CWE-284

{
  "affected": [],
  "aliases": [
    "CVE-2025-47161"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-15T20:16:08Z",
    "severity": "HIGH"
  },
  "details": "Microsoft Defender for Endpoint Elevation of Privilege Vulnerability",
  "id": "GHSA-ww93-7rhp-2gf3",
  "modified": "2025-05-15T21:31:34Z",
  "published": "2025-05-15T21:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47161"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47161"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2016-2272"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2016-04-06T23:59:00Z",
    "severity": "HIGH"
  },
  "details": "Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to have an unspecified impact via a modified cookie.",
  "id": "GHSA-wwc4-7wmq-mm63",
  "modified": "2022-05-17T03:57:27Z",
  "published": "2022-05-17T03:57:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2272"
    },
    {
      "type": "WEB",
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-061-03"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-5788"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-07T16:16:22Z",
    "severity": "HIGH"
  },
  "details": "An Improper Access Control in Ivanti EPMM before\u00a0versions 12.6.1.1, 12.7.0.1, and 12.8.0.1\u00a0allows a remote unauthenticated attacker to invoke arbitrary methods.",
  "id": "GHSA-wwfp-6c8c-qg35",
  "modified": "2026-05-07T21:30:27Z",
  "published": "2026-05-07T18:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5788"
    },
    {
      "type": "WEB",
      "url": "https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-20291"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-29T01:43:59Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the access control list (ACL) programming for port channel subinterfaces of Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, remote attacker to send traffic that should be blocked through an affected device.\n\n This vulnerability is due to incorrect hardware programming that occurs when configuration changes are made to port channel member ports. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to access network resources that should be protected by an ACL that was applied on port channel subinterfaces.",
  "id": "GHSA-wwgf-8wgf-pm54",
  "modified": "2024-02-29T03:33:17Z",
  "published": "2024-02-29T03:33:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20291"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-po-acl-TkyePgvL"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-44467"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-24T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "A broken access control vulnerability in the KillDupUsr_func function of spx_restservice allows an attacker to arbitrarily terminate active sessions of other users, causing a Denial-of-Service (DoS) condition. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.",
  "id": "GHSA-wwhw-grq6-66rj",
  "modified": "2024-09-30T15:30:43Z",
  "published": "2022-10-24T19:00:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44467"
    },
    {
      "type": "WEB",
      "url": "https://github.com/CVEProject/cvelist/blob/master/2021/44xxx/CVE-2021-44467.json"
    },
    {
      "type": "WEB",
      "url": "https://www.nozominetworks.com/blog/vulnerabilities-in-bmc-firmware-affect-ot-iot-device-security-part-1"
    },
    {
      "type": "WEB",
      "url": "https://www.nozominetworks.com/labs/vulnerability-advisories/CVE-2021-44467"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-72532"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-18T16:18:16Z",
    "severity": "MODERATE"
  },
  "details": "Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create categories via webservices endpoints.",
  "id": "GHSA-wwj2-vfcx-6xww",
  "modified": "2026-08-18T18:31:59Z",
  "published": "2026-08-18T18:31:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72532"
    },
    {
      "type": "WEB",
      "url": "https://developer.joomla.org/security-centre/1072-20260805-core-improper-acl-checks-for-category-webservice-endpoints.html"
    },
    {
      "type": "WEB",
      "url": "https://www.joomla.org"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2014-8827"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2015-01-30T11:59:00Z",
    "severity": "LOW"
  },
  "details": "LoginWindow in Apple OS X before 10.10.2 does not transition to the lock-screen state immediately upon being woken from sleep, which allows physically proximate attackers to obtain sensitive information by reading the screen.",
  "id": "GHSA-wwjg-r4fm-26qr",
  "modified": "2022-05-17T01:12:51Z",
  "published": "2022-05-17T01:12:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8827"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/100521"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html"
    },
    {
      "type": "WEB",
      "url": "http://support.apple.com/HT204244"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1031650"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-70844"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-18T21:17:40Z",
    "severity": "HIGH"
  },
  "details": "Vulnerability in the Oracle Loans product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Loans.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Loans accessible data as well as  unauthorized update, insert or delete access to some of Oracle Loans accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).",
  "id": "GHSA-wwp8-pcfr-x9p4",
  "modified": "2026-08-18T21:33:01Z",
  "published": "2026-08-18T21:33:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70844"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cspuaug2026.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34733"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-01T21:06:34Z",
