CWE-286

{
  "affected": [],
  "aliases": [
    "CVE-2024-45425"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-286"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-25T20:15:35Z",
    "severity": "MODERATE"
  },
  "details": "Incorrect user management in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access.",
  "id": "GHSA-hp33-4xv5-445m",
  "modified": "2025-02-25T21:31:43Z",
  "published": "2025-02-25T21:31:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45425"
    },
    {
      "type": "WEB",
      "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-24037"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-13041"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-286"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-09T07:15:26Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. When a user is created via the SAML provider, the external groups setting overrides the external provider configuration. As a result, the user may not be marked as external thereby giving those users access to internal projects or groups.",
  "id": "GHSA-j94v-jxmv-27r2",
  "modified": "2025-01-09T09:31:41Z",
  "published": "2025-01-09T09:31:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13041"
    },
    {
      "type": "WEB",
      "url": "https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/#instance-saml-does-not-respect-external_provider-configuration"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/479165"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-27269"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-286"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-14T15:11:54Z",
    "severity": "MODERATE"
  },
  "details": "IBM QRadar SIEM 7.5 could allow a privileged user to configure user management that would disclose unintended sensitive information across tenants.  IBM X-Force ID:  284575.",
  "id": "GHSA-jjrv-72p3-frpm",
  "modified": "2024-05-14T15:32:52Z",
  "published": "2024-05-14T15:32:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27269"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/284575"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7150684"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-7265"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-286",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-07T11:15:45Z",
    "severity": "HIGH"
  },
  "details": "Incorrect User Management vulnerability in Naukowa i Akademicka Sie\u0107 Komputerowa - Pa\u0144stwowy Instytut Badawczy EZD RP allows logged-in user to change the password of any user, including root user, which could lead to privilege escalation.\u00a0This issue affects EZD RP: from 15 before 15.84, from 16 before 16.15, from 17 before 17.2.",
  "id": "GHSA-jvvm-gq28-8rgc",
  "modified": "2025-03-17T09:31:01Z",
  "published": "2024-08-07T12:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7265"
    },
    {
      "type": "WEB",
      "url": "https://cert.pl/en/posts/2024/08/CVE-2023-7265"
    },
    {
      "type": "WEB",
      "url": "https://cert.pl/en/posts/2024/08/CVE-2024-7265"
    },
    {
      "type": "WEB",
      "url": "https://cert.pl/posts/2024/08/CVE-2023-7265"
    },
    {
      "type": "WEB",
      "url": "https://cert.pl/posts/2024/08/CVE-2024-7265"
    },
    {
      "type": "WEB",
      "url": "https://www.gov.pl/web/ezd-rp"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:D/RE:L/U:Amber",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-22518"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-276",
      "CWE-286"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-04-07T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A bug in CmpUserMgr component can lead to only partially applied security policies. This can result in enabled, anonymous access to components part of the applied security policy.",
  "id": "GHSA-m3jp-v66f-7qcp",
  "modified": "2022-04-19T00:01:33Z",
  "published": "2022-04-08T00:00:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22518"
    },
    {
      "type": "WEB",
      "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17092\u0026token=a556b1695843bb42084dc63d5bdf553ca02ea393\u0026download="
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "Weblate"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-64725"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-286"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-15T19:58:09Z",
    "nvd_published_at": "2025-12-15T21:15:59Z",
    "severity": "LOW"
  },
  "details": "### Impact\n\nIt was possible to accept an invitation opened by a different Weblate user.\n\n### Patches\n\n* https://github.com/WeblateOrg/weblate/pull/16913\n\n### Workarounds\n\nUsers should avoid leaving Weblate sessions with an unattended opened invitation.\n\n### References\n\nThanks to Nahid0x for responsibly disclosing this vulnerability to Weblate.",
  "id": "GHSA-m6hq-f4w9-qrjj",
  "modified": "2025-12-17T00:29:24Z",
  "published": "2025-12-15T19:58:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WeblateOrg/weblate/security/advisories/GHSA-m6hq-f4w9-qrjj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64725"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WeblateOrg/weblate/pull/16913"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WeblateOrg/weblate/commit/02e904675f0608a6bbfbf9466eeccd9d022591e9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WeblateOrg/weblate"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.15"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Weblate has improper validation upon invitation acceptance"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-7972"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-286"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-14T15:15:42Z",
    "severity": "HIGH"
  },
  "details": "A security issue exists within the FactoryTalk Linx Network Browser. By modifying the process.env.NODE_ENV to \u2018development\u2019, the attacker can disable FTSP token validation. This bypass allows access to create, update, and delete FTLinx drivers.",
  "id": "GHSA-mhj6-rxgc-8472",
  "modified": "2025-10-29T21:30:32Z",
  "published": "2025-08-14T15:30:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7972"
    },
    {
      "type": "WEB",
      "url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1735.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-63563"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-286"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-31T21:15:44Z",
    "severity": "MODERATE"
  },
  "details": "Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 does not properly invalidate active user sessions after a password change. This allows an attacker with a valid session token to maintain access to the account even after the legitimate user changes their password.",
  "id": "GHSA-mjjp-hj57-wv6f",
  "modified": "2025-11-03T21:34:41Z",
  "published": "2025-10-31T21:31:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63563"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Stolichnayer/Summer-Pearl-Group-Insufficient-Session-Expiration"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-0857"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-286"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-05-11T13:15:12Z",
    "severity": "HIGH"
  },
  "details": "Unintentional change of settings during initial registration of system administrators which uses control protocols. The affected Office / Small Office Multifunction Printers and Laser Printers(*) may allow an attacker on the network segment to trigger unauthorized access to the product. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.",
  "id": "GHSA-p555-r2hc-6428",
  "modified": "2024-04-04T04:02:28Z",
  "published": "2023-05-11T15:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0857"
    },
    {
      "type": "WEB",
      "url": "https://canon.jp/support/support-info/230414vulnerability-response"
    },
    {
      "type": "WEB",
      "url": "https://psirt.canon/advisory-information/cp2023-001"
    },
    {
      "type": "WEB",
      "url": "https://www.canon-europe.com/support/product-security-latest-news"
    },
    {
      "type": "WEB",
      "url": "https://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Vulnerabilities-Remediation-Against-Buffer-Overflow"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-20253"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-286"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-09-27T18:15:11Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the command line interface (cli) management interface of Cisco SD-WAN vManage could allow an authenticated, local attacker to bypass authorization and allow the attacker to roll back the configuration on vManage controllers and edge router device.\n\n This vulnerability is due to improper access control in the cli-management interface of an affected system. An attacker with low-privilege (read only) access to the cli could exploit this vulnerability by sending a request to roll back the configuration on for other controller and devices managed by an affected system. A successful exploit could allow the attacker to to roll back the configuration on for other controller and devices managed by an affected system.",
  "id": "GHSA-p5q8-553c-rh75",
  "modified": "2024-01-25T18:30:44Z",
  "published": "2023-09-27T18:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20253"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vman-sc-LRLfu2z"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}