CWE-269

{
  "affected": [],
  "aliases": [
    "CVE-2020-1395"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-07-14T23:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An elevation of privilege vulnerability exists in the way that the Windows Speech Brokered API handles objects in memory, aka \u0027Windows Elevation of Privilege Vulnerability\u0027. This CVE ID is unique from CVE-2020-1388, CVE-2020-1392, CVE-2020-1394.",
  "id": "GHSA-wm5p-263x-pww3",
  "modified": "2022-05-24T17:23:04Z",
  "published": "2022-05-24T17:23:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1395"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1395"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-1425"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-04T16:15:36Z",
    "severity": "MODERATE"
  },
  "details": "A Sudo privilege misconfiguration vulnerability in PocketBook InkPad Color 3 on Linux, ARM allows attackers to read file contents on the device.This issue affects InkPad Color 3: U743k3.6.8.3671.",
  "id": "GHSA-wm67-cvpp-xg5f",
  "modified": "2025-03-04T18:33:43Z",
  "published": "2025-03-04T18:33:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1425"
    },
    {
      "type": "WEB",
      "url": "https://www.redguard.ch/blog/2025/03/04/security-advisory-pocketbook-inkpad-color-3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-34338"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-08-01T11:15:00Z",
    "severity": "MODERATE"
  },
  "details": "IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could disclose sensitive information due to improper privilege management for storage provider types. IBM X-Force ID: 229962.",
  "id": "GHSA-wm74-mh49-g5x5",
  "modified": "2022-08-06T00:00:54Z",
  "published": "2022-08-02T00:00:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34338"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/229962"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/6608606"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-53349"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-21T16:15:18Z",
    "severity": "HIGH"
  },
  "details": "Insecure permissions in kuadrant v0.11.3 allow attackers to gain access to the service account\u0027s token, leading to escalation of privileges via the secretes component in the k8s cluster",
  "id": "GHSA-wm78-66mj-jh7h",
  "modified": "2025-03-24T18:30:59Z",
  "published": "2025-03-21T18:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53349"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/HouqiyuA/2a34c8f95dac7d9d8d7df7732403f383"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Kuadrant/kuadrant-operator"
    },
    {
      "type": "WEB",
      "url": "https://www.cncf.io/projects/kuadrant"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-34455"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-16T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "Windows File History Service Elevation of Privilege Vulnerability",
  "id": "GHSA-wm7w-8wm5-6w7j",
  "modified": "2023-12-29T00:30:35Z",
  "published": "2022-05-24T19:08:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34455"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34455"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-16497"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-05-26T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "In Versa Analytics, the cron jobs are used for scheduling tasks by executing commands at specific dates and times on the server. If the job is run as the user root, there is a potential privilege escalation vulnerability. In this case, the job runs a script as root that is writable by users who are members of the versa group.",
  "id": "GHSA-wm88-xgp8-jvpf",
  "modified": "2022-05-24T19:03:18Z",
  "published": "2022-05-24T19:03:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16497"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/1168194"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "hermes-agent"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.11.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-9368"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-526"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-30T15:37:24Z",
    "nvd_published_at": "2026-05-24T09:16:32Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16. This impacts the function execute_code of the file tools/code_execution_tool.py of the component Environment Variable Handler. Such manipulation leads to sandbox issue. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-wm96-9gfh-vvgq",
  "modified": "2026-06-30T15:37:24Z",
  "published": "2026-05-26T13:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9368"
    },
    {
      "type": "WEB",
      "url": "https://github.com/NousResearch/hermes-agent/commit/285bb2b9150b93445e5eded9bc897a4001b66e55"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/YLChen-007/43c72d19668421abe8ce10f299323a0a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/NousResearch/hermes-agent"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/812229"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/365331"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/365331/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "hermes-agent has a sandbox issue"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-21919"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-01-11T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "Windows User Profile Service Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-21895.",
