CWE-200
DiscouragedExposure of Sensitive Information to an Unauthorized Actor
Abstraction: Class · Status: Draft
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
16306 vulnerabilities reference this CWE, most recent first.
CVE-2026-1175 (GCVE-0-2026-1175)
Vulnerability from cvelistv5 – Published: 2026-01-19 20:32 – Updated: 2026-02-23 08:49| URL | Tags |
|---|---|
| https://vuldb.com/?id.341769 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.341769 | signaturepermissions-required |
| https://vuldb.com/?submit.731106 | third-party-advisory |
| https://github.com/birkir/prime/issues/546 | exploitissue-tracking |
| https://github.com/birkir/prime/ | product |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1175",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-20T17:20:45.526312Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-20T17:20:52.352Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"GraphQL Directive Handler"
],
"product": "prime",
"vendor": "birkir",
"versions": [
{
"status": "affected",
"version": "0.4.0.beta"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ZAST.AI (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in birkir prime up to 0.4.0.beta.0. This impacts an unknown function of the file /graphql of the component GraphQL Directive Handler. Such manipulation leads to information exposure through error message. The attack may be performed from remote. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "Information Exposure Through Error Message",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-23T08:49:09.909Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-341769 | birkir prime GraphQL Directive graphql information exposure",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.341769"
},
{
"name": "VDB-341769 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.341769"
},
{
"name": "Submit #731106 | birkir prime \u003c=0.4.0 GraphQL Directive Information Disclosure",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.731106"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/birkir/prime/issues/546"
},
{
"tags": [
"product"
],
"url": "https://github.com/birkir/prime/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-01-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-01-19T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-02-05T03:25:26.000Z",
"value": "VulDB entry last update"
}
],
"title": "birkir prime GraphQL Directive graphql information exposure"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-1175",
"datePublished": "2026-01-19T20:32:08.955Z",
"dateReserved": "2026-01-19T07:15:44.976Z",
"dateUpdated": "2026-02-23T08:49:09.909Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1170 (GCVE-0-2026-1170)
Vulnerability from cvelistv5 – Published: 2026-01-19 18:02 – Updated: 2026-02-23 08:48| URL | Tags |
|---|---|
| https://vuldb.com/?id.341764 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.341764 | signaturepermissions-required |
| https://vuldb.com/?submit.731100 | third-party-advisory |
| https://github.com/birkir/prime/issues/541 | exploitissue-tracking |
| https://github.com/birkir/prime/ | product |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1170",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-20T21:39:48.744853Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-20T21:39:55.634Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"GraphQL API"
],
"product": "prime",
"vendor": "birkir",
"versions": [
{
"status": "affected",
"version": "0.4.0.beta"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ZAST.AI (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in birkir prime up to 0.4.0.beta.0. This issue affects some unknown processing of the file /graphql of the component GraphQL API. Performing a manipulation results in information disclosure. The attack may be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-23T08:48:06.590Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-341764 | birkir prime GraphQL API graphql information disclosure",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.341764"
},
{
"name": "VDB-341764 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.341764"
},
{
"name": "Submit #731100 | birkir prime \u003c=0.4.0 Sensitive Information Disclosure",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.731100"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/birkir/prime/issues/541"
},
{
"tags": [
"product"
],
"url": "https://github.com/birkir/prime/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-01-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-01-19T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-01-20T05:33:52.000Z",
"value": "VulDB entry last update"
}
],
"title": "birkir prime GraphQL API graphql information disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-1170",
"datePublished": "2026-01-19T18:02:06.344Z",
"dateReserved": "2026-01-19T07:15:30.901Z",
"dateUpdated": "2026-02-23T08:48:06.590Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1060 (GCVE-0-2026-1060)
Vulnerability from cvelistv5 – Published: 2026-01-28 14:25 – Updated: 2026-04-08 17:03- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
| Vendor | Product | Version | |
|---|---|---|---|
| litonice13 | WP Adminify – White Label WordPress, Admin Menu Editor, Login Customizer |
Affected:
0 , ≤ 4.0.7.7
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1060",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-28T14:41:44.872345Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-28T14:42:12.226Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WP Adminify \u2013 White Label WordPress, Admin Menu Editor, Login Customizer",
"vendor": "litonice13",
"versions": [
{
"lessThanOrEqual": "4.0.7.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "yi\u011fit ibrahim sa\u011flam"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP Adminify plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.7.7 via the /wp-json/adminify/v1/get-addons-list REST API endpoint. The endpoint is registered with permission_callback set to __return_true, allowing unauthenticated attackers to retrieve the complete list of available addons, their installation status, version numbers, and download URLs."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:03:16.014Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7ecb4f95-346e-49b3-859f-44f28a72f065?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/adminify/tags/4.0.6.1/Libs/Addons.php#L54"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3442928/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-01-16T19:20:40.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-01-27T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "WP Adminify \u003c= 4.0.7.7 - Unauthenticated Sensitive Information Exposure via \u0027get-addons-list\u0027 REST API"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-1060",
"datePublished": "2026-01-28T14:25:11.551Z",
"dateReserved": "2026-01-16T19:04:24.186Z",
"dateUpdated": "2026-04-08T17:03:16.014Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0950 (GCVE-0-2026-0950)
Vulnerability from cvelistv5 – Published: 2026-02-03 05:30 – Updated: 2026-04-08 17:23- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
| Vendor | Product | Version | |
|---|---|---|---|
| brainstormforce | Spectra Gutenberg Blocks – Website Builder for the Block Editor |
Affected:
0 , ≤ 2.19.17
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0950",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-03T15:56:55.439332Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-03T15:57:03.562Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spectra Gutenberg Blocks \u2013 Website Builder for the Block Editor",
"vendor": "brainstormforce",
"versions": [
{
"lessThanOrEqual": "2.19.17",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "JohSka"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Spectra Gutenberg Blocks \u2013 Website Builder for the Block Editor plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.19.17. This is due to the plugin failing to check `post_password_required()` before rendering post excerpts in the `render_excerpt()` function and the `uagb_get_excerpt()` helper function. This makes it possible for unauthenticated attackers to read excerpts of password-protected posts by simply viewing any page that contains a Spectra Post Grid, Post Masonry, Post Carousel, or Post Timeline block."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:23:50.568Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ccaccf03-4162-4365-9f12-0363a78e91d4?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/trunk/blocks-config/post/class-uagb-post.php#L1303"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.17/blocks-config/post/class-uagb-post.php#L1303"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/trunk/blocks-config/post/class-uagb-post.php#L1621"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.17/blocks-config/post/class-uagb-post.php#L1621"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/trunk/blocks-config/post/class-uagb-post.php#L2196"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.17/blocks-config/post/class-uagb-post.php#L2196"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/trunk/classes/class-uagb-helper.php#L1403"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.17/classes/class-uagb-helper.php#L1403"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3443216%40ultimate-addons-for-gutenberg%2Ftrunk\u0026old=3410395%40ultimate-addons-for-gutenberg%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
}
],
"timeline": [
{
"lang": "en",
"time": "2026-01-14T18:08:20.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-02-02T16:58:28.000Z",
