CWE-863

{
  "affected": [],
  "aliases": [
    "CVE-2024-1156"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-276",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-20T15:15:09Z",
    "severity": "HIGH"
  },
  "details": "Incorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated user to read RabbitMQ configuration information and potentially enable escalation of privileges.",
  "id": "GHSA-ccq4-9qhm-55xx",
  "modified": "2024-02-20T15:31:06Z",
  "published": "2024-02-20T15:31:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1156"
    },
    {
      "type": "WEB",
      "url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-elixir-based-service.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-32213"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-03T00:16:04Z",
    "severity": "CRITICAL"
  },
  "details": "Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.",
  "id": "GHSA-ccr7-c63m-8vgm",
  "modified": "2026-04-03T00:31:09Z",
  "published": "2026-04-03T00:31:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32213"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32213"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-41091"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-11-09T22:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Windows Mark of the Web Security Feature Bypass Vulnerability. This CVE ID is unique from CVE-2022-41049.",
  "id": "GHSA-ccv7-v4mw-3wqq",
  "modified": "2025-10-22T00:32:37Z",
  "published": "2022-11-10T12:01:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41091"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41091"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41091"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41091"
    },
    {
      "type": "WEB",
      "url": "https://www.secpod.com/blog/microsoft-november-2022-patch-tuesday-patches-65-vulnerabilities-including-6-zero-days"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-29270"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-29T01:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In Nagios XI through 5.8.5, it is possible for a user without password verification to change his e-mail address.",
  "id": "GHSA-ccw8-4g6w-j73q",
  "modified": "2022-07-09T00:00:26Z",
  "published": "2022-06-30T00:00:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29270"
    },
    {
      "type": "WEB",
      "url": "https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT"
    },
    {
      "type": "WEB",
      "url": "https://github.com/4LPH4-NL/CVEs"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sT0wn-nl/CVEs/blob/master/README.md#nagios-xi"
    },
    {
      "type": "WEB",
      "url": "https://www.nagios.com/downloads/nagios-xi/change-log"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-20877"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-05-12T21:15:09Z",
    "severity": "HIGH"
  },
  "details": "VMware Aria Operations contains a privilege escalation vulnerability. An authenticated malicious user with ReadOnly privileges can perform code execution leading to privilege escalation.",
  "id": "GHSA-ccx6-6vgf-c5rw",
  "modified": "2024-04-04T04:04:34Z",
  "published": "2023-05-12T21:30:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20877"
    },
    {
      "type": "WEB",
      "url": "https://www.vmware.com/security/advisories/VMSA-2023-0009.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.5.0b3.dev99"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "pyload-ng"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.0b3.dev100"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42312"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295",
      "CWE-306",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-04T22:07:24Z",
    "nvd_published_at": "2026-05-11T18:16:34Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe `set_config_value()` API method (`@permission(Perms.SETTINGS)`) in `src/pyload/core/api/__init__.py` gates security-sensitive options behind a hand-maintained allowlist `ADMIN_ONLY_CORE_OPTIONS`. The option `(\"general\", \"ssl_verify\")` is **not** on that allowlist. Any authenticated user with the non-admin `SETTINGS` permission can set `general.ssl_verify = off`, and every subsequent outbound pycurl request is made with `SSL_VERIFYPEER=0` and `SSL_VERIFYHOST=0` \u2014 TLS peer and hostname verification are fully disabled. An on-path attacker can then present forged certificates for any hostname pyload fetches.\n\nThis is a direct continuation of the fix family CVE-2026-33509 / CVE-2026-35463 / CVE-2026-35464 / CVE-2026-35586, each of which patched a different missed option in the same allowlist.