CWE-284

{
  "affected": [],
  "aliases": [
    "CVE-2015-3757"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2015-08-16T23:59:00Z",
    "severity": "LOW"
  },
  "details": "Apple OS X before 10.10.5 does not properly restrict access to the Date \u0026 Time preferences pane, which allows local users to spoof the time by visiting this pane.",
  "id": "GHSA-fchg-2fv5-95mc",
  "modified": "2022-05-17T00:51:48Z",
  "published": "2022-05-17T00:51:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3757"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT205031"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/76340"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1033276"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "devise"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-16109"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2019-09-11T22:42:42Z",
    "nvd_published_at": "2019-09-08T20:15:10Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmation_token, if a database record has a blank value in the confirmation_token column. (However, there is no scenario within Devise itself in which such database records would exist.)",
  "id": "GHSA-fcjw-8rhj-gwwc",
  "modified": "2023-01-23T20:12:32Z",
  "published": "2019-09-11T23:06:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16109"
    },
    {
      "type": "WEB",
      "url": "https://github.com/plataformatec/devise/issues/5071"
    },
    {
      "type": "WEB",
      "url": "https://github.com/plataformatec/devise/pull/5132"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/plataformatec/devise"
    },
    {
      "type": "WEB",
      "url": "https://github.com/plataformatec/devise/compare/v4.7.0...v4.7.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise/CVE-2019-16109.yml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Authentication Bypass in Devise"
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-1168"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-732"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-02-21T14:29:00Z",
    "severity": "HIGH"
  },
  "details": "This vulnerability allows local attackers to escalate privileges on vulnerable installations of ABB MicroSCADA 9.3 with FP 1-2-3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of the access controls for the installed product files. The installation procedure leaves critical files open to manipulation by any authenticated user. An attacker can leverage this vulnerability to escalate privileges to SYSTEM. Was ZDI-CAN-5097.",
  "id": "GHSA-fcm3-cc23-mg3g",
  "modified": "2022-05-13T01:33:27Z",
  "published": "2022-05-13T01:33:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1168"
    },
    {
      "type": "WEB",
      "url": "https://library.e.abb.com/public/7a88a74b12bb492ea138b1f2365d00f6/ABBVU-PGGA-33888_ABB_SoftwareVulnerabilityHandlingAdvisory_Rev_A.pdf?x-sign=MJfu9cHtRUUubpLAYzyWFTmW5W+mg3kZ/nm7F/Jw5HlFTQf4eNyfLAgE8HozRJEC"
    },
    {
      "type": "WEB",
      "url": "https://zerodayinitiative.com/advisories/ZDI-18-141"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-14338"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-14T12:16:31Z",
    "severity": "HIGH"
  },
  "details": "Polkit authentication dis isabled by default and a race\ncondition in the Polkit authorization check in versions before v0.69.0 can\nlead to the same issues as in CVE-2025-66005.",
  "id": "GHSA-fcpw-6r74-grvh",
  "modified": "2026-01-14T12:31:38Z",
  "published": "2026-01-14T12:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14338"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-14338"
    },
    {
      "type": "WEB",
      "url": "https://security.opensuse.org/2026/01/09/inputplumber-lack-of-dbus-auth.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-20325"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-21T17:15:09Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the Live Data server of Cisco Unified Intelligence Center could allow an unauthenticated, local attacker to read and modify data in a repository that belongs to an internal service on an affected device.\n\n This vulnerability is due to insufficient access control implementations on cluster configuration CLI requests. An attacker could exploit this vulnerability by sending a cluster configuration CLI request to specific directories on an affected device. A successful exploit could allow the attacker to read and modify data that is handled by an internal service on the affected device.",
  "id": "GHSA-fcrq-rvcv-57cf",
  "modified": "2024-02-21T18:31:02Z",
  "published": "2024-02-21T18:31:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20325"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuic-access-control-jJsZQMjj"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.wildfly:wildfly-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "27.0.0.Final"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-01-30T17:56:01Z",
    "nvd_published_at": "2025-01-30T15:15:18Z",
    "severity": "MODERATE"
  },
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-qr6x-62gq-4ccp. This link is maintained to preserve external references.\n\n## Original Description\nA flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. \nThe vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.",
  "id": "GHSA-fcrw-mphx-7cxf",
  "modified": "2025-01-31T17:34:23Z",
  "published": "2025-01-30T15:31:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23367"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2025-23367"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2337620"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Duplicate Advisory: Wildfly Server Role Based Access Control (RBAC) provider has Improper Access Control",
  "withdrawn": "2025-01-31T17:34:23Z"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-70983"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-23T19:15:53Z",
