CWE-749

{
  "affected": [],
  "aliases": [
    "CVE-2023-38124"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-749"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-03T03:15:10Z",
    "severity": "HIGH"
  },
  "details": "Inductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the Ignition Gateway server. The issue results from the exposure of a dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-20541.",
  "id": "GHSA-fj6x-xhq4-hq99",
  "modified": "2024-05-03T03:30:56Z",
  "published": "2024-05-03T03:30:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38124"
    },
    {
      "type": "WEB",
      "url": "https://inductiveautomation.com/blog/inductive-automation-participates-in-pwn2own-to-strengthen-ignition-security"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1015"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-14496"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-749"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-23T22:15:50Z",
    "severity": "HIGH"
  },
  "details": "RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27678.",
  "id": "GHSA-fwjp-3g6w-x33q",
  "modified": "2025-12-24T00:30:16Z",
  "published": "2025-12-24T00:30:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14496"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1171"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "nx"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "17.0.4"
            },
            {
              "fixed": "22.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "nx"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "23.0.0-beta.0"
            },
            {
              "fixed": "23.0.0-beta.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54753"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-749",
      "CWE-942"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-31T16:50:24Z",
    "nvd_published_at": "2026-06-26T19:16:43Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe local HTTP server started by `nx graph` sent `Access-Control-Allow-Origin: *` on every response, letting any website a developer visited read the server\u0027s responses cross-origin \u2014 including the full project graph and the output of the `/help` endpoint, which runs a target\u0027s configured help command. The practical impact is typically **cross-origin information disclosure**, but can be arbitrary command injection in rare cases.\n\n## Severity\n\n\nExploitation requires the developer to be running `nx graph` and to visit an attacker page. Any execution beyond benign help commands also requires a malicious target to already be present in the workspace (see Details).\n\n## Affected \u0026 Patched Versions\n\nPackage: `nx` (npm).\n\n- **Affected:** `\u003e= 17.0.4, \u003c 22.7.2` and `\u003e= 23.0.0-beta.0, \u003c 23.0.0-beta.2`\n- **Patched:** `22.7.2`+ (backport) and `23.0.0` (first in `23.0.0-beta.2`)\n\nThe wildcard CORS header was introduced in `17.0.4`; the `/help` execution endpoint in `19.4.0`. **The `21.x` line is not patched** \u2014 `21.x` users should upgrade to `22.7.2` or later.\n\n## Details\n\n`nx graph` starts a local server (default `http://127.0.0.1:4211`). Before the fix, its request handler set a wildcard CORS header on every response:\n\n```ts\nres.setHeader(\u0027Access-Control-Allow-Origin\u0027, \u0027*\u0027);\n```\n\nThe `/help` endpoint runs a target\u0027s configured command:\n\n```ts\nconst command = target.metadata?.help?.command;\nreturn execSync(command, { cwd: target.options?.cwd ?? workspaceRoot }).toString();\n```\n\nA `GET /help` is a CORS \"simple request\", so a malicious page could `fetch()` it with no preflight, and the wildcard header let the page read the result. This exposes the project graph (project names, file paths, dependencies, build configuration) and the output of any configured help command.\n\nThe command is not attacker-controlled through the request \u2014 it comes from the workspace\u0027s project configuration, and first-party plugins (jest, vite, cypress) populate it with benign, read-only help commands. For `/help` to run anything malicious, a target carrying a malicious `help.command` must already exist in the project graph, which can only be introduced by **installing a malicious package** or by **altering the workspace\u0027s own code/configuration** \u2014 both of which already grant code execution independent of this flaw.\n\nThe fix ([#35494](https://github.com/nrwl/nx/pull/35494)) removes the header; the browser\u0027s same-origin policy then blocks cross-origin reads.\n\n## References\n\n- Fix: [nrwl/nx#35494](https://github.com/nrwl/nx/pull/35494)\n- Introduced: [nrwl/nx#20744](https://github.com/nrwl/nx/pull/20744) (CORS), [nrwl/nx#26629](https://github.com/nrwl/nx/pull/26629) (`/help`)\n\n## Credits\n\nThanks to Nozomu Sasaki (Paul) ([@morimori-dev](https://github.com/morimori-dev)) for finding and responsibly reporting this issue.",
  "id": "GHSA-g2r8-wvmj-jf5w",
  "modified": "2026-07-31T16:50:24Z",
  "published": "2026-07-31T16:50:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nrwl/nx/security/advisories/GHSA-g2r8-wvmj-jf5w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54753"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nrwl/nx/pull/35494"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nrwl/nx/commit/7620c1ffe598086ce5e66457c7e6e38799bb499d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nrwl/nx/commit/e59122c5569cf201561b9995ce4e34a304f4fb03"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nrwl/nx"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nrwl/nx/releases/tag/22.7.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "`nx graph` dev server permissive CORS policy"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.0.0-beta.3"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@vitest/browser"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-beta.0"
            },
            {
