Threats Tagged 'cwe-250'

CVE-2026-54319 is a path traversal vulnerability in daytonaio's daytona product prior to version 0.186. The issue arises because sandbox volume references used to build host bind-mount source paths were not properly confined, allowing path-traversal sequences to potentially escape the intended directory. This vulnerability has a medium severity with a CVSS score of 4.2 and is fixed in version 0.186.

Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to elevate privileges over a network.

IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions (create, delete, get, list, patch, update, watch) on core/v1 Secrets. The controller never accesses Secrets during normal operation. If the controller pod were compromised (e.g. via supply chain attack or container escape), an attacker could leverage these excessive permissions to read, modify, or delete Secrets in the namespace, potentially exposing credentials and other sensitive data. This issue has been patched in versions 1.11.7, 1.12.4, and 1.13.0.

A local privilege escalation vulnerability (CWE-250) exists in Broadcom Symantec Endpoint Protection CleanWipe Removal Tool for macOS prior to version 16.0.0.65. This vulnerability allows an attacker with limited privileges to escalate their privileges to administrative level. The CVSS 4.0 base score is 5.4, indicating a medium severity. No patch or official remediation has been confirmed yet. The vulnerability affects versions prior to 16.0.0.65. No known exploits are reported in the wild at this time.

Winlogon Elevation of Privilege Vulnerability

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected system includes a binary that is configured with the cap_dac_override capability. This capability allows the process to bypass file system permission checks, resulting in unrestricted file system access. This could allow a local attacker to escalate privileges leading to arbitrary file modification and gaining root privileges on the system.

A local privilege escalation vulnerability exists in Forcepoint VPN Client that allows a local non-administrative user to escalate privileges to SYSTEM. This issue affects VPN Client for Windows: versions 6.11.3 and prior.

Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

Execution with Unnecessary Privileges, : Improper Protection of Alternate Path vulnerability in TR7 Application Security Platform (ASP) allows Privilege Escalation, -Privilege Abuse. This issue affects Application Security Platform (ASP): v1.4.25.188.

Red Hat OpenShift Data Foundation 4.20.9 security, enhancement & bug fix update.