CWE-269

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gardener/gardener"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.116.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gardener/gardener"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.117.0"
            },
            {
              "fixed": "1.117.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gardener/gardener"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.118.0"
            },
            {
              "fixed": "1.118.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-47283"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-269"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-05-19T19:15:03Z",
    "nvd_published_at": "2025-05-19T19:15:51Z",
    "severity": "CRITICAL"
  },
  "details": "A security vulnerability was discovered in Gardener that could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed.\n\n### Am I Vulnerable?\n\nThis CVE affects all Gardener installations no matter of the public cloud provider(s) used for the seed clusters/shoot clusters.\n\n### Affected Components\n\n- `gardener/gardener`\n\n### Affected Versions\n\n- \u003c v1.116.4\n- \u003c v1.117.5\n- \u003c v1.118.2\n- \u003c v1.119.0\n\n### Fixed Versions\n\n- \u0026gt;= v1.116.4\n- \u0026gt;= v1.117.5\n- \u0026gt;= v1.118.2\n- \u0026gt;= v1.119.0\n\n### How do I mitigate this vulnerability?\n\nUpdate to a fixed version.",
  "id": "GHSA-3hw7-qj9h-r835",
  "modified": "2026-02-06T18:56:41Z",
  "published": "2025-05-19T19:15:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gardener/gardener/security/advisories/GHSA-3hw7-qj9h-r835"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47283"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gardener/gardener/commit/924b1575aae052bcda5a51fac8594d38fa3c41b0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gardener/gardener/commit/b89cf2cd5067e82f364063d5241af73650a6e11d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gardener/gardener/commit/bbd19b1dd3a31843d7b820172d37f75298dfaf8b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gardener/gardener/commit/cf4e9887d83902216b85609caf563f7a9dd2de00"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gardener/gardener"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Gardener allows bypassing project secret validation which can lead to privilege escalation"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-12981"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-24T07:16:32Z",
    "severity": "HIGH"
  },
  "details": "The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts.",
  "id": "GHSA-3j3x-65ff-623h",
  "modified": "2026-07-24T21:32:21Z",
  "published": "2026-07-24T09:32:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12981"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/79fa8b91-f88e-4249-9f17-9e98e879f6fa"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-14312"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-09-11T22:29:00Z",
    "severity": "HIGH"
  },
  "details": "Nagios Core through 4.3.4 initially executes /usr/sbin/nagios as root but supports configuration options in which this file is owned by a non-root account (and similarly can have nagios.cfg owned by a non-root account), which allows local users to gain privileges by leveraging access to this non-root account.",
  "id": "GHSA-3j4j-7q69-wj53",
  "modified": "2022-05-13T01:43:21Z",
  "published": "2022-05-13T01:43:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14312"
    },
    {
      "type": "WEB",
      "url": "https://github.com/NagiosEnterprises/nagioscore/issues/424"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201812-03"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/100881"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-36542"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-07T18:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "A vulnerability classified as critical has been found in Demokratian. This affects an unknown part of the file install/install3.php. The manipulation leads to privilege escalation. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.",
  "id": "GHSA-3j4m-48vr-7w3h",
  "modified": "2022-06-12T00:00:46Z",
  "published": "2022-06-08T00:00:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36542"
    },
    {
      "type": "WEB",
      "url": "https://alquimistadesistemas.com/sql-injection-y-archivo-peligroso-en-demokratian"
    },
    {
      "type": "WEB",
      "url": "https://bitbucket.org/csalgadow/demokratian_votaciones/commits/0d073ee461edd5f42528d41e00bf0a7b22e86bb3"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.159435"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-60567"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-21T22:17:56Z",
    "severity": "CRITICAL"
  },
  "details": "Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).",
  "id": "GHSA-3j7p-p25j-434w",
  "modified": "2026-07-22T00:31:48Z",
  "published": "2026-07-22T00:31:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60567"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-17956"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-30T01:17:00Z",
    "severity": "HIGH"
  },
  "details": "Inappropriate implementation in Scheduling in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)",
  "id": "GHSA-3j82-fv3w-55rr",
  "modified": "2026-07-30T15:31:44Z",
  "published": "2026-07-30T03:31:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17956"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/517436171"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-23128"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-05-06T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Chamilo LMS 1.11.10 does not properly manage privileges which could allow a user with Sessions administrator privilege to create a new user then use the edit user function to change this new user to administrator privilege.",
  "id": "GHSA-3jh7-8c9c-w8mx",
  "modified": "2022-05-24T19:01:40Z",
  "published": "2022-05-24T19:01:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-23128"
    },
    {
      "type": "WEB",
      "url": "https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-41-2020-04-22-Medium-risk-high-impact-CSRF-and-privilege-escalation-via-CSRF"
    },
    {
      "type": "WEB",
      "url": "https://toandak.blogspot.com/2020/05/improper-privilege-management-in.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-28251"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-12-03T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "NETSCOUT AirMagnet Enterprise 11.1.4 build 37257 and earlier has a sensor escalated privileges vulnerability that can be exploited to provide someone with administrative access to a sensor, with credentials to invoke a command to provide root access to the operating system. The attacker must complete a straightforward password-cracking exercise.",
  "id": "GHSA-3jhw-mxw2-vh5x",
  "modified": "2022-05-24T17:35:12Z",
  "published": "2022-05-24T17:35:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28251"
    },
    {
      "type": "WEB",
      "url": "https://www.netscout.com/products"
    },
    {
      "type": "WEB",
      "url": "https://www.netscout.com/securityadvisories"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-5623"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-03-19T20:59:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices. The attacker can change the bootmode of the device by issuing the \u0027fastboot oem boot_mode {rf/wlan/ftm/normal} command\u0027 in contradiction to the threat model of Android where the bootloader MUST NOT allow any security-sensitive operation to be run unless the bootloader is unlocked.",
  "id": "GHSA-3jj3-7hg7-2w24",
  "modified": "2022-05-13T01:46:13Z",
  "published": "2022-05-13T01:46:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5623"
    },
    {
      "type": "WEB",
      "url": "https://alephsecurity.com/vulns/aleph-2017005"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/97048"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-19585"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-01-06T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in rConfig 3.9.3. The install script updates the /etc/sudoers file for rconfig specific tasks. After an \"rConfig specific Apache configuration\" update, apache has high privileges for some binaries. This can be exploited by an attacker to bypass local security restrictions.",
  "id": "GHSA-3jwc-f428-ggr9",
  "modified": "2023-01-31T21:30:19Z",
  "published": "2022-05-24T17:05:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19585"
    },
    {
      "type": "WEB",
      "url": "https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_lpe.sh"
    },
    {
      "type": "WEB",
      "url": "https://raw.githubusercontent.com/v1k1ngfr/exploits/master/rconfig_lpe.sh?token="
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/156950/rConfig-3.9.4-searchField-Remote-Code-Execution.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}