\n\n### Details\n\n**Writer** \u2014 `src/pyload/core/api/__init__.py`, `set_config_value()` (around lines 215\u2013290). The function is decorated with `@permission(Perms.SETTINGS)` and only rejects writes when `(category, option)` appears in `ADMIN_ONLY_CORE_OPTIONS`:\n\n```python\nADMIN_ONLY_CORE_OPTIONS = {\n    (\"general\", \"storage_folder\"),\n    (\"log\", \"syslog_host\"), (\"log\", \"syslog_port\"),\n    (\"proxy\", \"password\"), (\"proxy\", \"username\"),\n    (\"reconnect\", \"script\"),\n    (\"webui\", \"host\"),\n    (\"webui\", \"ssl_certfile\"), (\"webui\", \"ssl_keyfile\"), (\"webui\", \"ssl_certchain\"),\n    (\"webui\", \"use_ssl\"),\n}\n...\nif (category, option) in ADMIN_ONLY_CORE_OPTIONS and not is_admin:\n    self.pyload.log.error(...); return\nself.pyload.config.set(category, option, value)\n```\n\n`(\"general\", \"ssl_verify\")` is absent. `config.set()` in `src/pyload/core/config/parser.py:329` calls `cast()` which has no branch for enum-string types \u2014 `\"off\"` is stored verbatim and persisted to disk via `self.save()`.\n\n**Reader** \u2014 `src/pyload/core/network/request_factory.py:109-110`:\n\n```python\ndef get_options(self):\n    return {\n        \"interface\": self.iface(),\n        \"proxies\":   self.get_proxies(),\n        \"ipv6\":      self.pyload.config.get(\"download\", \"ipv6\"),\n        \"ssl_verify\": self.pyload.config.get(\"general\", \"ssl_verify\"),\n        ...\n    }\n```\n\n**Sink** \u2014 `src/pyload/core/network/http/http_request.py:193-206`:\n\n```python\nif \"ssl_verify\" in options:\n    aiachaser_on = b\"on (using aia-chaser)\"\n    if options[\"ssl_verify\"] in [True, b\"on\", aiachaser_on]:\n        ...\n        ssl_verify = 1\n    else:\n        ssl_verify = 0\n    self.c.setopt(pycurl.SSL_VERIFYPEER, ssl_verify)\n    self.c.setopt(pycurl.SSL_VERIFYHOST, ssl_verify * 2)\n```\n\nBecause `get_options()` is invoked every time a new pycurl handle is built, the new config value takes effect on the very next outbound request \u2014 no pyload restart required.\n\n### PoC\n\nAuthenticated as any user who has `Perms.SETTINGS` but is **not** admin (e.g. a user with `Role.USER` + the SETTINGS permission bit):\n\n```bash\n# 1) Log in as the SETTINGS (non-admin) user.\ncurl -c cookies.txt -X POST http://pyload.example:8000/api/login \\\n    -d \u0027username=settings_user\u0026password=\u003cpassword\u003e\u0027\n\n# 2) Disable TLS verification for all outbound downloads.\ncurl -b cookies.txt -X POST http://pyload.example:8000/api/setConfigValue \\\n    -d \u0027category=general\u0026option=ssl_verify\u0026value=off\u0026section=core\u0027\n# -\u003e 200 OK. Config persisted.\n\n# 3) Enqueue any HTTPS download. An on-path attacker (shared LAN,\n#    compromised upstream router, DNS hijack, or a malicious proxy\n#    enabled via the sibling advisory on the proxy.* options) can\n#    now present a forged cert for any target \u2014 pyload accepts it.\n```\n\nVerification: observe pycurl `SSL_VERIFYPEER=0` in a debug build, or confirm that a download from an HTTPS endpoint served with a self-signed / mismatched cert succeeds after step 2 and fails before it.\n\n### Impact\n\n- **Who**: any authenticated user whose role was granted `Perms.SETTINGS`. In multi-user pyload deployments that delegate settings administration to non-admins, this is an unintended privilege escalation from \"can change UI/download settings\" to \"can silently disable TLS cert validation for all outbound fetches\".\n- **What**:\n    1. Man-in-the-middle on all HTTPS downloads, captcha fetches, update checks, and plugin HTTP calls.\n    2. Extends the impact of the already-published SSRF chain (CVE-2026-33992 / CVE-2026-35459). The URL-hostname validation those patches added is only meaningful if the TLS channel authenticates the endpoint; with `ssl_verify=off`, an on-path attacker can present forged certs for already-validated hosts \u2014 so HTTPS cloud-metadata endpoints and internal HTTPS services behind the host allowlist become reachable again.\n    3. Silent to the admin. Every adjacent security-critical option (`proxy.password`, SSL certfile/keyfile/certchain, `use_ssl`) is already admin-only, so the admin\u0027s mental model is that TLS policy cannot be weakened by a non-admin.\n- **Not impacted**: unauthenticated attackers; users holding only `DOWNLOAD` / `LIST` roles.",
  "id": "GHSA-ccxc-x975-4hh9",
  "modified": "2026-06-08T19:48:07Z",
  "published": "2026-05-04T22:07:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pyload/pyload/security/advisories/GHSA-ccxc-x975-4hh9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42312"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-4744-96p5-mp2j"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-ppvx-rwh9-7rj7"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-r7mc-x6x7-cqxx"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-w48f-wwwf-f5fr"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pyload/pyload"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyload-ng/PYSEC-2026-126.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification via unrestricted `ssl_verify` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.fabric8.pipeline:kubernetes-pipeline-steps"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-10417"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-183",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-08T22:42:36Z",
