Common Weakness Enumeration

CWE-15

Allowed

External Control of System or Configuration Setting

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

One or more system settings or configuration elements can be externally controlled by a user.

145 vulnerabilities reference this CWE, most recent first.

GHSA-4WCF-X7XM-RW82

Vulnerability from github – Published: 2022-05-24 19:18 – Updated: 2022-05-24 19:18
VLAI
Details

Some API functions allow interaction with the registry, which includes reading values as well as data modification.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-38453"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-15"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-10-22T12:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Some API functions allow interaction with the registry, which includes reading values as well as data modification.",
  "id": "GHSA-4wcf-x7xm-rw82",
  "modified": "2022-05-24T19:18:40Z",
  "published": "2022-05-24T19:18:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38453"
    },
    {
      "type": "WEB",
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-292-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-5429-V87Q-PG8H

Vulnerability from github – Published: 2026-01-13 03:32 – Updated: 2026-01-13 03:32
VLAI
Details

SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arbitrary emails which could enable effective phishing campaigns. This has low impact on confidentiality, integrity and availability of the application.

Severity
5.1 (Medium)
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-0495"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-15"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-13T02:15:51Z",
    "severity": "MODERATE"
  },
  "details": "SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges  to send uploaded files to arbitrary emails which could enable effective phishing campaigns. This has low impact on confidentiality, integrity and availability of the application.",
  "id": "GHSA-5429-v87q-pg8h",
  "modified": "2026-01-13T03:32:08Z",
  "published": "2026-01-13T03:32:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0495"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3565506"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-583G-G682-CRXF

Vulnerability from github – Published: 2024-02-09 15:19 – Updated: 2024-02-09 15:19
VLAI
Summary
Micronaut management endpoints vulnerable to drive-by localhost attack
Details

Summary

Enabled but unsecured management endpoints are susceptible to drive-by localhost attacks. While not typical of a production application, these attacks may have more impact on a development environment where such endpoints may be flipped on without much thought.

Details

A malicious/compromised website can make HTTP requests to localhost. Normally, such requests would trigger a CORS preflight check which would prevent the request; however, some requests are "simple" and do not require a preflight check. These endpoints, if enabled and not secured, are vulnerable to being triggered.

Impact

Production environments typically disable unused endpoints and secure/restrict access to needed endpoints. A more likely victim is the developer in their local development host, who has enabled endpoints without security for the sake of easing development.

Severity
5.1 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.micronaut:micronaut-http-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.8.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.micronaut:micronaut-http-server-netty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.8.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.micronaut:micronaut-http-server-tck"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.8.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-23639"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-15",
      "CWE-610",
      "CWE-664"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-09T15:19:15Z",
    "nvd_published_at": "2024-02-09T01:15:09Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nEnabled but unsecured management endpoints are susceptible to drive-by localhost attacks. While not typical of a production application, these attacks may have more impact on a development environment where such endpoints may be flipped on without much thought.\n\n### Details\nA malicious/compromised website can make HTTP requests to `localhost`. Normally, such requests would trigger a CORS preflight check which would prevent the request; however, some requests are [\"simple\"](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests) and do not require a preflight check. These endpoints, if enabled and not secured, are vulnerable to being triggered.\n\n### Impact\nProduction environments typically disable unused endpoints and secure/restrict access to needed endpoints. A more likely victim is the developer in their local development host, who has enabled endpoints without security for the sake of easing development.\n",
  "id": "GHSA-583g-g682-crxf",
  "modified": "2024-02-09T15:19:15Z",
  "published": "2024-02-09T15:19:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-583g-g682-crxf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23639"
    },
    {
      "type": "WEB",
      "url": "https://github.com/micronaut-projects/micronaut-core/pull/8642"
    },
    {
      "type": "WEB",
      "url": "https://github.com/micronaut-projects/micronaut-core/commit/01adb21e57137caaf7004313d2055c5a78b1f47b"
    },
    {
      "type": "WEB",
      "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/micronaut-projects/micronaut-core"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Micronaut management endpoints vulnerable to drive-by localhost attack"
}

GHSA-5CPH-WVM9-45GJ

Vulnerability from github – Published: 2024-11-21 22:21 – Updated: 2024-11-21 22:21
VLAI
Summary
Flowise OverrideConfig security vulnerability
Details

Impact

Flowise allows developers to inject configuration into the Chainflow during execution through the overrideConfig option. This is supported in both the frontend web integration and the backend Prediction API.