    "nvd_published_at": "2026-03-31T21:16:32Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe AVideo installation script `install/deleteSystemdPrivate.php` contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition `!php_sapi_name() === \u0027cli\u0027` never evaluates to true due to how PHP resolves operator precedence. The `!` (logical NOT) operator binds more tightly than `===` (strict comparison), causing the expression to always evaluate to `false`, which means the `die()` statement never executes. As a result, the script is accessible via HTTP without authentication and will delete files from the server\u0027s temp directory while also disclosing the temp directory contents in its response.\n\n## Details\n\nThe faulty guard is at lines 2-4 of the script:\n\n```php\n// install/deleteSystemdPrivate.php:2-4\nif (!php_sapi_name() === \u0027cli\u0027) {\n    die(\u0027Command Line only\u0027);\n}\n```\n\nDue to PHP operator precedence, this expression is parsed as:\n\n```php\nif ((!php_sapi_name()) === \u0027cli\u0027) {\n```\n\nStep-by-step evaluation when accessed via HTTP (Apache/nginx with mod_php or php-fpm):\n\n1. `php_sapi_name()` returns `\"apache2handler\"` (or `\"fpm-fcgi\"`, etc.) - a non-empty string\n2. `!php_sapi_name()` applies logical NOT to a truthy string, yielding `false`\n3. `false === \u0027cli\u0027` is a strict comparison between a boolean and a string, which is always `false`\n4. The `if` body (`die()`) is never entered\n\nThe correct code should be:\n\n```php\nif (php_sapi_name() !== \u0027cli\u0027) {\n    die(\u0027Command Line only\u0027);\n}\n```\n\nAfter the bypassed guard, the script enumerates and deletes aged files from the system temp directory:\n\n```php\n$glob = glob(sys_get_temp_dir() . \"/*\");\n// ...\nforeach ($glob as $file) {\n    if (filemtime($file) \u003c $one_day_ago) {\n        unlink($file);  // Deletes the file\n    }\n}\n```\n\nThe script also outputs the total number of items found and details about processed files, leaking information about the temp directory contents.\n\nConfirmed on a live instance: an unauthenticated HTTP GET request returned HTTP 200 with the response body including \"Found total of 91 items\", confirming the guard bypass and information disclosure.\n\n## Proof of Concept\n\n**Step 1:** Verify the endpoint is accessible without authentication:\n\n```bash\ncurl -v \"https://your-avideo-instance.com/install/deleteSystemdPrivate.php\"\n```\n\nExpected response (HTTP 200):\n\n```\nFound total of 91 items\nProcessing /tmp/phpXXXXXX ...\nDeleted: /tmp/old_session_file ...\n```\n\nIf the guard were working correctly, the response would be:\n\n```\nCommand Line only\n```\n\n**Step 2:** Demonstrate the PHP operator precedence bug locally:\n\n```php\n\u003c?php\n// Simulates the bug\n$sapi = \u0027apache2handler\u0027; // non-CLI SAPI\n\n// Buggy check (as written in deleteSystemdPrivate.php)\nvar_dump(!$sapi === \u0027cli\u0027);\n// Output: bool(false) - guard never triggers\n\n// Correct check\nvar_dump($sapi !== \u0027cli\u0027);\n// Output: bool(true) - guard would trigger correctly\n?\u003e\n```\n\n**Step 3:** Monitor the effect by checking before and after:\n\n```bash\n# Check initial state\ncurl -s \"https://your-avideo-instance.com/install/deleteSystemdPrivate.php\" | head -1\n# Output: \"Found total of 91 items\"\n\n# Wait and check again - files older than 24 hours will have been deleted\ncurl -s \"https://your-avideo-instance.com/install/deleteSystemdPrivate.php\" | head -1\n# Output: \"Found total of 47 items\" (fewer items after deletion)\n```\n\n## Impact\n\nAn unauthenticated attacker can trigger deletion of files in the server\u0027s system temp directory by simply sending an HTTP request to this endpoint. The impact includes:\n\n- **File deletion**: Any files in the temp directory older than 24 hours are deleted. This can disrupt server operations by removing PHP session files, upload temp files, cache files, or files used by other applications sharing the same temp directory.\n- **Information disclosure**: The script\u0027s output reveals the full path of the temp directory and enumerates its contents, including file names and counts. This can expose internal server paths, session file names, and the presence of other applications.\n- **Denial of service**: Repeated requests can be used to continuously purge temp files, interfering with file uploads, session management, and other temp-dependent operations.\n\nThe root cause is a common PHP pitfall where the logical NOT operator (`!`) has higher precedence than strict comparison (`===`), causing the intended CLI-only guard to be completely ineffective.\n\n- **CWE-284**: Improper Access Control\n- **Severity**: Medium\n\n## Recommended Fix\n\nFix the operator precedence bug at `install/deleteSystemdPrivate.php:2` by replacing the negation with the `!==` operator:\n\n```php\n// install/deleteSystemdPrivate.php:2\n// Before (broken - always evaluates to false):\nif (!php_sapi_name() === \u0027cli\u0027) {\n\n// After (correct):\nif (php_sapi_name() !== \u0027cli\u0027) {\n```\n\n---\n*Found by [aisafe.io](https://aisafe.io)*",
  "id": "GHSA-wwpw-hrx8-79r5",
  "modified": "2026-04-01T21:06:34Z",
  "published": "2026-04-01T21:06:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-wwpw-hrx8-79r5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34733"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/355e8c70806694b3bf8605d75e1bd1c695cd95e7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-46097"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-27T18:15:05Z",
    "severity": "HIGH"
  },
  "details": "TestLink 1.9.20 is vulnerable to Incorrect Access Control in the TestPlan editing section. When a new TestPlan is created, an ID with an incremental value is automatically generated. Using the edit function you can change the tplan_id parameter to another ID. The application does not carry out a check on the user\u0027s permissions maing it possible to recover the IDs of all the TestPlans (even the administrative ones) and modify them even with minimal privileges.",
  "id": "GHSA-wwq9-rfhf-r6h9",
  "modified": "2024-09-27T21:31:50Z",
  "published": "2024-09-27T18:32:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46097"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Alkatraz97/CVEs/blob/main/CVE-2024-46097.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}