificate, private-key, passphrase, CA, or session-related options when the host supplies them through request options;\n- perform authenticated actions using stolen bearer credentials;\n- write to or destroy live host sockets, disrupting or corrupting unrelated traffic;\n- cross tenant boundaries when multiple sandboxes and host workloads share one process.\n\nThe sandbox already has the intentional ability to make its own HTTPS requests. It does not intentionally have authority to observe or reuse the host application\u0027s credentials and connections. A host that always supplies a separate private Agent for every sensitive request avoids this specific singleton, but that is not the default behavior.",
  "id": "GHSA-h85j-hv3c-qfgq",
  "modified": "2026-10-01T15:38:26Z",
  "published": "2026-10-01T15:38:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-h85j-hv3c-qfgq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92940"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/commit/aa146a77f859325e079f3bfbfe6d8309af483daa"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/patriksimek/vm2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/releases/tag/v3.11.7"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/vm2-3.11.3-through-3.11.6-https-credential-exposure-via-globalagent"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vm2 exposes host HTTPS credentials and TLS traffic through globalAgent"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-45421"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-668"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-02-14T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "** UNSUPPORTED WHEN ASSIGNED ** Emerson Dixell XWEB-500 products are affected by information disclosure via directory listing. A potential attacker can use this misconfiguration to access all the files in the remote directories. Note: the product has not been supported since 2018 and should be removed or replaced.",
  "id": "GHSA-h872-jxr7-q7rj",
  "modified": "2023-08-08T15:31:43Z",
  "published": "2022-02-15T00:02:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45421"
    },
    {
      "type": "WEB",
      "url": "https://www.swascan.com/emerson"
    },
    {
      "type": "WEB",
      "url": "http://dixell.com"
    },
    {
      "type": "WEB",
      "url": "http://emerson.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-2857"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-668"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-27T14:15:55Z",
    "severity": "CRITICAL"
  },
  "details": "Following the sandbox escape in CVE-2025-2783, various Firefox developers identified a similar pattern in our IPC code. Attackers were able to confuse the parent process into leaking handles to unprivileged child processes leading to a sandbox escape. \nThe original vulnerability was being exploited in the wild. \n*This only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox \u003c 136.0.4, Firefox ESR \u003c 128.8.1, and Firefox ESR \u003c 115.21.1.",
  "id": "GHSA-h8g5-2596-xjh9",
  "modified": "2025-03-28T18:33:09Z",
  "published": "2025-03-27T15:31:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2857"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1956398"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/405143032"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-2783"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-19"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}