This has a range of fundamental issues that are a major security vulnerability. While this feature is intentional, it should have strong protections added and be disabled by default.

These issues include: 1. Remote code execution. While inside a sandbox this allows for 1. Sandbox escape 2. DoS by crashing the server 3. SSRF 2. Prompt Injection, both System and User 1. Full control over LLM prompts 2. Server variable and data exfiltration And many many more such as altering the flow of a conversation, prompt exfiltration via LLM proxying etc.

These issues are self-targeted and do not persist to other users but do leave the server and business exposed. All issues are shown with the API but also work with the web embed.

Workarounds

  • overrideConfig should be disabled by default
  • overrideConfig should have an explicit allow list of variables that are allowed to be modified. This way the user opts-in to where modifications can be made.
  • vm2 and any forks of it should be removed as in the authors own words, "fixing the vulnerability seems impossible". The recommended replacement is https://www.npmjs.com/package/isolated-vm
Severity
8.6 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "flowise"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-15"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-21T22:21:03Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\nFlowise allows developers to inject configuration into the Chainflow during execution through the `overrideConfig` option. This is supported in both the frontend web integration and the backend Prediction API. \n\nThis has a range of fundamental issues that are a **major** security vulnerability. \nWhile this feature is intentional, it should have strong protections added and be disabled by default. \n\nThese issues include: \n1. Remote code execution. While inside a sandbox this allows for\n  1. Sandbox escape \n  2. DoS by crashing the server\n  3. SSRF\n2. Prompt Injection, both System and User\n  1. Full control over LLM prompts\n  2. Server variable and data exfiltration\nAnd many many more such as altering the flow of a conversation, prompt exfiltration via LLM proxying etc.\n\nThese issues are self-targeted and do not persist to other users but do leave the server and business exposed. \nAll issues are shown with the API but also work with the web embed.\n\n### Workarounds\n- `overrideConfig` should be disabled by default\n- `overrideConfig` should have an explicit allow list of variables that are allowed to be modified. This way the user opts-in to where modifications can be made. \n- `vm2` and any forks of it should be removed as in the authors own words, \"fixing the vulnerability seems impossible\". The recommended replacement is https://www.npmjs.com/package/isolated-vm",
  "id": "GHSA-5cph-wvm9-45gj",
  "modified": "2024-11-21T22:21:03Z",
  "published": "2024-11-21T22:21:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-5cph-wvm9-45gj"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/FlowiseAI/Flowise"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Flowise OverrideConfig security vulnerability"
}

GHSA-5GQQ-CH9P-4H64

Vulnerability from github – Published: 2026-06-09 18:30 – Updated: 2026-06-18 15:31
VLAI
Details

Insufficient configuration management in the listed devices allows authenticated administrators connected to the local network to tamper with the system.