"value": "Disclosed"
}
],
"title": "Spectra Gutenberg Blocks \u003c= 2.19.17 - Unauthenticated Information Disclosure in Sensitive Data"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-0950",
"datePublished": "2026-02-03T05:30:14.865Z",
"dateReserved": "2026-01-14T17:53:04.377Z",
"dateUpdated": "2026-04-08T17:23:50.568Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0860 (GCVE-0-2026-0860)
Vulnerability from cvelistv5 – Published: 2026-09-08 14:19 – Updated: 2026-09-10 18:06- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
| Vendor | Product | Version | |
|---|---|---|---|
| Arm Ltd | Valhall GPU Kernel Driver |
Affected:
r29p0 , ≤ r49p5
(patch)
Affected: r50p0 , ≤ r54p3 (patch) Affected: r55p0 (patch) Unaffected: r56p0 (patch) |
|
| Arm Ltd | Arm 5th Gen GPU Architecture Kernel Driver |
Affected:
r41p0 , ≤ r49p5
(patch)
Affected: r50p0 , ≤ r54p3 (patch) Affected: r55p0 (patch) Unaffected: r56p0 (patch) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-0860",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T18:06:19.626718Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T18:06:49.715Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Valhall GPU Kernel Driver",
"vendor": "Arm Ltd",
"versions": [
{
"lessThanOrEqual": "r49p5",
"status": "affected",
"version": "r29p0",
"versionType": "patch"
},
{
"lessThanOrEqual": "r54p3",
"status": "affected",
"version": "r50p0",
"versionType": "patch"
},
{
"status": "affected",
"version": "r55p0",
"versionType": "patch"
},
{
"status": "unaffected",
"version": "r56p0",
"versionType": "patch"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Arm 5th Gen GPU Architecture Kernel Driver",
"vendor": "Arm Ltd",
"versions": [
{
"lessThanOrEqual": "r49p5",
"status": "affected",
"version": "r41p0",
"versionType": "patch"
},
{
"lessThanOrEqual": "r54p3",
"status": "affected",
"version": "r50p0",
"versionType": "patch"
},
{
"status": "affected",
"version": "r55p0",
"versionType": "patch"
},
{
"status": "unaffected",
"version": "r56p0",
"versionType": "patch"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eExposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to sensitive kernel information.\u003c/p\u003e\u003cp\u003eThis issue affects Valhall GPU Kernel Driver: from r29p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0.\u003c/p\u003e"
}
],
"value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to sensitive kernel information.\n\n\n\nThis issue affects Valhall GPU Kernel Driver: from r29p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:19:22.205Z",
"orgId": "56a131ea-b967-4a0d-a41e-5f3549952846",
"shortName": "Arm"
},
"references": [
{
"url": "https://support.arm.com/documentation/111552/1-0/?lang=en"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThis issue has been fixed in the following versions: Valhall GPU Kernel Driver: r56p0; Arm 5th Gen GPU Architecture Kernel Driver: r56p0. Arm partners are recommended to upgrade to the latest applicable version as soon as possible.\u003c/p\u003e"
}
],
"value": "This issue has been fixed in the following versions: Valhall GPU Kernel Driver: r56p0; Arm 5th Gen GPU Architecture Kernel Driver: r56p0. Arm partners are recommended to upgrade to the latest applicable version as soon as possible."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Mali GPU Kernel Driver allows access to sensitive kernel information",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "56a131ea-b967-4a0d-a41e-5f3549952846",
"assignerShortName": "Arm",
"cveId": "CVE-2026-0860",
"datePublished": "2026-09-08T14:19:22.205Z",
"dateReserved": "2026-01-12T13:44:43.992Z",
"dateUpdated": "2026-09-10T18:06:49.715Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0789 (GCVE-0-2026-0789)
Vulnerability from cvelistv5 – Published: 2026-01-23 03:01 – Updated: 2026-01-23 19:39- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
| Vendor | Product | Version | |
|---|---|---|---|
| ALGO | 8180 IP Audio Alerter |
Affected:
5.5
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0789",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-23T19:39:13.770947Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-23T19:39:25.056Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "8180 IP Audio Alerter",
"vendor": "ALGO",
"versions": [
{
"status": "affected",
"version": "5.5"
}
]
}
],
"dateAssigned": "2026-01-08T22:55:36.599Z",
"datePublic": "2026-01-09T15:55:23.355Z",
"descriptions": [
{
"lang": "en",
"value": "ALGO 8180 IP Audio Alerter Web UI Inclusion of Authentication Cookie in Response Body Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the web-based user interface. The issue results from the lack of proper management of sensitive information. An attacker can leverage this vulnerability to disclose information in the context of the device. Was ZDI-CAN-28297."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-23T03:01:16.956Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-26-011",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-011/"
}
],
"source": {
"lang": "en",
"value": "Vera Mensa of Claroty Research - Team82"
},
"title": "ALGO 8180 IP Audio Alerter Web UI Inclusion of Authentication Cookie in Response Body Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2026-0789",
"datePublished": "2026-01-23T03:01:16.956Z",
"dateReserved": "2026-01-08T22:55:36.577Z",
"dateUpdated": "2026-01-23T19:39:25.056Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0747 (GCVE-0-2026-0747)
Vulnerability from cvelistv5 – Published: 2026-01-08 19:55 – Updated: 2026-01-08 20:07- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
| Vendor | Product | Version | |
|---|---|---|---|
| Devolutions | Remote Desktop Manager |
Affected:
2025.3.24.0 , ≤ 2025.3.28.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-0747",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-08T20:06:33.387229Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-08T20:07:40.198Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Remote Desktop Manager",
"vendor": "Devolutions",
"versions": [
{
"lessThanOrEqual": "2025.3.28.0",
"status": "affected",
"version": "2025.3.24.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003eExposure of sensitive information in the TeamViewer entry dashboard component in Devolutions Remote Desktop Manager 2025.3.24.0 through 2025.3.28.0 on Windows allows an external observer to view a password on screen via a defective masking feature, for example during physical observation or screen sharing.\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cbr\u003e\n\n\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "Exposure of sensitive information in the TeamViewer entry dashboard component in Devolutions Remote Desktop Manager 2025.3.24.0 through 2025.3.28.0 on Windows allows an external observer to view a password on screen via a defective masking feature, for example during physical observation or screen sharing."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-08T19:55:58.944Z",
"orgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23",
"shortName": "DEVOLUTIONS"
},
"references": [
{
"url": "https://devolutions.net/security/advisories/DEVO-2026-0002/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23",
"assignerShortName": "DEVOLUTIONS",
"cveId": "CVE-2026-0747",
"datePublished": "2026-01-08T19:55:58.944Z",
"dateReserved": "2026-01-08T19:09:44.557Z",
"dateUpdated": "2026-01-08T20:07:40.198Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0717 (GCVE-0-2026-0717)
Vulnerability from cvelistv5 – Published: 2026-01-14 05:28 – Updated: 2026-04-08 16:37- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
| Vendor | Product | Version | |
|---|---|---|---|
| lottiefile | LottieFiles |
Affected:
0 , ≤ 3.0.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0717",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T15:45:03.443111Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T19:17:15.578Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LottieFiles",
"vendor": "lottiefile",
"versions": [
{
"lessThanOrEqual": "3.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "yoshi cat"
}
],
"descriptions": [
{
"lang": "en",
"value": "The LottieFiles \u2013 Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the `/wp-json/lottiefiles/v1/settings/` REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site owner\u0027s LottieFiles.com account credentials including their API access token and email address when the \u0027Share LottieFiles account with other WordPress users\u0027 option is enabled."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:37:55.879Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/19b159ca-4b41-48b4-880d-9b9dc44b3463?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/lottiefiles/tags/3.0.0/src/common.php?marks=21,122#L21"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3442469/"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-12-24T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2026-01-13T16:45:26.000Z",
"value": "Disclosed"
}
],
"title": "LottieFiles \u2013 Lottie block for Gutenberg \u003c= 3.0.0 - Unauthenticated Sensitive Information Exposure"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-0717",
"datePublished": "2026-01-14T05:28:04.741Z",
"dateReserved": "2026-01-08T11:59:20.274Z",
"dateUpdated": "2026-04-08T16:37:55.879Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0491
Vulnerability from gna-1988 – Published: 2026-11-02 07:30 – Updated: 2026-11-02 07:30| Vendor | Product | Version | |
|---|---|---|---|
