#cwe-250

共收录 89 条相关情报。

漏洞预警2026-07-09 发布INFO

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] XAPI can configure different users with differ...

CVE-2026-23559

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

历史摘要 · 未重新核验 · NVD

#cve #cwe-250

安全公告2026-06-30 发布INFO

Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation

CVE-2026-50566

### Summary A follow-up bypass of the round-4 PodSpec hardening (GHSA-gx55-f84r-v3r7, GHSA-wmgg-3p4h-48x7, GHSA-v455-mv

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-250 #cwe-269 #severity:critical

安全公告2026-06-30 发布INFO

Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container

CVE-2026-50565

### Summary Fission builder pods were created with `ServiceAccountName: fission-builder` and no `AutomountServiceAccoun

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-250 #cwe-269 #cwe-538 #severity:medium

漏洞预警2026-06-23 发布INFO

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.186, a sandbox volume reference (volumeId, which may also ...

CVE-2026-54319

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.1

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-250 #cwe-269

安全公告2026-06-19 发布INFO

Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to elevate...

CVE-2026-48584

Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to elevate privileges over a networ

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-250 #severity:critical

漏洞预警2026-06-19 发布CRITICAL

Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to elevate privileges over a network.

CVE-2026-48584

CVE-2026-48584 是 Azure Synapse Analytics 中的一个严重权限提升漏洞。该漏洞源于组件在执行操作时未充分验证权限，导致已获得低权限授权的攻击者可以利用不必要的权限执行特权操作。攻击者无需任何用户交互，只需

历史摘要 · 未重新核验 · NVD

#cve #cwe-250

安全公告2026-06-18 发布INFO

Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape

CVE-2026-54319

## Summary A sandbox volume reference (`volumeId`, which may also be a volume name) was forwarded to the runner and used

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-20 #cwe-22 #cwe-250 #cwe-269

漏洞预警2026-06-18 发布INFO

A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled en...

CVE-2026-12505

A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges befor

历史摘要 · 未重新核验 · NVD

#cve #cwe-250

漏洞预警2026-06-12 发布INFO

IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions (cr...

CVE-2026-47190

IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM c

历史摘要 · 未重新核验 · NVD

#cve #cwe-250

漏洞预警2026-06-11 发布INFO

Inappropriate implementation in Headless in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a san...

CVE-2026-12027

Inappropriate implementation in Headless in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had comp

历史摘要 · 未重新核验 · NVD

#cve #cwe-250 #cwe-693

漏洞预警2026-06-09 发布INFO

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected system includes a binary that is configured with the cap_dac_override capabilit...

CVE-2026-46748

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected system includes a bina

历史摘要 · 未重新核验 · NVD

#cve #cwe-250

安全公告2026-06-08 发布INFO

actual Allows Electron to Run As Node

CVE-2026-42890

## Summary A electron run as node vulnerability was identified in `actual` (macOS application, version `25.x (Electron

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-94 #cwe-250 #cwe-693 #severity:medium

漏洞预警2026-06-04 发布INFO

Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perf...

CVE-2026-11167

Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who

历史摘要 · 未重新核验 · NVD

#cve #cwe-250

漏洞预警2026-06-04 发布HIGH

A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are provisioned with account-wide scope for destructive actions ...

CVE-2026-10843

A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are pro

来源摘录 · NVD

#cve #cwe-250

安全公告2026-06-03 发布INFO

Local privilege escalation due to excessive permissions assigned to child processes. The...

CVE-2026-42061

Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-250 #severity:high

漏洞预警2026-06-03 发布INFO

Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051...

CVE-2026-42061

Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected

历史摘要 · 未重新核验 · NVD

#cve #cwe-250

漏洞预警2026-05-28 发布INFO

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.29.1 and 1.28.3, the CloudNativePG metrics exporter opens its Post...

CVE-2026-44477

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.29.1 and

历史摘要 · 未重新核验 · NVD

#cve #cwe-250 #cwe-271 #cwe-426

漏洞预警2026-05-27 发布INFO

IBM Netezza Performance Server Replication Services 3.0.2.0 through 3.0.5.0 allows an attacker with low‑privileged access to escalate their privileges to root. By exploiting thi...

CVE-2026-3623

IBM Netezza Performance Server Replication Services 3.0.2.0 through 3.0.5.0 allows an attacker with low‑privileged acces

历史摘要 · 未重新核验 · NVD

#cve #cwe-250

安全公告2026-05-19 发布INFO

Execution with unnecessary privileges vulnerability in Broadcom Automic Automation Agent Unix on...

CVE-2026-8370

Execution with unnecessary privileges vulnerability in Broadcom Automic Automation Agent Unix on Linux x64, Linux Power

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-250 #severity:high

漏洞预警2026-05-19 发布INFO

Execution with unnecessary privileges vulnerability in Broadcom Automic Automation Agent Unix on Linux x64, Linux Power 64 BE, Linux Power 64 LE, zLinux (zSeries), AIX, Solaris ...

CVE-2026-8370

Execution with unnecessary privileges vulnerability in Broadcom Automic Automation Agent Unix on Linux x64, Linux Power

历史摘要 · 未重新核验 · NVD

#cve #cwe-250