Severity
4.5 (Medium)
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
4.3 (Medium)
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/R:U/V:D/RE:L/U:Amber
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-0418"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-15",
      "CWE-610"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-09T17:16:59Z",
    "severity": "MODERATE"
  },
  "details": "Insufficient configuration management in the listed devices\u00a0allows authenticated administrators connected to the local network\nto tamper with the system.",
  "id": "GHSA-5gqq-ch9p-4h64",
  "modified": "2026-06-18T15:31:55Z",
  "published": "2026-06-09T18:30:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0418"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/rax45"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/rax48"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/rax50"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/rax50s"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/rax75"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/rax80"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/raxe450"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/raxe500"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/rbr750"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/rbr840"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/rbr850"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/rbre960"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/rbs750"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/rbs840"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/rbs850"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/rbse960"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/rs700"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/xr1000"
    },
    {
      "type": "WEB",
      "url": "https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/cbr750"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/ex6120"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/ex6130"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/mr60"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/mr70"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/mr80"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/ms60"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/ms70"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/ms80"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/rax15"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/rax20"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/rax200"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/rax35v2"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/rax38v2"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/rax40v2"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/rax42"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/support/product/rax43"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:D/RE:L/U:Amber",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-5H2C-8V84-QPVR

Vulnerability from github – Published: 2026-03-03 21:39 – Updated: 2026-03-03 21:39
VLAI
Summary
OpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths
Details

Summary

OpenClaw shell-env fallback trusted startup environment values and could execute attacker-influenced login-shell startup paths before loading env keys.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: >= 2026.1.5 and <= 2026.2.21-2
  • Fixed on main: 9363c320d8ffe29290906752fab92621da02c3f7
  • Planned patched release version (pre-set): 2026.2.22

Details

The vulnerable chain was in the shell-env fallback path:

  1. src/infra/shell-env.ts
  2. resolveShell(env) trusted env.SHELL when set.

  3. execLoginShellEnvZero(...) executed ${SHELL} -l -c "env -0" with inherited runtime env.

  4. src/config/io.ts

  5. Config env values were applied before shell fallback execution.

  6. src/config/env-vars.ts / env policy coverage

  7. SHELL handling was hardened, but startup-path selectors (HOME, ZDOTDIR) still needed explicit blocking in config env ingestion and sanitization for shell fallback execution.

With env/config influence, this could trigger unintended command execution in shell startup processing on the OpenClaw host process context.

Fix

Mainline hardening now: - blocks SHELL, HOME, and ZDOTDIR during config env ingestion used by runtime fallback, - sanitizes shell fallback execution env, pinning HOME to the real user home and dropping ZDOTDIR + dangerous startup vars, - adds regression tests for config env ingestion and shell fallback/path-probe sanitization.

Fix Commit(s)

  • 9363c320d8ffe29290906752fab92621da02c3f7

Impact

  • Local code-execution risk in environments where attacker-controlled env/config input can reach shell-env fallback.
  • Under OpenClaw trust assumptions (SECURITY.md), this is not a public-remote issue and depends on crossing local trusted-operator boundaries.

Release Process Note

patched_versions is intentionally pre-set to the planned next release (2026.2.22) so once npm release is out, maintainers can publish advisory immediately.

OpenClaw thanks @tdjackey for reporting.