              "fixed": "5.0.0-beta.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.1.7"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@vitest/browser"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.1.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.2.4"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@vitest/browser"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.2.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.1.23"
      },
      "package": {
        "ecosystem": "npm",
        "name": "vite-plus"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.24"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53633"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-749",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-15T20:05:15Z",
    "nvd_published_at": "2026-07-14T20:17:42Z",
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\nVitest Browser Mode exposes a `cdp()` API that forwards raw Chrome DevTools Protocol (CDP) methods over the Vitest browser WebSocket RPC. CDP is not gated by `browser.api.allowWrite`, `browser.api.allowExec`, `api.allowWrite`, or `api.allowExec`.\n\nAs a result, disabling Browser Mode write and exec operations does not prevent a browser API client from using CDP to perform equivalent actions. In a verified reproduction with `allowWrite: false` and `allowExec: false`, CDP `Page.setDownloadBehavior` set the browser download directory to the project root, and CDP `Runtime.evaluate` downloaded a controlled `vite.config.ts`. Vitest reloaded the changed config and executed attacker-controlled Node.js code.\n\nWhen the Browser Mode API is also exposed to the network, this becomes remotely exploitable because the generated browser runner page exposes the API token, active session id, project name, and project root path needed to connect to the browser WebSocket API and select the target download directory.\n\n## Impact\n\nThis affects Browser Mode projects using a CDP-capable provider, such as Playwright Chromium, when the browser API server is exposed to the network, for example with `--browser.api.host=0.0.0.0`.\n\nIn this mode Vitest warns that write and exec operations are disabled by default, but the generated browser runner page exposes enough metadata for a remote client to authenticate to the browser WebSocket API while an active session exists. This includes the browser API token, active session id, project name, and serialized test config including the project root path. The attacker can then call Vitest\u0027s CDP RPC and use Chrome\u0027s download controls to overwrite `vite.config.ts` in the project root. When Vitest reloads the changed config, attacker-controlled Node.js code executes on the host running Vitest.\n\nThe same exposed CDP bridge also allows direct browser-session JavaScript execution through `Runtime.evaluate`. A separate local probe showed that CDP can navigate the browser to a `file://` URL and read rendered file contents, but the primary verified impact is config-file overwrite leading to RCE.\n\n## Reproduction\n\nFor a concrete reproduction, start Browser Mode in watch mode using the official Lit example:\n\n```sh\npnpm dlx tiged vitest-dev/vitest/examples/lit vitest-poc\ncd vitest-poc\npnpm install\n```\n\nConfigure the Browser Mode API to listen on all interfaces while explicitly disabling write and exec operations:\n\n```ts\nimport { playwright } from \u0027@vitest/browser-playwright\u0027\nimport { defineConfig } from \u0027vite\u0027\n\nexport default defineConfig({\n  test: {\n    browser: {\n      enabled: true,\n      provider: playwright(),\n      instances: [\n        { browser: \u0027chromium\u0027 },\n      ],\n      api: {\n        host: \u00270.0.0.0\u0027,\n        allowWrite: false,\n        allowExec: false,\n      },\n    },\n  },\n})\n```\n\nThen start the test server:\n\n```sh\npnpm test\n```\n\nVitest serves the browser runner HTML and WebSocket API at `http://localhost:63315`.\n\nWhile the browser session is active:\n\n1. Fetch the generated browser runner page:\n\n   ```text\n   http://localhost:63315/__vitest_test__/\n   ```\n\n2. Extract the embedded browser API token, active session id, project name, and project root:\n\n   - `window.VITEST_API_TOKEN`\n   - `__vitest_browser_runner__.sessionId`\n   - `__vitest_browser_runner__.config.name`\n   - `__vitest_browser_runner__.config.root`\n\n3. Connect to the browser API WebSocket as a tester client:\n\n   ```text\n   /__vitest_browser_api__?type=tester\u0026rpcId=\u003cfresh-id\u003e\u0026sessionId=\u003csession-id\u003e\u0026projectName=\u003cproject-name\u003e\u0026method=none\u0026token=\u003ctoken\u003e\n   ```\n\n4. Call the `sendCdpEvent` RPC method with:\n\n   ```text\n   Page.setDownloadBehavior({\n     behavior: \"allow\",\n     downloadPath: __vitest_browser_runner__.config.root\n   })\n   ```\n\n5. Call `sendCdpEvent` again with `Runtime.evaluate`. The evaluated JavaScript creates a Blob containing a malicious Vite config and clicks an anchor element `\u003ca download=\"vite.config.ts\"\u003e`.\n\n6. Observed result:\n\n   - `vite.config.ts` is overwritten with attacker-controlled content.\n   - Vitest reloads the changed config.\n   - The injected Node.js payload runs on the host.",
  "id": "GHSA-g8mr-85jm-7xhm",
  "modified": "2026-08-13T18:19:32Z",
  "published": "2026-06-15T20:05:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-g8mr-85jm-7xhm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53633"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/pull/10444"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/pull/10450"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/pull/10456"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/commit/385a1aefd4c2bfa5e7d58bf7c6834c929969f2c7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/commit/63e3b2eee4d58da56786a6333f517b9b492528c7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/commit/e4067b3b150005fd42cf75f994300119245806b9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vitest-dev/vitest"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/releases/tag/v3.2.5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-66781"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312",
      "CWE-749"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-18T17:17:00Z",
    "severity": "MODERATE"
  },