    "severity": "CRITICAL"
  },
  "details": "Incorrect access control in the authRoutes function of SpringBlade v4.5.0 allows attackers with low-level privileges to escalate privileges.",
  "id": "GHSA-fcx6-74v8-hjfh",
  "modified": "2026-01-23T21:30:43Z",
  "published": "2026-01-23T21:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-70983"
    },
    {
      "type": "WEB",
      "url": "https://github.com/chillzhuang/SpringBlade/issues/35"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/old6ma/9c4d2ba32cd8f562cb80796538157912"
    },
    {
      "type": "WEB",
      "url": "https://github.com/chillzhuang/SpringBlade"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/external-secrets/external-secrets"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.15.0"
            },
            {
              "fixed": "0.19.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-55196"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-08-13T19:45:15Z",
    "nvd_published_at": "2025-08-13T23:15:27Z",
    "severity": "HIGH"
  },
  "details": "## Summary\nA vulnerability was discovered in the External Secrets Operator where the `List()` calls for Kubernetes Secret and SecretStore resources performed by the `PushSecret` controller did not apply a namespace selector.  \nThis flaw allowed an attacker to use label selectors to list and read secrets/secret-stores across the cluster, bypassing intended namespace restrictions.\n\n---\n\n## Impact\nAn attacker with the ability to create or update `PushSecret` resources and control `SecretStore` configurations could exploit this vulnerability to exfiltrate sensitive data from arbitrary namespaces.  \nThis could lead to full disclosure of Kubernetes secrets, including credentials, tokens, and other sensitive information stored in the cluster.\n\n---\n\n## Exploitability\nTo exploit this vulnerability, an attacker must:\n\n1. Have permissions to create or update `PushSecret` resources.\n2. Control one or more `SecretStore` resources.\n\nWith these conditions met, the attacker could leverage label selectors to list secrets from any namespace and retrieve their contents.\n\n---\n\n## Affected Versions\n- **Vulnerable:** v0.15.0 \u2013 v0.19.1  \n- **Not Vulnerable:** v0.19.2 and later  \n\n---\n\n## Fix\nThe vulnerability was addressed in v0.19.2 by adding namespace restrictions to the `List()` calls for both `PushSecret` and `SecretStore` controllers.  \nThis ensures that only secrets in the intended namespace are accessible.\n\nRelevant fixes:\n- [#5133](https://github.com/external-secrets/external-secrets/pull/5133) \u2013 Enforce namespace selector for PushSecret `List()` calls  \n- [#5109](https://github.com/external-secrets/external-secrets/pull/5109) \u2013 Enforce namespace selector for SecretStore `List()` calls  \n\n---\n\n## Mitigation\nIf upgrading to v0.19.2 or later is not immediately possible, the following mitigations are recommended:\n\n- Restrict RBAC permissions so that only trusted service accounts can create or update `PushSecret` and `SecretStore` resources.  \n- Audit existing `PushSecret` and `SecretStore` resources to ensure they are controlled by trusted parties.  \n- Review Network Policies to prevent data exfiltration\n\n---\n\n## Credit\nThis vulnerability was reported by @gracedo and @moolen",
  "id": "GHSA-fcxq-v2r3-cc8h",
  "modified": "2025-08-14T13:31:03Z",
  "published": "2025-08-13T19:45:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/external-secrets/external-secrets/security/advisories/GHSA-fcxq-v2r3-cc8h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55196"
    },
    {
      "type": "WEB",
      "url": "https://github.com/external-secrets/external-secrets/pull/5109"
    },
    {
      "type": "WEB",
      "url": "https://github.com/external-secrets/external-secrets/pull/5133"
    },
    {
      "type": "WEB",
      "url": "https://github.com/external-secrets/external-secrets/commit/39cdba5863533007b582dc63dd300839326b2f1d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/external-secrets/external-secrets/commit/de40e8f4fa9559c1d770bb674589b285da5ef2d1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/external-secrets/external-secrets"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "External Secrets Operator\u0027s Missing Namespace Restriction Allows Unauthorized Secret Access"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-3786"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-07-20T13:15:11Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability classified as problematic has been found in Aures Komet up to 20230509. This affects an unknown part of the component Kiosk Mode. The manipulation leads to improper access controls. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier VDB-235053 was assigned to this vulnerability.",
  "id": "GHSA-ff5p-pc9j-wj2w",
  "modified": "2023-07-20T18:33:43Z",
  "published": "2023-07-20T18:33:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3786"
    },
    {
      "type": "WEB",
      "url": "https://seclists.org/fulldisclosure/2023/Jul/40"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.235053"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.235053"
    },
    {
      "type": "WEB",
      "url": "https://www.vulnerability-lab.com/get_content.php?id=2323"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-62484"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-21T22:19:04Z",
    "severity": "MODERATE"
  },
  "details": "Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Contracts Integration.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Contracts Integration accessible data. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).",
  "id": "GHSA-ff5r-g2gv-9vfq",
  "modified": "2026-07-22T00:32:30Z",
  "published": "2026-07-22T00:32:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62484"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}