Severity
5.3 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.2.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-15",
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-03T21:39:51Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nOpenClaw shell-env fallback trusted startup environment values and could execute attacker-influenced login-shell startup paths before loading env keys.\n\n### Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected versions: `\u003e= 2026.1.5` and `\u003c= 2026.2.21-2`\n- Fixed on `main`: `9363c320d8ffe29290906752fab92621da02c3f7`\n- Planned patched release version (pre-set): `2026.2.22`\n\n### Details\nThe vulnerable chain was in the shell-env fallback path:\n\n1. `src/infra/shell-env.ts`\n- `resolveShell(env)` trusted `env.SHELL` when set.\n- `execLoginShellEnvZero(...)` executed `${SHELL} -l -c \"env -0\"` with inherited runtime env.\n\n2. `src/config/io.ts`\n- Config env values were applied before shell fallback execution.\n\n3. `src/config/env-vars.ts` / env policy coverage\n- `SHELL` handling was hardened, but startup-path selectors (`HOME`, `ZDOTDIR`) still needed explicit blocking in config env ingestion and sanitization for shell fallback execution.\n\nWith env/config influence, this could trigger unintended command execution in shell startup processing on the OpenClaw host process context.\n\n### Fix\nMainline hardening now:\n- blocks `SHELL`, `HOME`, and `ZDOTDIR` during config env ingestion used by runtime fallback,\n- sanitizes shell fallback execution env, pinning `HOME` to the real user home and dropping `ZDOTDIR` + dangerous startup vars,\n- adds regression tests for config env ingestion and shell fallback/path-probe sanitization.\n\n### Fix Commit(s)\n- `9363c320d8ffe29290906752fab92621da02c3f7`\n\n### Impact\n- Local code-execution risk in environments where attacker-controlled env/config input can reach shell-env fallback.\n- Under OpenClaw trust assumptions (`SECURITY.md`), this is not a public-remote issue and depends on crossing local trusted-operator boundaries.\n\n### Release Process Note\n`patched_versions` is intentionally pre-set to the planned next release (`2026.2.22`) so once npm release is out, maintainers can publish advisory immediately.\n\nOpenClaw thanks @tdjackey for reporting.",
  "id": "GHSA-5h2c-8v84-qpvr",
  "modified": "2026-03-03T21:39:51Z",
  "published": "2026-03-03T21:39:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-5h2c-8v84-qpvr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/9363c320d8ffe29290906752fab92621da02c3f7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths"
}

GHSA-5WMQ-F28X-GGG6

Vulnerability from github – Published: 2025-01-14 15:30 – Updated: 2025-11-04 00:32
VLAI
Details

Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability exists within the ftp_max_sessions POST parameter.

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-39790"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-15"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-14T15:15:24Z",
    "severity": "CRITICAL"
  },
  "details": "Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability exists within the `ftp_max_sessions` POST parameter.",
  "id": "GHSA-5wmq-f28x-ggg6",
  "modified": "2025-11-04T00:32:17Z",
  "published": "2025-01-14T15:30:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39790"
    },
    {
      "type": "WEB",
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2056"
    },
    {
      "type": "WEB",
      "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2056"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6G3P-Q5XV-HQ72

Vulnerability from github – Published: 2024-12-05 15:31 – Updated: 2024-12-05 15:31
VLAI
Details

Service Control vulnerabilities allow access to service restart requests and vm configuration settings.  Affected products:

ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
8.8 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:L/SI:L/SA:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-51544"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-15"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-05T13:15:07Z",
    "severity": "HIGH"
  },
  "details": "Service Control vulnerabilities allow access to service restart requests and vm configuration settings.\u00a0\nAffected products:\n\n\nABB ASPECT - Enterprise v3.08.02; \nNEXUS Series v3.08.02; \nMATRIX Series v3.08.02",
  "id": "GHSA-6g3p-q5xv-hq72",
  "modified": "2024-12-05T15:31:02Z",
  "published": "2024-12-05T15:31:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51544"
    },
    {
      "type": "WEB",
      "url": "https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-6GR5-F9V8-MMJP

Vulnerability from github – Published: 2023-11-08 12:30 – Updated: 2024-09-04 18:30
VLAI
Details

Unauthorized startup vulnerability of background apps. Successful exploitation of this vulnerability may cause background apps to start maliciously.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-46764"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-15"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-11-08T10:15:09Z",
    "severity": "MODERATE"
  },
  "details": "Unauthorized startup vulnerability of background apps. Successful exploitation of this vulnerability may cause background apps to start maliciously.",
  "id": "GHSA-6gr5-f9v8-mmjp",
  "modified": "2024-09-04T18:30:47Z",
  "published": "2023-11-08T12:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46764"
    },
    {
      "type": "WEB",
      "url": "https://consumer.huawei.com/en/support/bulletin/2023/11"
    },
    {
      "type": "WEB",
      "url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-0000001729189597"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6PGC-3W24-9RCW

Vulnerability from github – Published: 2023-09-28 21:30 – Updated: 2024-04-04 07:57
VLAI
Details

mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP and DNS request to external server. The Parameters effected are multiple - messageText, data[wall_photo], data[userShareVideo] and data[userShareLink].

