CWE-668

{
  "affected": [],
  "aliases": [
    "CVE-2022-26090"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-668"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-04-11T20:15:00Z",
    "severity": "LOW"
  },
  "details": "Improper access control vulnerability in SamsungContacts prior to SMR Apr-2022 Release 1 allows that attackers can access contact information without permission.",
  "id": "GHSA-2hgf-c2v6-4f32",
  "modified": "2022-04-20T00:01:06Z",
  "published": "2022-04-12T00:00:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26090"
    },
    {
      "type": "WEB",
      "url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2022\u0026month=4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-24074"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-668",
      "CWE-732"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-03-17T06:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could lead to controlling Whale Bridge if the rendering process compromises.",
  "id": "GHSA-2hh3-2vjw-vgr4",
  "modified": "2022-03-24T00:00:31Z",
  "published": "2022-03-18T00:01:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24074"
    },
    {
      "type": "WEB",
      "url": "https://cve.naver.com/detail/cve-2022-24074"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-46937"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-668"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-27T10:15:08Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/dbgfs: fix \u0027struct pid\u0027 leaks in \u0027dbgfs_target_ids_write()\u0027\n\nDAMON debugfs interface increases the reference counts of \u0027struct pid\u0027s\nfor targets from the \u0027target_ids\u0027 file write callback\n(\u0027dbgfs_target_ids_write()\u0027), but decreases the counts only in DAMON\nmonitoring termination callback (\u0027dbgfs_before_terminate()\u0027).\n\nTherefore, when \u0027target_ids\u0027 file is repeatedly written without DAMON\nmonitoring start/termination, the reference count is not decreased and\ntherefore memory for the \u0027struct pid\u0027 cannot be freed.  This commit\nfixes this issue by decreasing the reference counts when \u0027target_ids\u0027 is\nwritten.",
  "id": "GHSA-2hrm-9gxc-3c35",
  "modified": "2024-04-10T21:30:28Z",
  "published": "2024-02-27T12:31:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46937"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ebb3f994dd92f8fb4d70c7541091216c1e10cb71"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ffe4a1ba1a82c416a6b3a09d46594f6a885ae141"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-1467"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-668"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-05-23T20:16:00Z",
    "severity": "CRITICAL"
  },
  "details": "Windows OS can be configured to overlay a \u201clanguage bar\u201d on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewable in the browser alongside the AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere applications. It is possible to manipulate the Windows OS language bar to launch an OS command prompt, resulting in a context-escape from application into OS.",
  "id": "GHSA-2hvg-pfw9-r56c",
  "modified": "2022-06-08T00:00:59Z",
  "published": "2022-05-24T00:00:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1467"
    },
    {
      "type": "WEB",
      "url": "https://www.aveva.com/en/support-and-success/cyber-security-updates"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-130-05"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.1.2"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/lima-vm/lima/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53657"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-276",
      "CWE-668"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-14T19:24:33Z",
    "nvd_published_at": "2026-07-10T17:16:57Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nOn an instance of Lima running with `qemu` driver, an arbitrary user in the VM could access `/run/lima-guestagent.sock` when the guest agent is enabled.\n\nThis could result in running an arbitrary command with the root privileges in the VM (**not on the host**), as `lima-guestagent.sock` provides the tunneling service for an arbitrary address, including a Unix socket address for privileged daemons like D-Bus.\n\nThis vulnerability is not exploitable on `vz` driver, as the guest agent uses vsocks instead of Unix sockets.\n\n### Patches\nPatched in Lima v2.1.3 (8a45892378d22f40505c31a38f786a07701b6d50)\n\n\u003e [!NOTE]\n\u003e The default user account in the VM can still run an arbitrary command as the root via the guest agent socket.\n\u003e This is not a vulnerability, as the user can already run an arbitrary command with `sudo` by design.\n\n### Workarounds\n- On macOS hosts, use `vz` driver instead of `qemu` (`limactl create --vm-type=vz`. Default since v1.0.)\n- Or, disable the guest agent (`limactl create --plain`)",
  "id": "GHSA-2j9v-p4xj-cjw2",
  "modified": "2026-08-14T19:24:33Z",
  "published": "2026-08-14T19:24:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lima-vm/lima/security/advisories/GHSA-2j9v-p4xj-cjw2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53657"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lima-vm/lima/commit/8a45892378d22f40505c31a38f786a07701b6d50"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lima-vm/lima/commit/b08cae8a670cf916d5da11c48a6de76dabd89678"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lima-vm/lima"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lima-vm/lima/releases/tag/v2.1.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-1146"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-668"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-23T00:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Inappropriate implementation in Resource Timing in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to leak cross-origin data via a crafted HTML page.",
  "id": "GHSA-2jg4-f9f6-jf7m",
  "modified": "2022-07-28T00:00:48Z",
  "published": "2022-07-24T00:00:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1146"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html"
    },
    {
      "type": "WEB",
      "url": "https://crbug.com/1290150"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202208-25"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-33751"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-668"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-16T22:15:00Z",
    "severity": "HIGH"
  },
  "details": "CA Automic Automation 12.2 and 12.3 contain an insecure memory handling vulnerability in the Automic agent that could allow a remote attacker to potentially access sensitive data.",
  "id": "GHSA-2ph8-rh6h-6gpc",
  "modified": "2022-06-28T00:00:44Z",
  "published": "2022-06-17T00:01:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-33751"
    },
    {
      "type": "WEB",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/20629"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-21356"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-668"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-08-06T23:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An information disclosure vulnerability in upload.php of PopojiCMS 1.2 leads to physical path disclosure of the host when \u0027name = \"file\" is deleted during file uploads.",
  "id": "GHSA-2pqp-x768-f3m2",
  "modified": "2022-05-24T19:10:22Z",
  "published": "2022-05-24T19:10:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-21356"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PopojiCMS/PopojiCMS/issues/23"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:http_request"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-36901"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-256",
      "CWE-668"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-08-10T18:30:41Z",
    "nvd_published_at": "2022-07-27T15:15:00Z",
    "severity": "LOW"
  },
  "details": "HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file `jenkins.plugins.http_request.HttpRequest.xml` on the Jenkins controller as part of its configuration when using (deprecated) Basic/Digest Authentication. These passwords can be viewed by users with access to the Jenkins controller file system.",
  "id": "GHSA-2qh6-hhvv-m2ww",
  "modified": "2022-12-09T17:01:35Z",
  "published": "2022-07-28T00:00:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36901"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jenkinsci/http-request-plugin/commit/a2cf3454a8752759b092c23cadc156dfd2943c42"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jenkinsci/http-request-plugin"
    },
    {
      "type": "WEB",
      "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2053"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Jenkins HTTP Request Plugin stores HTTP Request passwords unencrypted"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-27621"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-668"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-06-09T14:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Information Disclosure vulnerability in UserAdmin application in SAP NetWeaver Application Server for Java, versions - 7.11,7.20,7.30,7.31,7.40 and 7.50 allows attackers to access restricted information by entering malicious server name.",
  "id": "GHSA-2rpq-3585-p54f",
  "modified": "2022-07-13T00:01:13Z",
  "published": "2022-05-24T19:04:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27621"
    },
    {
      "type": "WEB",
      "url": "https://launchpad.support.sap.com/#/notes/3023299"
    },
    {
      "type": "WEB",
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}