CWE-269

{
  "affected": [],
  "aliases": [
    "CVE-2023-41119"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-12T07:15:45Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It contains the function _dbms_aq_move_to_exception_queue that may be used to elevate a user\u0027s privileges to superuser. This function accepts the OID of a table, and then accesses that table as the superuser by using SELECT and DML commands.",
  "id": "GHSA-jrqw-cwpm-3q7j",
  "modified": "2023-12-12T09:30:32Z",
  "published": "2023-12-12T09:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41119"
    },
    {
      "type": "WEB",
      "url": "https://www.enterprisedb.com/docs/security/advisories/cve202341119"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-33089"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-11-17T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "Improper access control in the software installer for the Intel(R) NUC HDMI Firmware Update Tool for NUC8i3BE, NUC8i5BE, NUC8i7BE before version 1.78.4.0.4 may allow an authenticated user to potentially enable escalation of privilege via local access.",
  "id": "GHSA-jrxq-c3fc-77xr",
  "modified": "2022-06-29T00:00:52Z",
  "published": "2022-05-24T19:21:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33089"
    },
    {
      "type": "WEB",
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00568.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-53350"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-21T17:15:38Z",
    "severity": "HIGH"
  },
  "details": "Insecure permissions in kubeslice v1.3.1 allow attackers to gain access to the service account\u0027s token, leading to escalation of privileges.",
  "id": "GHSA-jv2m-p9xq-jqm9",
  "modified": "2025-03-24T18:30:59Z",
  "published": "2025-03-21T18:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53350"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/HouqiyuA/1cb964206e0d6bebd1c57a124c55fa03"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeslice/kubeslice"
    },
    {
      "type": "WEB",
      "url": "https://kubeslice.io/documentation/open-source/1.3.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-33771"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119",
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-14T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "Windows Kernel Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-31979, CVE-2021-34514.",
  "id": "GHSA-jv37-xg37-jxgp",
  "modified": "2025-10-22T00:32:18Z",
  "published": "2022-05-24T19:07:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33771"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-33771"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33771"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-4685"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-11-11T13:15:00Z",
    "severity": "HIGH"
  },
  "details": "A low level user of IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, 10.4.1, and 10.4.2 who has Administration rights to the server where the application is installed, can escalate their privilege from Low level to Super Admin and gain access to Create/Update/Delete any level of user in Cognos Controller. IBM X-Force ID: 186625.",
  "id": "GHSA-jv3x-w786-8ggq",
  "modified": "2022-05-24T17:34:05Z",
  "published": "2022-05-24T17:34:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-4685"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/186625"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/6339995"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-11006"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-01-11T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "An Incorrect Access Control issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53.",
  "id": "GHSA-jv66-wgjv-q2mw",
  "modified": "2022-05-24T17:38:27Z",
  "published": "2022-05-24T17:38:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11006"
    },
    {
      "type": "WEB",
      "url": "https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021"
    },
    {
      "type": "WEB",
      "url": "https://www.k7computing.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-10857"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-10-12T14:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Cybozu Office 10.0.0 to 10.6.1 allows authenticated attackers to bypass access restriction to perform arbitrary actions via \"Cabinet\" function.",
  "id": "GHSA-jv68-xppx-xmrf",
  "modified": "2022-05-13T01:41:59Z",
  "published": "2022-05-13T01:41:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10857"
    },
    {
      "type": "WEB",
      "url": "https://support.cybozu.com/ja-jp/article/9811"
    },
    {
      "type": "WEB",
      "url": "http://jvn.jp/en/jp/JVN14658424/index.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-12964"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-11-15T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "A potential privilege escalation/denial of service issue exists in the AMD Radeon Kernel Mode driver Escape 0x2000c00 Call handler. An attacker with low privilege could potentially induce a Windows BugCheck or write to leak information.",
  "id": "GHSA-jv6f-vhvr-rr75",
  "modified": "2022-07-13T00:00:43Z",
  "published": "2022-05-24T19:20:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12964"
    },
    {
      "type": "WEB",
      "url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1000"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-58104"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-25T18:15:34Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability  in the Trend Micro Apex One Security Agent Plug-in User Interface Manager could allow a local attacker to bypass existing security and execute arbitrary code on affected installations. \n\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
  "id": "GHSA-jv78-c3q7-mc62",
  "modified": "2025-03-25T18:30:54Z",
  "published": "2025-03-25T18:30:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58104"
    },
    {
      "type": "WEB",
      "url": "https://success.trendmicro.com/en-US/solution/KA-0018217"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "sentry"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "20.6.0"
            },
            {
              "fixed": "22.11.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-23485"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-284"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-12T21:27:09Z",
    "nvd_published_at": "2022-12-10T01:15:00Z",
    "severity": "MODERATE"
  },
  "details": "With a known valid invite link (i.e. not already accepted or expired) an unauthenticated attacker can manipulate the cookie to allow the same invite link to be reused on multiple accounts when joining an organization.\n\n### Impact\nAn attacker with a valid invite link can create multiple users and join the organization from which the invite link was generated.\n\n### Patches\nThis issue was patched in version 22.11.0.\n\n### Workarounds\nSentry SaaS customers do not need to take action.\n\nSelf-hosted Sentry installs can disable the invite functionality until they are ready to deploy the patched version by editing their `sentry.conf.py` file (usually located at `~/.sentry/`).\n\n1. Add the following line into `sentry.conf.py`:\n\n    ```python\n     SENTRY_FEATURES[\"organizations:invite-members\"] = False\n    ```\n2. Restart the Sentry web service.\n\n    ```\n    docker compose restart web\n    ```\n\n### For more information\nIf you have any questions or comments about this advisory:\n* [Visit our FAQs on this CVE](https://help.sentry.io/account/security/cve-2022-23485-faqs/)\n* Open an issue in [getsentry/sentry](http://github.com/getsentry/sentry)\n* Email us at security[@]sentry.io\n",
  "id": "GHSA-jv85-mqxj-3f9j",
  "modified": "2024-10-22T17:30:35Z",
  "published": "2022-12-12T21:27:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getsentry/sentry/security/advisories/GHSA-jv85-mqxj-3f9j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23485"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getsentry/sentry/commit/565f971da955d57c754a47f5802fe9f9f7c66b39"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getsentry/sentry"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/sentry/PYSEC-2022-43011.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Sentry vulnerable to invite code reuse via cookie manipulation"
}