| unknown | South River Technologies |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "South River Technologies",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "disclosure via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "0day Rubbish Research Team is publicly disclosing a vulnerability chain in South\nRiver Technologies Titan MFT Server 26.0.0.364, the NextGen generation of the\ncommercial managed file transfer server from South River Technologies (Annapolis,\nMaryland, United States). The product runs as a single .NET 8 process,\ntitanmft.exe, registered as the Windows service SrtTitanMFTServerService under\nLocalSystem, serves a Blazor Server administration application on 0.0.0.0:47443\nover TLS, and drives transfers with EF Core over SQLite.\n\nBefore anything else, the framing. This is a first-run window, which is a\ndeployment state, and it is not an absence of authentication. The window opens\nwhen installation completes and the service starts listening, and it closes the\ninstant the first administrator account exists. While the administration\ndatabase\u0027s nxUserParams table holds zero rows, the login route renders an\n\"Initial Admin User Setup\" screen to any client that can reach the listener.\nOnce one administrator exists, that route renders a credential form instead and\nthis chain\u0027s account-creation half has no route whatsoever. The product has\nthree authentication planes and the message-level one is closed; we measured it\nclosed, in the same run, at the same time the setup screen was available. What\nis exposed is a state, and no configured deployment is exposed to the half that\ncreates the account.\n\nType: CWE-306, Missing Authentication for Critical Function, on the first-run\nadministrator-creation path, chained with CWE-78, Improper Neutralization of\nSpecial Elements used in an OS Command, on the job post-command path.\nCWE-250/CWE-269 (LocalSystem execution with no privilege separation) and\nCWE-209/CWE-200 (unauthenticated stack-trace echo and window-state leak) are\nnamed as contributing and are deliberately not folded into the score. CWE-1188\nis deliberately not used: no insecure default credential ships with this\nproduct, and implying that rotating a password closes the exposure would be\nfalse, because creating the first administrator closes it.\n\nThe gate is a row count and nothing else. MxSvrParams.cs:518-520 evaluates\n`RunWizard = !nxUserParams.AdminUserExists() \u0026\u0026 !CreateAdminAtConsole`, and the\nclearest form of the same predicate is in the legacy route:\n\n if (!nxUserParams.AdminUserExists())\n CreateAdminUser(li.user.NxDecryptAPI(), li.pass.NxDecryptAPI());\n\nThere is no bootstrap ticket, no CAPTCHA, no first-boot token, no localhost\nrestriction and no channel binding. We counted zero `[Authorize]` attributes\nacross the 1,880 decompiled files of the ServerCore assembly, so every\nauthorisation decision in the product lives in application logic, and for the\nsetup screen that logic is the empty-table test. Submitting the screen calls\n`AppState.CreateAdminUser` followed by `AppState.Login` inside the same\nin-process circuit and lands the anonymous client in the management console at\n`/SvrHome/\u003cguid\u003e/\u003cguid\u003e`.\n\nThe sink is the job post-command. The field labelled `Execute After File\nTransfer Task` is persisted verbatim into `nxJobs.document.PostCommandText` and\nis executed by the transfer engine:\n\n // MxUtilSvrJobHandler.cs:970-972 trigger predicate\n if (P_0.IsSuccess() || Job.ExecuteCustomPostProcessOnFileTransferTaskFailure)\n return !string.IsNullOrWhiteSpace(Job.PostCommandText);\n\n // MxUtilSvrJobHandler.cs:979-982 call site\n LogMsg(\"Post Command: \" + Job.PostCommandText);\n RunCustomProcessAsync(Job.PostCommandText, Job.PostWorkingDir, Job.PostTimeout)\n\n // MxUtilSvrJobHandler.cs:991 onward (a second pass over the same\n // decompilation records this routine at :996)\n if (command.TrimStart().StartsWith(\"cmd\", OrdinalIgnoreCase)) {\n fileName = \"cmd.exe\";\n arguments = \"/c \" + command.Substring(3).Trim();\n } else {\n int num = command.IndexOf(\u0027 \u0027);\n fileName = num \u003e 0 ? command.Substring(0, num) : command;\n arguments = num \u003e 0 ? command.Substring(num + 1) : \"\";\n }\n StartInfo = new ProcessStartInfo { FileName = fileName, Arguments = arguments,\n WorkingDirectory = workingDir, UseShellExecute = false, ... }\n\nFour properties make this a command injection rather than a command launcher:\nthe `cmd`-prefix special case reconstitutes full shell semantics, so\nredirection, chaining, percent-expansion and quoting are all live in the payload\nspace; otherwise the value is split on its first space with no quoting\ndiscipline; `Arguments` is a string rather than a vector, so `ArgumentList`\nnever protects the value; and there is no allow-list, no path canonicalisation,\nno executable-existence check, no metacharacter rejection and no server-side\nre-validation between the write and the process start. The only inspection of\nthe value on the path is `IsNullOrWhiteSpace`, which answers \"should I run\nanything\" and not \"is this safe\". `UseShellExecute = false` with no\nimpersonation, no restricted token, no job object and no integrity-level\ndowngrade means the child inherits the service token, which is LocalSystem.\n\nIdentity reached: `NT AUTHORITY\\SYSTEM`. The proof is a marker file, 21 bytes,\ncontent `nt authority\\system`, written by the injected `cmd /c whoami` child;\nits modification time sits 76 milliseconds after the job-completion timestamp\nthe product itself recorded in its own job-history table for that run. That\noffset is the attribution evidence: at that precision the file was written by\nthe step that followed transfer completion in that job, not by anything else on\nthe host.\n\nHow confirmation works, and what was deliberately not reproduced. The control\nleg repeated the entire pipeline with one variable removed: using the\nadministrator the exploit itself had created, the same job was re-opened, its\n`PostCommandText` cleared (confirmed empty both in the field and in the job\ndocument), saved, and run again. The job completed - a second job-history row,\nCompleted, successful, zero files transferred - and the marker was untouched:\nsame byte length, same modification time to the millisecond. The two runs were\n111.6 seconds apart. That single leg removes every alternative explanation for\nthe marker that does not involve the injected field: it was not written by the\ntransfer engine or any pipeline stage, it is not a leftover artifact from\ninstallation or from an earlier experiment, and it was not written by a\nscheduled task, a service restart or a background process, because the only\ndifference between the two runs is one field\u0027s contents.\n\nThe payload was chosen to prove identity and nothing else. What we deliberately\ndid not do: no destructive action, no persistence, no lateral movement, no\ndomain compromise, no access to any partner system, and no second command shape\nbeyond the one successful-transfer run and its empty-command control. The\npre-transfer counterpart of the same field was not executed, so its\nexploitability is inference from shared code shape and is not claimed. The\nfailing-transfer-with-payload combination was not executed either; the predicate\nreading that makes it work at all comes from the code plus the control row\u0027s\nsemantics, and we do not claim that combination as measured. The published\nadvisory reproduces the identity string but not the per-run marker path or the\nhost names from the run.\n\nScoring. The primary published rating is 8.1 High,\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Arithmetic:\nISS = 1 - (0.44)^3 = 0.914816; Impact at S:U = 6.42 x 0.914816 = 5.87311872;\nExploitability = 8.22 x 0.85 x 0.44 x 0.85 x 0.85 = 2.2211673;\nBase = min(5.87311872 + 2.2211673, 10) = 8.09428602; Roundup = 8.1, band High.\n\nWhy AC:H and therefore why 8.1 is the headline. The chain requires the target\nto be inside a state the attacker cannot create: an installation that has not\nyet completed first-time setup. The attacker can discover such targets cheaply\nand cannot bring the condition about, cannot extend it and cannot re-open it\nfrom the network; once the operator completes setup the first half is gone for\ngood. CVSS 3.1 places \"the attack depends on conditions beyond the attacker\u0027s\ncontrol\" in Attack Complexity High, and a transient deployment state that must\nbe found rather than caused is squarely that. We also never measured a typical\nwindow duration in any environment, so claiming AC:L as the headline would\nsilently assume the very deployment fact we declined to measure.\n\nConditional reading, published as conditional and never as the headline: 9.8\nCritical, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, Exploitability\n8.22 x 0.85 x 0.77 x 0.85 x 0.85 = 3.887042775, Base 9.760161495, Roundup 9.8.\nIt applies to one installation confirmed to be inside its first-run window,\nwhere the state condition is already satisfied and what remains is four form\nsubmissions and a menu click. Use it when triaging a specific host; use 8.1\nwhen triaging a fleet or a vendor. The two figures may not be swapped.\n\nRejected readings, named so the rejection is auditable.\n - Scope Changed: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H computes to 9.1,\n and the conditional under S:C would be 10.0. The argument is coherent - the\n host OS is governed by Windows rather than by the product\u0027s authorisation\n component - and we reject it, because the child is created by the service\n inside the service\u0027s own LocalSystem token on the service\u0027s own host, and\n executing as the same service identity on the same host does not change\n scope. Adopting Changed also puts a conditional 10.0 on the table, which\n invites exactly the \"this product has no authentication\" misreading that the\n framing above exists to prevent.