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-43323"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-15"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-09-28T20:15:11Z",
    "severity": "MODERATE"
  },
  "details": "mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP and DNS request to external server. The Parameters effected are multiple - messageText, data[wall_photo], data[userShareVideo] and data[userShareLink].",
  "id": "GHSA-6pgc-3w24-9rcw",
  "modified": "2024-04-04T07:57:26Z",
  "published": "2023-09-28T21:30:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43323"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ahrixia/CVE-2023-43323"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation MIT-46
Architecture and Design

Strategy: Separation of Privilege

  • Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
  • Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Mitigation
Implementation Architecture and Design

Because setting manipulation covers a diverse set of functions, any attempt at illustrating it will inevitably be incomplete. Rather than searching for a tight-knit relationship between the functions addressed in the setting manipulation category, take a step back and consider the sorts of system values that an attacker should not be allowed to control.

Mitigation
Implementation Architecture and Design

In general, do not allow user-provided or otherwise untrusted data to control sensitive values. The leverage that an attacker gains by controlling these values is not always immediately obvious, but do not underestimate the creativity of the attacker.

CAPEC-13: Subverting Environment Variable Values

The adversary directly or indirectly modifies environment variables used by or controlling the target software. The adversary's goal is to cause the target software to deviate from its expected operation in a manner that benefits the adversary.

CAPEC-146: XML Schema Poisoning

An adversary corrupts or modifies the content of XML schema information passed between a client and server for the purpose of undermining the security of the target. XML Schemas provide the structure and content definitions for XML documents. Schema poisoning is the ability to manipulate a schema either by replacing or modifying it to compromise the programs that process documents that use this schema.

CAPEC-176: Configuration/Environment Manipulation

An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.

CAPEC-203: Manipulate Registry Information

An adversary exploits a weakness in authorization in order to modify content within a registry (e.g., Windows Registry, Mac plist, application registry). Editing registry information can permit the adversary to hide configuration information or remove indicators of compromise to cover up activity. Many applications utilize registries to store configuration and service information. As such, modification of registry information can affect individual services (affecting billing, authorization, or even allowing for identity spoofing) or the overall configuration of a targeted application. For example, both Java RMI and SOAP use registries to track available services. Changing registry values is sometimes a preliminary step towards completing another attack pattern, but given the long term usage of many registry values, manipulation of registry information could be its own end.

CAPEC-270: Modification of Registry Run Keys

An adversary adds a new entry to the "run keys" in the Windows registry so that an application of their choosing is executed when a user logs in. In this way, the adversary can get their executable to operate and run on the target system with the authorized user's level of permissions. This attack is a good way for an adversary to run persistent spyware on a user's machine, such as a keylogger.

CAPEC-271: Schema Poisoning

An adversary corrupts or modifies the content of a schema for the purpose of undermining the security of the target. Schemas provide the structure and content definitions for resources used by an application. By replacing or modifying a schema, the adversary can affect how the application handles or interprets a resource, often leading to possible denial of service, entering into an unexpected state, or recording incomplete data.

CAPEC-579: Replace Winlogon Helper DLL

Winlogon is a part of Windows that performs logon actions. In Windows systems prior to Windows Vista, a registry key can be modified that causes Winlogon to load a DLL on startup. Adversaries may take advantage of this feature to load adversarial code at startup.

CAPEC-69: Target Programs with Elevated Privileges

This attack targets programs running with elevated privileges. The adversary tries to leverage a vulnerability in the running program and get arbitrary code to execute with elevated privileges.

CAPEC-76: Manipulating Web Input to File System Calls

An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.

CAPEC-77: Manipulating User-Controlled Variables

This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.

← Back to the CWE list