  "id": "GHSA-wmfg-rc3x-58v3",
  "modified": "2025-10-22T00:32:27Z",
  "published": "2022-01-12T00:00:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21919"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21919"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21919"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-21919"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.23.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/fission/fission"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.24.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-50545"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-284",
      "CWE-693"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-30T18:18:05Z",
    "nvd_published_at": "2026-06-10T18:17:12Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\nA stronger framing of the same root cause as GHSA-gx55-f84r-v3r7: the `Environment.spec.runtime.podSpec` / `spec.builder.podSpec` passthrough lacked validation, and `MergePodSpec` propagated dangerous fields into the generated pods.\n\n### Details\n\nThree independent flaws compounded:\n\n1. **Validate gap.** `pkg/apis/core/v1/validation.go::Environment.Validate` checked only container naming conventions, never `hostPID`/`hostIPC`/`hostNetwork`/`hostPath`/`privileged`.\n2. **UPDATE bypass.** The `pkg/webhook/environment.go` kubebuilder marker registered `verbs=create` only. A tenant could `kubectl apply` a clean Environment and then `kubectl patch` in the dangerous fields \u2014 the webhook was never called.\n3. **Merge propagation.** `pkg/executor/util/merge.go::MergePodSpec` unconditionally forwarded `HostPID`, `HostIPC`, `HostNetwork`, `Volumes` (including hostPath), `SecurityContext`, and `ServiceAccountName` into the Deployments\ngenerated by poolmgr / newdeploy / buildermgr.\n\nA `kubectl apply` plus a follow-up `kubectl patch` caused poolmgr to schedule a privileged pod with a host-root mount within roughly 20 seconds. From that pod the cluster CA private key was readable, allowing the attacker to sign\narbitrary kubelet certificates and achieve full cluster takeover.\n\n### Impact\n\n`environments.fission.io` create/update RBAC is escalated to node escape and, via the readable cluster CA key, full cluster takeover.\n\n### Fix\n\nFixed in [#3391](https://github.com/fission/fission/pull/3391) (with the companion buildermgr SA-token fix in [#3390](https://github.com/fission/fission/pull/3390)) and released in\n[v1.24.0](https://github.com/fission/fission/releases/tag/v1.24.0). Each enumerated flaw is addressed:\n\n1. **Validate** \u2014 `ValidatePodSpecSafety` is called from `Environment.Validate` for both `Runtime.PodSpec` and `Builder.PodSpec`.\n2. **UPDATE bypass** \u2014 the webhook marker is extended to `verbs=create;update`; chart and envtest manifests are aligned.\n3. **Merge propagation** \u2014 host namespaces, `ServiceAccountName`, and hostPath volumes are stripped at the merge layer; per-container `privileged`/`allowPrivilegeEscalation` and dangerous capabilities are sanitized.\n\nSee GHSA-gx55-f84r-v3r7 for the detailed fix \u2014 both advisories close to the same commit.\n\n### Duplicate handling\n\nThis advisory and GHSA-gx55-f84r-v3r7 were reported separately but close to the same code fix. Both are published to acknowledge each reporter\u0027s contribution and to keep the public CVE record clear about the multi-layer nature of the\nissue.",
  "id": "GHSA-wmgg-3p4h-48x7",
  "modified": "2026-06-30T18:18:05Z",
  "published": "2026-06-30T18:18:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fission/fission/security/advisories/GHSA-wmgg-3p4h-48x7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50545"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fission/fission/pull/3390"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fission/fission/pull/3391"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fission/fission/commit/8fa799417c77ce8a0189d9858bfe11ece29b84a6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fission/fission/commit/e484df8460bb4e8026e24210120602aa7f181f64"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fission/fission"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fission/fission/releases/tag/v1.24.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-3388"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-10T17:15:57Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the GlobalProtect Gateway in Palo Alto Networks PAN-OS software enables an authenticated attacker to impersonate another user and send network packets to internal assets. However, this vulnerability does not allow the attacker to receive response packets from those internal assets.",
  "id": "GHSA-wmmf-r63x-5jrw",
  "modified": "2024-04-10T18:30:48Z",
  "published": "2024-04-10T18:30:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3388"
    },
    {
      "type": "WEB",
      "url": "https://security.paloaltonetworks.com/CVE-2024-3388"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}