\n - Sink only: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H computes to 7.2. The\n post-command field on its own is a documented administrator feature; an\n administrator reaching LocalSystem is a privilege-separation weakness rather\n than remote code execution, and publishing either half in isolation would\n misrepresent the finding.\n\nNo recorded score exists to correct here, and that is worth saying explicitly\nbecause it is unusual: the material this analysis is built from carries no CVSS\nvector and no base score for this finding, so both readings were derived from\nthe metric definitions and the measured facts, computed with the CVSS 3.1 base\nformula, and rounded up to the tenth as that formula specifies. PR:N is a\nproperty of the chain start, not of the sink in isolation: the least privileged\nprincipal that reaches the sink by the documented path is a principal that did\nnot exist before the request.\n\nAuthentication, and the negative-control evidence behind the framing. The\ncounter-gate measurement is the load-bearing one, and its detail matters: within\nthe same service instance, in the same pass, an unauthenticated\n`POST /WebApi/Process` returned 401 with an empty body while the first-run\nwizard was simultaneously available to that same unauthenticated client, and\n`POST /api/Authenticate/Login` returned 500 with an empty body because the REST\nadministration plane is gated by `RESTEnableAdminApi`, which has no row by\ndefault and so makes the controller constructor throw. That is a counter-gate,\nnot a post-setup result: message-level authentication was demonstrably intact\nand demonstrably irrelevant, because this chain never traverses it. We are also\ncorrecting a detail of our own record rather than leaving it to be inferred: no\npost-setup HTTP status sample was ever captured from the login route. Our\npost-window evidence is exactly three observations - the setup screen is no\nlonger rendered, a credential form is rendered in its place, and the created\nadministrator\u0027s credentials were accepted through it. We are not going to invent\na 401 on that route.\n\nThe setup screen itself was measured as having zero preconditions: it submitted\nsuccessfully with the EULA checkbox untouched (present but non-blocking), with no\nticket parameter, with no CAPTCHA element in the DOM, with no first-boot token,\nand from "
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1188",
"description": "CWE-1188",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-209",
"description": "CWE-209",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-250",
"description": "CWE-250",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-269",
"description": "CWE-269",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-306",
"description": "CWE-306",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-78",
"description": "CWE-78",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T07:30:03Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/20"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Oct/20"
},
{
"url": "https://0day-rubbish.com"
},
{
"url": "https://0day-rubbish.com/blog/southriver-titan-mft-firstrun-admin-setup-job-command-injection"
},
{
"url": "https://github.com/Exploit-Garbage/0day-Rubbish"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Oct/20"
],
"discovery": "EXTERNAL"
},
"title": "[0day-rubbish] South River Technologies Titan MFT Server 26.0.0 first-run administrator setup chained to job post-command injection, NT AUTHORITY\\SYSTEM (8.1)",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0491",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/20",
"automated": true,
"contentSha256": "5adb567e9098c5a90b10865c6366e56faa21d7e9b61485d41bca4075c1b69fa3",
"evidenceScore": 11,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Oct/20",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-10-13T02:22:46Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-11-02T07:30:03Z",
"dateUpdated": "2026-11-02T07:30:03Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0491"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0486
Vulnerability from gna-1988 – Published: 2026-11-02 07:30 – Updated: 2026-11-02 07:30| Vendor | Product | Version | |
|---|---|---|---|
| unknown | Dataedo Portal |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Dataedo Portal",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "disclosure via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Dataedo\nPortal 26.2.8 together with Dataedo Agent 26.2.8, the closed-source enterprise\ndata-catalog and data-governance platform from Dataedo sp. z o.o. (Poland).\nBoth components are in scope because the chain crosses from one to the other:\nthe Portal discloses a database credential, and the separately installed Agent\nexecutes an injected scheduler job on its own host. In the verified shape the\ncommand ran as `nt authority\\system`.\n\nType: deserialization of untrusted data by unrestricted invocation-type\nresolution (CWE-502 primary, with CWE-470 an equally defensible\ncharacterisation of the same mechanism), enabled by insufficiently protected\ncredentials (CWE-522) under a hard-coded cryptographic key (CWE-321), with\nincorrect authorization and missing privilege separation (CWE-863 / CWE-284)\nand execution with unnecessary privileges (CWE-250 / CWE-732) contributing.\n\nThe entry route works exactly as designed, which is the point. `GET\n/api/repository/connection-string` returns the repository database connection\nstring to a caller holding a repository-management role, encrypted with\n`SimpleAES` - an AES-256-CBC construction whose 32-byte key and 16-byte IV are\nbyte-array literals in the shipped `Dataedo.Settings.dll` and are\nbyte-identical across builds, with PKCS7 padding and every ciphertext byte\nencoded as a three-digit decimal group. Anyone holding a copy of the product\ntherefore decrypts the response offline; both values are reproduced in the\npublished proof-of-concept. `GenerateEncryptionKey()` exists at\n`Dataedo.Settings:116` and no call path was found that replaces the static\nfield with its output. A full census counted the same static pair referenced\nfrom 19 assemblies. The recovered login in the tested deployments was `sa`, a\nsysadmin-level principal on the repository database - and that database also\nholds the Hangfire scheduler storage in the `[Scheduler]` schema.\n\nThe sink is on the Agent side. `AgentServiceRegistration.AddScheduler` calls\n`AddHangfireServer` twice, once for the `default` queue with a worker count of\none and once for the `priority` queue, and registers no `ITypeResolver`\nrestriction and no invocation allowlist with either, so Hangfire\u0027s default type\nresolver will resolve any type name the runtime can load. `FilterInitializer`\nthen runs `GlobalJobFilters.Clear()` and adds four filters, none of which\nconstrains execution: `ExecutionCreatingFilter` and `RequestUpdatingFilter` are\n`IClientFilter` implementations, which run on the client-side job-creation path\nrather than on server-side execution and additionally return early unless the\ndeclaring type implements `ISchedulerTaskExecutor`; `JobCancellationFilter` is\nan `IApplyStateFilter` that reacts only to transitions into `DeletedState`;\nand `AutomaticRetry` is configured with `Attempts = 0`, which disables retries\nand has no bearing on authorization. After `Clear()` nothing in the chain\ninspects the invocation type, the declaring type, the method name or the\narguments at execution time. The producer is disciplined and the consumer is\nnot, and the consumer is the one that executes.\n\nOne row into `[Scheduler].Job` plus one row into `[Scheduler].JobQueue` is\ntherefore enough, and no gadget chain is needed because the invocation document\nnames the sink directly:\n\n {\"Type\":\"System.Diagnostics.Process, System.Diagnostics.Process\",\n \"Method\":\"Start\",\n \"ParameterTypes\":\"[\\\"System.String\\\",\\\"System.String\\\"]\",\n \"Arguments\":\"[\\\"cmd.exe\\\",\\\"/c \u003cpayload\u003e\\\"]\"}\n\nThree details are load-bearing and none of them is obvious. The `Arguments`\ncolumn and the `InvocationData.Arguments` member must both carry the command,\nand the latter is a JSON array serialized as a string inside the outer JSON\nobject, so a Windows path appears with doubled backslashes in the outer\ndocument and quadrupled backslashes in the inner one while the enclosing T-SQL\nliteral doubles every single quote. `QUOTED_IDENTIFIER` must be ON because the\nscheduler schema uses filtered indexes. And the `JobQueue` row must name a\nqueue the Agent actually polls, otherwise the job exists and is never fetched.\n\nExecution lands on the Agent host as the identity of the Agent process. Two\nshapes were observed and both are recorded because they bound the claim:\n`whoami` returned `\u003cagent-host\u003e\\administrator` when the Agent was launched from\na console under an interactive administrative account, and `nt authority\\system`\nwhen it ran resident as a SYSTEM-privileged scheduled task, where filtered\n`tasklist` output for PID 4 appended to the same file showed the System process\nin session 0 under the Services session name, consistent with a service-context\nexecution environment. For production the Agent is installed as a Windows\nservice through `AddWindowsService` with an empty `ServiceConfiguration`, so\nthe identity is whatever that service is configured with: SYSTEM is what the\ndefault service configuration yielded in the tested shape and is not a claim\nabout every deployment, and the installer\u0027s own service-registration table was\nnot inspected to finality, so the production service account is an inference\nfrom the host configuration call rather than an artifact-confirmed value.