    "nvd_published_at": "2019-09-25T16:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Jenkins Kubernetes :: Pipeline :: Kubernetes Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.",
  "id": "GHSA-ccxh-j7hg-m5mr",
  "modified": "2023-07-17T21:18:47Z",
  "published": "2022-05-24T16:56:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10417"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jenkinsci/kubernetes-pipeline-plugin/blob/master/kubernetes-steps"
    },
    {
      "type": "WEB",
      "url": "https://jenkins.io/security/advisory/2019-09-25/#SECURITY-920%20(1)"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2019/09/25/3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Incorrect Authorization in Jenkins Kubernetes :: Pipeline :: Kubernetes Steps Plugin"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.dspace:dspace-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0"
            },
            {
              "fixed": "7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-41189"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-10-29T17:26:35Z",
    "nvd_published_at": "2021-10-29T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nAny community or collection administrator can escalate their permission up to become system administrator.\n\nThis vulnerability only existed in 7.0 and does not impact 6.x or below.\n\n### Patches\nFix is included in [7.1](https://github.com/DSpace/DSpace/releases/tag/dspace-7.1). Please upgrade to 7.1 at your earliest convenience.\n\n### Workarounds\nIn 7.0, temporarily disable the ability for community or collection administrators to manage permissions or workflows settings, i.e. set the following properties in your local.cfg / dspace.cfg file\n```\ncore.authorization.collection-admin.policies = false\ncore.authorization.community-admin.policies = false\ncore.authorization.community-admin.collection.workflows = false\n```\nOnce upgraded to 7.1, these settings can be safely reverted to the default values of `true`.\n\n### References\nDiscovered during investigation of https://github.com/DSpace/DSpace/issues/7928\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at security@dspace.org\n",
  "id": "GHSA-cf2j-vf36-c6w8",
  "modified": "2021-10-29T17:26:35Z",
  "published": "2021-11-01T19:18:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/DSpace/DSpace/security/advisories/GHSA-cf2j-vf36-c6w8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41189"
    },
    {
      "type": "WEB",
      "url": "https://github.com/DSpace/DSpace/issues/7928"
    },
    {
      "type": "WEB",
      "url": "https://github.com/DSpace/DSpace/commit/277b499a5cd3a4f5eb2370513a1b7e4ec2a6e041"
    },
    {
      "type": "WEB",
      "url": "https://github.com/DSpace/DSpace/commit/c3bea16ab911606e15ae96c97a1575e1ffb14f8a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/DSpace/DSpace"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Communities and collections administrators can escalate their privilege up to system administrator"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-41049"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-303",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-22T16:16:35Z",
    "severity": "HIGH"
  },
  "details": "Incorrect caching of authentication between different users of the\u00a0 qSnapper dbus service before version 1.3.3 allowed any local attacker to use dbus functions after a privileged users has authenticated for them.",
  "id": "GHSA-cf66-c678-24r2",
  "modified": "2026-07-08T09:31:46Z",
  "published": "2026-06-22T18:34:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41049"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1262218"
    },
    {
      "type": "WEB",
      "url": "https://github.com/presire/qSnapper/releases/tag/v1.3.3"
    },
    {
      "type": "WEB",
      "url": "https://security.opensuse.org/2026/05/26/qsnapper-dbus-issues.html#issue-auth-caching"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-23256"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-04T16:15:33Z",
    "severity": "HIGH"
  },
  "details": "NVIDIA BlueField contains a vulnerability in the management interface, where an attacker with local access could cause incorrect authorization to modify the configuration. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, and data tampering.",
  "id": "GHSA-cf8m-72r3-jm23",
  "modified": "2025-09-05T18:31:14Z",
  "published": "2025-09-05T18:31:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23256"
    },
    {
      "type": "WEB",
      "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5655"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-23256"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}