Base de CVEs

CVE-2021-47700 Alta · 7.8 CWE-250 30/10/2025

Nagios XI < 5.8.7 Insecure Permissions on Highcharts Temporary Directory

Nagios XI versions prior to 5.8.7 used a temporary directory for Highcharts exports with overly permissive ownership/permissions under the Apache user. Local or co-hosted processes could read/overwrite export artifacts or manipulate paths, risking disclosure or tampering and potential code execution depending on deployment.

CVE-2018-25123 Alta · 7.8 CWE-250 30/10/2025

Nagios XI < 5.5.7 Privilege Escalation via MRTG Graphing Component

Nagios XI versions prior to 5.5.7 contain a privilege escalation vulnerability in the MRTG graphing component. MRTG-related processes/scripts executed with excessive privileges, allowing a local attacker with limited system access to abuse file/command execution paths or writable resources to gain elevated privileges.

CVE-2025-36137 Alta · 7.2 CWE-250 30/10/2025

IBM Sterling Connect:Direct for UNIX command execution

IBM Sterling Connect Direct for Unix 6.2.0.7 through 6.2.0.9 iFix004, 6.4.0.0 through 6.4.0.2 iFix001, and 6.3.0.2 through 6.3.0.5 iFix002 incorrectly assigns permissions for maintenance tasks to Control Center Director (CCD) users that could allow a privileged user to escalate their privileges further due to unnecessary privilege assignment for post update scripts.

CVE-2025-62503 Média · 4.6 CWE-250 30/10/2025

Apache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

CVE-2025-62402 Média · 5.4 CWE-250 30/10/2025

Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API

API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.

CVE-2025-43017 Crítica · 9.8 CWE-250 28/10/2025

HP ThinPro 8.1 SP8 Security Updates

HP ThinPro 8.1 System management application failed to verify user's true id. HP has released HP ThinPro 8.1 SP8, which includes updates to mitigate potential vulnerabilities.

CVE-2025-6949 Crítica · 9.3 CWE-250 17/10/2025

Appliances de Segurança de Rede e Roteadores Moxa: Privilégios Desnecessários na API Permitem Criação de Contas Administrativas (CVE-2025-6949)

Foi identificada uma vulnerabilidade de Execução com Privilégios Desnecessários nos appliances de segurança de rede e roteadores da Moxa. Uma falha crítica de autorização na API permite que um usuário autenticado, com baixos privilégios, crie uma nova conta de administrador, inclusive contas com nomes de usuário idênticos aos de usuários existentes. Em determinados cenários, essa vulnerabilidade poderia permitir que um atacante obtivesse controle administrativo total sobre o dispositivo afetado, levando a possível personificação de contas. Embora a exploração bem-sucedida possa impactar gravemente a confidencialidade, a integridade e a disponibilidade do próprio dispositivo afetado, não há perda de confidencialidade ou integridade em sistemas subsequentes.

CVE-2025-6894 Média · 5.3 CWE-250 17/10/2025

Execution with Unnecessary Privileges em Moxa EDR-G9010 Series

An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the API authorization logic of the affected device allows an authenticated, low-privileged user to execute the administrative `ping` function, which is restricted to higher-privileged roles. This vulnerability enables the user to perform internal network reconnaissance, potentially discovering internal hosts or services that would otherwise be inaccessible. Repeated exploitation could lead to minor resource consumption. While the overall impact is limited, it may result in some loss of confidentiality and availability on the affected device. There is no impact on the integrity of the device, and the vulnerability does not affect any subsequent systems.

CVE-2025-6893 Crítica · 9.3 CWE-250 17/10/2025

Appliances de segurança e roteadores Moxa: privilégios desnecessários por controle de acesso quebrado (CVE-2025-6893)

Uma vulnerabilidade de Execução com Privilégios Desnecessários foi identificada nos appliances de segurança de rede e roteadores da Moxa. Foi identificada uma falha de controle de acesso quebrado no endpoint /api/v1/setting/data do dispositivo afetado. Essa falha permite que um usuário autenticado com baixos privilégios chame a API sem as permissões necessárias, obtendo assim a capacidade de acessar ou modificar dados de configuração do sistema. A exploração bem-sucedida pode levar à escalada de privilégios, permitindo que o atacante acesse ou modifique configurações sensíveis do sistema. Embora o impacto geral seja alto, não há perda de confidencialidade ou integridade em quaisquer sistemas subsequentes.

CVE-2025-61909 Média · 4.4 CWE-250 16/10/2025

Icinga 2 signals sent as root to processes based on PID file written by the Icinga 2 daemon user

Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icinga2) and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2 process from a PID file writable by the daemon user, but send the signal as the root user. This can allow the Icinga user to send signals to processes it would otherwise not permitted to. A fix is included in the following Icinga 2 versions: 2.15.1, 2.14.7, and 2.13.13.

CVE-2025-34515 Crítica · 9.8 CWE-250 16/10/2025

Ilevia EVE X1 Server 4.7.18.0.eden Root Privilege Escalation

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an execution with unnecessary privileges vulnerability in sync_project.sh that allows an attacker to escalate privileges to root. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.

CVE-2025-57780 Alta · 8.8 CWE-250 15/10/2025

F5OS Vulnerability

A vulnerability exists in F5OS-A and F5OS-C system that may allow an authenticated attacker with local access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-8486 Alta · 7.8 CWE-250 15/10/2025

Execution with Unnecessary Privileges em Lenovo Pcmanager

A potential vulnerability was reported in PC Manager that could allow a local authenticated user to execute code with elevated privileges.

CVE-2025-61958 Alta · 8.7 CWE-250 15/10/2025

BIG-IP TMSH vulnerability

A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administrator role to bypass tmsh restrictions and gain access to a bash shell. For BIG-IP systems running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-59481 Alta · 8.7 CWE-250 15/10/2025

BIG-IP iControl REST and tmsh vulnerability

A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with at least resource administrator role to execute arbitrary system commands with higher privileges. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-36356 Crítica · 9.3 CWE-250 06/10/2025

IBM Security Verify Access privilege escalation

IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow a locally authenticated user to escalate their privileges to root due to execution with more privileges than required.

CVE-2024-5042 Média · 6.6 CWE-250 17/05/2024

Submariner-operator: rbac permissions can allow for the spread of node compromises

A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.