\n\nHow confirmation works. The recorded job was assigned identifier 7 and its\nstate progression was read directly from the storage tables: Enqueued -\u003e\nProcessing (with the fetching worker\u0027s own ServerId recorded) -\u003e Succeeded,\nwith `PerformanceDuration` of 4 milliseconds and `State.Result` equal to \"Can\nnot serialize the return value\". That pair is proof of invocation rather than\nof bookkeeping: `Process.Start` returns a live Process object which the\nscheduler cannot serialize into its state column, so it records that string,\nand a job that had been rejected or never fetched would not have reached\nSucceeded at all. A marker file was written on the Agent host by the executed\ncommand. The marker path and the marker token are command-line arguments of the\npublished tool, and neither the path nor the token from the recorded run is\nreproduced here, because both are artefacts of one execution on one host rather\nthan evidence about the product.\n\nThe strongest single piece of evidence in the package is an argument-provenance\ncontrol. The first injection attempt wrote a placeholder token into the\n`[Scheduler].Job.Arguments` column while the `InvocationData` document was\ncorrect, and the Agent\u0027s run log recorded the shell complaining that the\nplaceholder was not recognized as an internal or external command. That\nestablishes that the executed arguments came from the database row and not from\nany configuration, command line or code path inside the Agent, and it\nidentified the column mismatch in the same breath. Without it a reviewer could\nreasonably ask whether the observed execution was an artefact of the test rig;\nwith it the causality is direct.\n\nWhat was deliberately not reproduced. The published tool issues no destructive\ncommand, creates no account, deletes no catalog data and touches no downstream\ndata source. The static key was validated in both cryptographic directions -\ndecrypting a production-shaped ciphertext, and building one offline that the\nreal Agent binary subsequently accepted into its own configuration file and\nconnected with, which confirms the key, the IV and the encoding independently\nof the decryption direction - but no domain-controller or domain-administrative\noutcome was attempted, downstream data sources were not accessed, and NetNTLMv2\ncapture through the outbound-SQL surface described in the adjacent group was\nnever demonstrated end to end.\n\nScoring. One score is published: 8.1 High,\nCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. Computed from that vector with\nCVSS 3.1 weights: ISS = 1 - (0.44 ^ 3) = 0.914816; Impact under Scope Changed =\n7.52 * 0.885816 - 3.25 * (0.870207 ^ 13) = 6.127958; Exploitability = 8.22 *\n0.85 * 0.44 * 0.50 * 0.85 = 1.306569, the PR weight being 0.50 precisely\nbecause Scope is Changed; base = 1.08 * 7.434527 = 8.029289; 8.1 after the\nceiling-to-tenth Roundup.\n\nA reading of this chain as zero-click and anonymous is withdrawn, and the\nreversal argument is printed because it is more useful than the original claim\nwas. An earlier reading asserted that an unauthenticated attacker could switch\na running Portal\u0027s repository to an attacker-controlled database and that an\nalready-installed Agent would follow the Portal onto that repository and\nexecute injected jobs there - an anonymous, remote path to SYSTEM. The Agent\nreads its repository connection string from its own configuration file, at\n`Dataedo.Agent.Startup/ServicesConfigurator.cs:43`, and exposes no controller\nand no remote-configuration endpoint of any kind, so nothing that happens to\nthe Portal\u0027s configuration propagates to an installed Agent. The propagation\nleg of the claim does not exist. A second sub-claim fell with it: that a\nhealthy, already-configured instance can be silently switched to another\nrepository. `POST /api/repository/set` answers HTTP 409 with an explicit\n\"already configured\" message, `create-on-existing-database` surfaces\n`RepositoryAlreadyConfiguredException` through `lastOperation.error`, and the\nvalidator\u0027s `IsConfigured` gate was confirmed by experiment; the HTTP 202 from\n`connect-and-upgrade` is a fire-and-forget acknowledgement that carries no\ninformation about whether any switch happened, and the subsequent state read\nshowed the configured repository unchanged. Every figure published here was\ncomputed from the vector printed beside it, and no score built on the withdrawn\npremise was carried over.\n\nAC:H carries the two conditions that remain once PR:H is granted: a Dataedo\nAgent must actually be attached to that repository database - the Agent is a\nseparately installed component, and with none attached the injected row is\nnever fetched and nothing executes - and the attacker must have a network path\nto the repository listener. Both held in the verified shape and neither is a\nproperty the product guarantees. PR:H because only a principal holding role\naction 11 or above was demonstrated to reach the disclosure, and PR:L is\nsupported by no evidence in this package. UI:N because no victim click, page\nvisit or administrator action on the Agent host participates.\n\nScope is Changed, argued on component and host grounds. The vulnerable\ncomponent is the Portal web application, whose authority ends at its own\nprocess, its application-pool or service identity and the set of resources its\nrole model governs; nothing in that model extends to a second machine. The\nimpacted component is the Dataedo Agent host - a separately installed\ncomponent, running as a separate process under a separate identity on a\nseparate machine - reached only through a third component, the repository\ndatabase, whose credentials are themselves the object of the confidentiality\nfailure. Two observations make the boundary concrete rather than merely\nadministrative: the attacker never authenticates to the Agent at all, and the\nidentity gained is not the Portal\u0027s identity in any shape, since the Portal\nruns under a web-tier identity while the outcome is a machine-level identity on\na Windows host. What Scope does NOT rest on: it is not justified by the\nanonymity of the adjacent group below, which is scored nowhere in this vector;\nnot by the CORS item or the signing-key item; and not by downstream data-source\ncompromise, which is a consequence of the Agent-host identity rather than an\nindependent scope change.\n\nThe rejected reading is printed so that the difference is auditable: 6.6\nMedium, CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, where Impact = 6.42 *\n0.914816 = 5.873095 and Exploitability = 8.22 * 0.85 * 0.44 * 0.27 * 0.85 =\n0.705547 under the Scope-Unchanged PR weight of 0.27, summing to 6.578642. It\nis rejected because the execution demonstrably occurs on another host under\nanother component\u0027s service identity, and scoring it "
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-209",
"description": "CWE-209",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-250",
"description": "CWE-250",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-284",
"description": "CWE-284",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-306",
"description": "CWE-306",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-321",
"description": "CWE-321",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-346",
"description": "CWE-346",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-347",
"description": "CWE-347",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-470",
"description": "CWE-470",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-502",
"description": "CWE-502",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-522",
"description": "CWE-522",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-732",
"description": "CWE-732",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-798",
"description": "CWE-798",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-918",
"description": "CWE-918",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-942",
"description": "CWE-942",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T07:30:02Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/15"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Oct/15"
},
{
"url": "https://0day-rubbish.com"
},
{
"url": "https://0day-rubbish.com/blog/dataedo-portal-repository-connection-string-scheduler-job-agent-rce"
},
{
"url": "https://github.com/Exploit-Garbage/0day-Rubbish"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Oct/15"
],
"discovery": "EXTERNAL"
},
"title": "[0day-rubbish] Dataedo Portal 26.2.8 with Dataedo Agent 26.2.8 unrestricted scheduler job-type deserialization to Agent-host command execution (8.1)",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0486",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/15",
"automated": true,
"contentSha256": "61b32dee00457032b5c9d39c5759cf1b7c38c4d7978d3de7112b0cf70de18d5a",
"evidenceScore": 11,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Oct/15",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-10-13T02:21:33Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-11-02T07:30:02Z",
"dateUpdated": "2026-11-02T07:30:02Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0486"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-46
Strategy: Separation of Privilege
- Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
- Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
CAPEC-116: Excavation
An adversary actively probes the target in a manner that is designed to solicit information that could be leveraged for malicious purposes.