  "details": "A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPsec pre-shared key (PSK) in an unencrypted format. This key, which is critical for securing communication between Kubernetes clusters, can be accessed by unauthorized parties. Such access enables an attacker to passively decrypt network traffic flowing between any two clusters in the mesh, resulting in sensitive information disclosure.",
  "id": "GHSA-gcch-g8g2-6852",
  "modified": "2026-08-27T06:31:23Z",
  "published": "2026-08-18T18:32:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66781"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:60386"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:60387"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:60388"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:60389"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:60390"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:60391"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-66781"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507526"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.sap.cloud.security:java-security"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.17.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.sap.cloud.security:java-security"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.sap.cloud.security.xsuaa:spring-xsuaa"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.17.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.sap.cloud.security.xsuaa:spring-xsuaa"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.sap.cloud.security:spring-security"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.17.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.sap.cloud.security:spring-security"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-639",
      "CWE-749"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-15T03:53:07Z",
    "nvd_published_at": "2023-12-12T02:15:08Z",
    "severity": "CRITICAL"
  },
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-59c9-pxq8-9c73. This link is maintained to preserve external references.\n\n## Original Description\nSAP\u00a0BTP\u00a0Security Services Integration Library ([Java] cloud-security-services-integration-library) -\u00a0versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.\n\n",
  "id": "GHSA-gcgw-q47m-prvj",
  "modified": "2024-09-30T18:52:44Z",
  "published": "2023-12-12T03:31:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-59c9-pxq8-9c73"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50422"
    },
    {
      "type": "WEB",
      "url": "https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/SAP/cloud-security-services-integration-library"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3411067"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3413475"
    },
    {
      "type": "WEB",
      "url": "https://mvnrepository.com/artifact/com.sap.cloud.security.xsuaa/spring-xsuaa"
    },
    {
      "type": "WEB",
      "url": "https://mvnrepository.com/artifact/com.sap.cloud.security/java-security"
    },
    {
      "type": "WEB",
      "url": "https://mvnrepository.com/artifact/com.sap.cloud.security/spring-security"
    },
    {
      "type": "WEB",
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Duplicate Advisory: Improper JWT Signature Validation in SAP Security Services Library ",
  "withdrawn": "2024-09-30T18:52:44Z"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-51581"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-749"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-03T03:16:17Z",
    "severity": "CRITICAL"
  },
  "details": "Voltronic Power ViewPower MacMonitorConsole Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the MacMonitorConsole class. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22034.",
  "id": "GHSA-h5v5-9632-6pph",
  "modified": "2024-05-03T03:31:07Z",
  "published": "2024-05-03T03:31:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51581"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1886"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-51575"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-749"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-03T03:16:16Z",
    "severity": "CRITICAL"
  },
  "details": "Voltronic Power ViewPower MonitorConsole Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the MonitorConsole class. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22011.",
  "id": "GHSA-h7cw-m84h-c746",
  "modified": "2024-05-03T03:31:07Z",
  "published": "2024-05-03T03:31:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51575"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1881"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-5389"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-749"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-30T20:15:45Z",
    "severity": "CRITICAL"
  },
  "details": "\nAn attacker could potentially exploit this vulnerability, leading to the ability to modify files on Honeywell Experion VirtualUOC and UOC . This exploit could be used to write a file that may result in unexpected behavior based on configuration changes or updating of files that could result in subsequent execution of a malicious application if triggered. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning.\u00a0",
  "id": "GHSA-h7wp-7q3v-7m5w",
  "modified": "2024-02-08T15:30:26Z",
  "published": "2024-01-30T21:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5389"
    },
    {
      "type": "WEB",
      "url": "https://process.honeywell.com"
    },
    {
      "type": "WEB",
      "url": "https://www.honeywell.com/us/en/product-security"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-45489"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-290",
      "CWE-749"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-03T21:17:00Z",
    "severity": "MODERATE"
  },
  "details": "Microsoft Edge (Chromium-based) Spoofing Vulnerability",
  "id": "GHSA-h8wv-x2gq-wqw9",
  "modified": "2026-07-03T21:31:38Z",
  "published": "2026-07-03T21:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45489"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45489"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}