CAPEC-13: Subverting Environment Variable Values
The adversary directly or indirectly modifies environment variables used by or controlling the target software. The adversary's goal is to cause the target software to deviate from its expected operation in a manner that benefits the adversary.
CAPEC-169: Footprinting
An adversary engages in probing and exploration activities to identify constituents and properties of the target.
CAPEC-22: Exploiting Trust in Client
An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
CAPEC-224: Fingerprinting
An adversary compares output from a target system to known indicators that uniquely identify specific details about the target. Most commonly, fingerprinting is done to determine operating system and application versions. Fingerprinting can be done passively as well as actively. Fingerprinting by itself is not usually detrimental to the target. However, the information gathered through fingerprinting often enables an adversary to discover existing weaknesses in the target.
CAPEC-285: ICMP Echo Request Ping
An adversary sends out an ICMP Type 8 Echo Request, commonly known as a 'Ping', in order to determine if a target system is responsive. If the request is not blocked by a firewall or ACL, the target host will respond with an ICMP Type 0 Echo Reply datagram. This type of exchange is usually referred to as a 'Ping' due to the Ping utility present in almost all operating systems. Ping, as commonly implemented, allows a user to test for alive hosts, measure round-trip time, and measure the percentage of packet loss.
CAPEC-287: TCP SYN Scan
An adversary uses a SYN scan to determine the status of ports on the remote target. SYN scanning is the most common type of port scanning that is used because of its many advantages and few drawbacks. As a result, novice attackers tend to overly rely on the SYN scan while performing system reconnaissance. As a scanning method, the primary advantages of SYN scanning are its universality and speed.
CAPEC-290: Enumerate Mail Exchange (MX) Records
An adversary enumerates the MX records for a given via a DNS query. This type of information gathering returns the names of mail servers on the network. Mail servers are often not exposed to the Internet but are located within the DMZ of a network protected by a firewall. A side effect of this configuration is that enumerating the MX records for an organization my reveal the IP address of the firewall or possibly other internal systems. Attackers often resort to MX record enumeration when a DNS Zone Transfer is not possible.
CAPEC-291: DNS Zone Transfers
An attacker exploits a DNS misconfiguration that permits a ZONE transfer. Some external DNS servers will return a list of IP address and valid hostnames. Under certain conditions, it may even be possible to obtain Zone data about the organization's internal network. When successful the attacker learns valuable information about the topology of the target organization, including information about particular servers, their role within the IT structure, and possibly information about the operating systems running upon the network. This is configuration dependent behavior so it may also be required to search out multiple DNS servers while attempting to find one with ZONE transfers allowed.
CAPEC-292: Host Discovery
An adversary sends a probe to an IP address to determine if the host is alive. Host discovery is one of the earliest phases of network reconnaissance. The adversary usually starts with a range of IP addresses belonging to a target network and uses various methods to determine if a host is present at that IP address. Host discovery is usually referred to as 'Ping' scanning using a sonar analogy. The goal is to send a packet through to the IP address and solicit a response from the host. As such, a 'ping' can be virtually any crafted packet whatsoever, provided the adversary can identify a functional host based on its response. An attack of this nature is usually carried out with a 'ping sweep,' where a particular kind of ping is sent to a range of IP addresses.
CAPEC-293: Traceroute Route Enumeration
An adversary uses a traceroute utility to map out the route which data flows through the network in route to a target destination. Tracerouting can allow the adversary to construct a working topology of systems and routers by listing the systems through which data passes through on their way to the targeted machine. This attack can return varied results depending upon the type of traceroute that is performed. Traceroute works by sending packets to a target while incrementing the Time-to-Live field in the packet header. As the packet traverses each hop along its way to the destination, its TTL expires generating an ICMP diagnostic message that identifies where the packet expired. Traditional techniques for tracerouting involved the use of ICMP and UDP, but as more firewalls began to filter ingress ICMP, methods of traceroute using TCP were developed.
CAPEC-294: ICMP Address Mask Request
An adversary sends an ICMP Type 17 Address Mask Request to gather information about a target's networking configuration. ICMP Address Mask Requests are defined by RFC-950, "Internet Standard Subnetting Procedure." An Address Mask Request is an ICMP type 17 message that triggers a remote system to respond with a list of its related subnets, as well as its default gateway and broadcast address via an ICMP type 18 Address Mask Reply datagram. Gathering this type of information helps the adversary plan router-based attacks as well as denial-of-service attacks against the broadcast address.
CAPEC-295: Timestamp Request
This pattern of attack leverages standard requests to learn the exact time associated with a target system. An adversary may be able to use the timestamp returned from the target to attack time-based security algorithms, such as random number generators, or time-based authentication mechanisms.
CAPEC-296: ICMP Information Request
An adversary sends an ICMP Information Request to a host to determine if it will respond to this deprecated mechanism. ICMP Information Requests are a deprecated message type. Information Requests were originally used for diskless machines to automatically obtain their network configuration, but this message type has been superseded by more robust protocol implementations like DHCP.
CAPEC-297: TCP ACK Ping
An adversary sends a TCP segment with the ACK flag set to a remote host for the purpose of determining if the host is alive. This is one of several TCP 'ping' types. The RFC 793 expected behavior for a service is to respond with a RST 'reset' packet to any unsolicited ACK segment that is not part of an existing connection. So by sending an ACK segment to a port, the adversary can identify that the host is alive by looking for a RST packet. Typically, a remote server will respond with a RST regardless of whether a port is open or closed. In this way, TCP ACK pings cannot discover the state of a remote port because the behavior is the same in either case. The firewall will look up the ACK packet in its state-table and discard the segment because it does not correspond to any active connection. A TCP ACK Ping can be used to discover if a host is alive via RST response packets sent from the host.
CAPEC-298: UDP Ping
An adversary sends a UDP datagram to the remote host to determine if the host is alive. If a UDP datagram is sent to an open UDP port there is very often no response, so a typical strategy for using a UDP ping is to send the datagram to a random high port on the target. The goal is to solicit an 'ICMP port unreachable' message from the target, indicating that the host is alive. UDP pings are useful because some firewalls are not configured to block UDP datagrams sent to strange or typically unused ports, like ports in the 65K range. Additionally, while some firewalls may filter incoming ICMP, weaknesses in firewall rule-sets may allow certain types of ICMP (host unreachable, port unreachable) which are useful for UDP ping attempts.
CAPEC-299: TCP SYN Ping
An adversary uses TCP SYN packets as a means towards host discovery. Typical RFC 793 behavior specifies that when a TCP port is open, a host must respond to an incoming SYN "synchronize" packet by completing stage two of the 'three-way handshake' - by sending an SYN/ACK in response. When a port is closed, RFC 793 behavior is to respond with a RST "reset" packet. This behavior can be used to 'ping' a target to see if it is alive by sending a TCP SYN packet to a port and then looking for a RST or an ACK packet in response.
CAPEC-300: Port Scanning
An adversary uses a combination of techniques to determine the state of the ports on a remote target. Any service or application available for TCP or UDP networking will have a port open for communications over the network.
CAPEC-301: TCP Connect Scan
An adversary uses full TCP connection attempts to determine if a port is open on the target system. The scanning process involves completing a 'three-way handshake' with a remote port, and reports the port as closed if the full handshake cannot be established. An advantage of TCP connect scanning is that it works against any TCP/IP stack.
CAPEC-302: TCP FIN Scan
An adversary uses a TCP FIN scan to determine if ports are closed on the target machine. This scan type is accomplished by sending TCP segments with the FIN bit set in the packet header. The RFC 793 expected behavior is that any TCP segment with an out-of-state Flag sent to an open port is discarded, whereas segments with out-of-state flags sent to closed ports should be handled with a RST in response. This behavior should allow the adversary to scan for closed ports by sending certain types of rule-breaking packets (out of sync or disallowed by the TCB) and detect closed ports via RST packets.
CAPEC-303: TCP Xmas Scan
An adversary uses a TCP XMAS scan to determine if ports are closed on the target machine. This scan type is accomplished by sending TCP segments with all possible flags set in the packet header, generating packets that are illegal based on RFC 793. The RFC 793 expected behavior is that any TCP segment with an out-of-state Flag sent to an open port is discarded, whereas segments with out-of-state flags sent to closed ports should be handled with a RST in response. This behavior should allow an attacker to scan for closed ports by sending certain types of rule-breaking packets (out of sync or disallowed by the TCB) and detect closed ports via RST packets.
CAPEC-304: TCP Null Scan
An adversary uses a TCP NULL scan to determine if ports are closed on the target machine. This scan type is accomplished by sending TCP segments with no flags in the packet header, generating packets that are illegal based on RFC 793. The RFC 793 expected behavior is that any TCP segment with an out-of-state Flag sent to an open port is discarded, whereas segments with out-of-state flags sent to closed ports should be handled with a RST in response. This behavior should allow an attacker to scan for closed ports by sending certain types of rule-breaking packets (out of sync or disallowed by the TCB) and detect closed ports via RST packets.
CAPEC-305: TCP ACK Scan
An adversary uses TCP ACK segments to gather information about firewall or ACL configuration. The purpose of this type of scan is to discover information about filter configurations rather than port state. This type of scanning is rarely useful alone, but when combined with SYN scanning, gives a more complete picture of the type of firewall rules that are present.
CAPEC-306: TCP Window Scan
An adversary engages in TCP Window scanning to analyze port status and operating system type. TCP Window scanning uses the ACK scanning method but examine the TCP Window Size field of response RST packets to make certain inferences. While TCP Window Scans are fast and relatively stealthy, they work against fewer TCP stack implementations than any other type of scan. Some operating systems return a positive TCP window size when a RST packet is sent from an open port, and a negative value when the RST originates from a closed port. TCP Window scanning is one of the most complex scan types, and its results are difficult to interpret. Window scanning alone rarely yields useful information, but when combined with other types of scanning is more useful. It is a generally more reliable means of making inference about operating system versions than port status.
CAPEC-307: TCP RPC Scan
An adversary scans for RPC services listing on a Unix/Linux host.
CAPEC-308: UDP Scan
An adversary engages in UDP scanning to gather information about UDP port status on the target system. UDP scanning methods involve sending a UDP datagram to the target port and looking for evidence that the port is closed. Open UDP ports usually do not respond to UDP datagrams as there is no stateful mechanism within the protocol that requires building or establishing a session. Responses to UDP datagrams are therefore application specific and cannot be relied upon as a method of detecting an open port. UDP scanning relies heavily upon ICMP diagnostic messages in order to determine the status of a remote port.
CAPEC-309: Network Topology Mapping
An adversary engages in scanning activities to map network nodes, hosts, devices, and routes. Adversaries usually perform this type of network reconnaissance during the early stages of attack against an external network. Many types of scanning utilities are typically employed, including ICMP tools, network mappers, port scanners, and route testing utilities such as traceroute.
CAPEC-310: Scanning for Vulnerable Software
An attacker engages in scanning activity to find vulnerable software versions or types, such as operating system versions or network services. Vulnerable or exploitable network configurations, such as improperly firewalled systems, or misconfigured systems in the DMZ or external network, provide windows of opportunity for an attacker. Common types of vulnerable software include unpatched operating systems or services (e.g FTP, Telnet, SMTP, SNMP) running on open ports that the attacker has identified. Attackers usually begin probing for vulnerable software once the external network has been port scanned and potential targets have been revealed.
CAPEC-312: Active OS Fingerprinting
An adversary engages in activity to detect the operating system or firmware version of a remote target by interrogating a device, server, or platform with a probe designed to solicit behavior that will reveal information about the operating systems or firmware in the environment. Operating System detection is possible because implementations of common protocols (Such as IP or TCP) differ in distinct ways. While the implementation differences are not sufficient to 'break' compatibility with the protocol the differences are detectable because the target will respond in unique ways to specific probing activity that breaks the semantic or logical rules of packet construction for a protocol. Different operating systems will have a unique response to the anomalous input, providing the basis to fingerprint the OS behavior. This type of OS fingerprinting can distinguish between operating system types and versions.
CAPEC-313: Passive OS Fingerprinting
An adversary engages in activity to detect the version or type of OS software in a an environment by passively monitoring communication between devices, nodes, or applications. Passive techniques for operating system detection send no actual probes to a target, but monitor network or client-server communication between nodes in order to identify operating systems based on observed behavior as compared to a database of known signatures or values. While passive OS fingerprinting is not usually as reliable as active methods, it is generally better able to evade detection.
CAPEC-317: IP ID Sequencing Probe
This OS fingerprinting probe analyzes the IP 'ID' field sequence number generation algorithm of a remote host. Operating systems generate IP 'ID' numbers differently, allowing an attacker to identify the operating system of the host by examining how is assigns ID numbers when generating response packets. RFC 791 does not specify how ID numbers are chosen or their ranges, so ID sequence generation differs from implementation to implementation. There are two kinds of IP 'ID' sequence number analysis - IP 'ID' Sequencing: analyzing the IP 'ID' sequence generation algorithm for one protocol used by a host and Shared IP 'ID' Sequencing: analyzing the packet ordering via IP 'ID' values spanning multiple protocols, such as between ICMP and TCP.
CAPEC-318: IP 'ID' Echoed Byte-Order Probe
This OS fingerprinting probe tests to determine if the remote host echoes back the IP 'ID' value from the probe packet. An attacker sends a UDP datagram with an arbitrary IP 'ID' value to a closed port on the remote host to observe the manner in which this bit is echoed back in the ICMP error message. The identification field (ID) is typically utilized for reassembling a fragmented packet. Some operating systems or router firmware reverse the bit order of the ID field when echoing the IP Header portion of the original datagram within an ICMP error message.
CAPEC-319: IP (DF) 'Don't Fragment Bit' Echoing Probe
This OS fingerprinting probe tests to determine if the remote host echoes back the IP 'DF' (Don't Fragment) bit in a response packet. An attacker sends a UDP datagram with the DF bit set to a closed port on the remote host to observe whether the 'DF' bit is set in the response packet. Some operating systems will echo the bit in the ICMP error message while others will zero out the bit in the response packet.
CAPEC-320: TCP Timestamp Probe
This OS fingerprinting probe examines the remote server's implementation of TCP timestamps. Not all operating systems implement timestamps within the TCP header, but when timestamps are used then this provides the attacker with a means to guess the operating system of the target. The attacker begins by probing any active TCP service in order to get response which contains a TCP timestamp. Different Operating systems update the timestamp value using different intervals. This type of analysis is most accurate when multiple timestamp responses are received and then analyzed. TCP timestamps can be found in the TCP Options field of the TCP header.
CAPEC-321: TCP Sequence Number Probe
This OS fingerprinting probe tests the target system's assignment of TCP sequence numbers. One common way to test TCP Sequence Number generation is to send a probe packet to an open port on the target and then compare the how the Sequence Number generated by the target relates to the Acknowledgement Number in the probe packet. Different operating systems assign Sequence Numbers differently, so a fingerprint of the operating system can be obtained by categorizing the relationship between the acknowledgement number and sequence number as follows: 1) the Sequence Number generated by the target is Zero, 2) the Sequence Number generated by the target is the same as the acknowledgement number in the probe, 3) the Sequence Number generated by the target is the acknowledgement number plus one, or 4) the Sequence Number is any other non-zero number.
CAPEC-322: TCP (ISN) Greatest Common Divisor Probe
This OS fingerprinting probe sends a number of TCP SYN packets to an open port of a remote machine. The Initial Sequence Number (ISN) in each of the SYN/ACK response packets is analyzed to determine the smallest number that the target host uses when incrementing sequence numbers. This information can be useful for identifying an operating system because particular operating systems and versions increment sequence numbers using different values. The result of the analysis is then compared against a database of OS behaviors to determine the OS type and/or version.
CAPEC-323: TCP (ISN) Counter Rate Probe
This OS detection probe measures the average rate of initial sequence number increments during a period of time. Sequence numbers are incremented using a time-based algorithm and are susceptible to a timing analysis that can determine the number of increments per unit time. The result of this analysis is then compared against a database of operating systems and versions to determine likely operation system matches.
CAPEC-324: TCP (ISN) Sequence Predictability Probe
This type of operating system probe attempts to determine an estimate for how predictable the sequence number generation algorithm is for a remote host. Statistical techniques, such as standard deviation, can be used to determine how predictable the sequence number generation is for a system. This result can then be compared to a database of operating system behaviors to determine a likely match for operating system and version.
CAPEC-325: TCP Congestion Control Flag (ECN) Probe
This OS fingerprinting probe checks to see if the remote host supports explicit congestion notification (ECN) messaging. ECN messaging was designed to allow routers to notify a remote host when signal congestion problems are occurring. Explicit Congestion Notification messaging is defined by RFC 3168. Different operating systems and versions may or may not implement ECN notifications, or may respond uniquely to particular ECN flag types.
CAPEC-326: TCP Initial Window Size Probe
This OS fingerprinting probe checks the initial TCP Window size. TCP stacks limit the range of sequence numbers allowable within a session to maintain the "connected" state within TCP protocol logic. The initial window size specifies a range of acceptable sequence numbers that will qualify as a response to an ACK packet within a session. Various operating systems use different Initial window sizes. The initial window size can be sampled by establishing an ordinary TCP connection.
CAPEC-327: TCP Options Probe
This OS fingerprinting probe analyzes the type and order of any TCP header options present within a response segment. Most operating systems use unique ordering and different option sets when options are present. RFC 793 does not specify a required order when options are present, so different implementations use unique ways of ordering or structuring TCP options. TCP options can be generated by ordinary TCP traffic.
CAPEC-328: TCP 'RST' Flag Checksum Probe
This OS fingerprinting probe performs a checksum on any ASCII data contained within the data portion or a RST packet. Some operating systems will report a human-readable text message in the payload of a 'RST' (reset) packet when specific types of connection errors occur. RFC 1122 allows text payloads within reset packets but not all operating systems or routers implement this functionality.
CAPEC-329: ICMP Error Message Quoting Probe
An adversary uses a technique to generate an ICMP Error message (Port Unreachable, Destination Unreachable, Redirect, Source Quench, Time Exceeded, Parameter Problem) from a target and then analyze the amount of data returned or "Quoted" from the originating request that generated the ICMP error message.
CAPEC-330: ICMP Error Message Echoing Integrity Probe
An adversary uses a technique to generate an ICMP Error message (Port Unreachable, Destination Unreachable, Redirect, Source Quench, Time Exceeded, Parameter Problem) from a target and then analyze the integrity of data returned or "Quoted" from the originating request that generated the error message.
CAPEC-472: Browser Fingerprinting
An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
CAPEC-497: File Discovery
An adversary engages in probing and exploration activities to determine if common key files exists. Such files often contain configuration and security parameters of the targeted application, system or network. Using this knowledge may often pave the way for more damaging attacks.
CAPEC-508: Shoulder Surfing
In a shoulder surfing attack, an adversary observes an unaware individual's keystrokes, screen content, or conversations with the goal of obtaining sensitive information. One motive for this attack is to obtain sensitive information about the target for financial, personal, political, or other gains. From an insider threat perspective, an additional motive could be to obtain system/application credentials or cryptographic keys. Shoulder surfing attacks are accomplished by observing the content "over the victim's shoulder", as implied by the name of this attack.
CAPEC-573: Process Footprinting
An adversary exploits functionality meant to identify information about the currently running processes on the target system to an authorized user. By knowing what processes are running on the target system, the adversary can learn about the target environment as a means towards further malicious behavior.
CAPEC-574: Services Footprinting
An adversary exploits functionality meant to identify information about the services on the target system to an authorized user. By knowing what services are registered on the target system, the adversary can learn about the target environment as a means towards further malicious behavior. Depending on the operating system, commands that can obtain services information include "sc" and "tasklist/svc" using Tasklist, and "net start" using Net.
CAPEC-575: Account Footprinting
An adversary exploits functionality meant to identify information about the domain accounts and their permissions on the target system to an authorized user. By knowing what accounts are registered on the target system, the adversary can inform further and more targeted malicious behavior. Example Windows commands which can acquire this information are: "net user" and "dsquery".
CAPEC-576: Group Permission Footprinting
An adversary exploits functionality meant to identify information about user groups and their permissions on the target system to an authorized user. By knowing what users/permissions are registered on the target system, the adversary can inform further and more targeted malicious behavior. An example Windows command which can list local groups is "net localgroup".
CAPEC-577: Owner Footprinting
An adversary exploits functionality meant to identify information about the primary users on the target system to an authorized user. They may do this, for example, by reviewing logins or file modification times. By knowing what owners use the target system, the adversary can inform further and more targeted malicious behavior. An example Windows command that may accomplish this is "dir /A ntuser.dat". Which will display the last modified time of a user's ntuser.dat file when run within the root folder of a user. This time is synonymous with the last time that user was logged in.
CAPEC-59: Session Credential Falsification through Prediction
This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
CAPEC-60: Reusing Session IDs (aka Session Replay)
This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.
CAPEC-616: Establish Rogue Location
An adversary provides a malicious version of a resource at a location that is similar to the expected location of a legitimate resource. After establishing the rogue location, the adversary waits for a victim to visit the location and access the malicious resource.
CAPEC-643: Identify Shared Files/Directories on System
An adversary discovers connections between systems by exploiting the target system's standard practice of revealing them in searchable, common areas. Through the identification of shared folders/drives between systems, the adversary may further their goals of locating and collecting sensitive information/files, or map potential routes for lateral movement within the network.
CAPEC-646: Peripheral Footprinting
Adversaries may attempt to obtain information about attached peripheral devices and components connected to a computer system. Examples may include discovering the presence of iOS devices by searching for backups, analyzing the Windows registry to determine what USB devices have been connected, or infecting a victim system with malware to report when a USB device has been connected. This may allow the adversary to gain additional insight about the system or network environment, which may be useful in constructing further attacks.
CAPEC-651: Eavesdropping
An adversary intercepts a form of communication (e.g. text, audio, video) by way of software (e.g., microphone and audio recording application), hardware (e.g., recording equipment), or physical means (e.g., physical proximity). The goal of eavesdropping is typically to gain unauthorized access to sensitive information about the target for financial, personal, political, or other gains. Eavesdropping is different from a sniffing attack as it does not take place on a network-based communication channel (e.g., IP traffic). Instead, it entails listening in on the raw audio source of a conversation between two or more parties.
CAPEC-79: Using Slashes in Alternate Encoding
This attack targets the encoding of the Slash characters. An adversary would try to exploit common filtering problems related to the use of the slashes characters to gain access to resources on the target host. Directory-driven systems, such as file systems and databases, typically use the slash character to indicate traversal between directories or other container components. For murky historical reasons, PCs (and, as a result, Microsoft OSs) choose to use a backslash, whereas the UNIX world typically makes use of the forward slash. The schizophrenic result is that many MS-based systems are required to understand both forms of the slash. This gives the adversary many opportunities to discover and abuse a number of common filtering problems. The goal of this pattern is to discover server software that only applies filters to one version, but not the other.