Monthly
Asterisk's REST Interface (ARI) allows a caller holding only read-only credentials to invoke write-capable dialplan functions - most notably FILE() - through the setChannelVar operation, even when live_dangerously is set to no in asterisk.conf, so a supposedly low-privilege ARI user can write files on the PBX host. Affected releases are Asterisk 20.x through 20.20.0, 21.x through 21.12.2, 22.x through 22.10.0, 23.x through 23.4.0, plus Certified Asterisk 20.7-cert10 and 22.8-cert2 and earlier; exposure requires the Asterisk HTTP server to be enabled and reachable and the attacker to already hold valid read-only ARI credentials. No public exploit code was identified at time of analysis, and vendor patches are available in 20.20.1, 21.12.3, 22.10.1, 23.4.1, Certified 20.7-cert11 and Certified 22.8-cert3.
Local privilege escalation in Colorful iGameCenter 2.0.0.82 allows an attacker who already holds a low-privileged session on the host to gain full control of the machine by abusing the AMDRyzenMasterDriver.sys kernel driver. The driver's Dispatch Handler passes an attacker-supplied SystemBuffer straight into MmMapIoSpace, so a crafted IOCTL lets a user-mode caller map arbitrary physical memory, breaking the kernel/user boundary and yielding high confidentiality, integrity, and availability impact across the security scope. Exploitation is strictly local (the assessed vector is AV:L/AC:L/PR:L/UI:N/S:C with all impacts High), no public exploit code has been identified at time of analysis, and the vendor was contacted but did not respond, so no vendor patch is confirmed.
Authenticated users with low-level Viewer permissions in Red Hat Satellite 6.19 (and upstream Foreman) can exploit template preview endpoints to disclose sensitive data, including host root passwords. In non-default configurations where Safemode protections are disabled, the flaw can escalate to arbitrary command execution as the Foreman system account. No public exploit code or active exploitation has been identified at time of analysis; the CVSS score of 9.1 reflects high confidentiality impact, though the RCE component requires an insecure configuration.
Privilege escalation to cluster-admin in Red Hat Advanced Cluster Management for Kubernetes (ACM) lets a user holding only namespace-scoped 'edit' rights on an ACM hub namespace take over the entire cluster. By creating a Channel pointing to an attacker-controlled Helm repository and a Subscription referencing it, the app-subscription controller (multicluster-operators-subscription) applies the chart with its own elevated authority and without enforcing the subscription-admin role or namespace confinement, letting the chart install cluster-scoped objects such as a ClusterRoleBinding to cluster-admin. No public exploit identified at time of analysis, and EPSS is low (0.25%), but the technical impact is total and the flaw directly contradicts ACM's documented namespace-confinement guarantee.
Arbitrary command execution in F5 BIG-IP and BIG-IQ Certificate Manager allows highly privileged attackers with Certificate Manager role to run OS commands by modifying configuration objects. The vulnerability requires network access and high privileges (PR:H) but enables scope change (S:C) with high confidentiality and integrity impact. Vendor-released patch available per F5 Security Advisory K000160971. EPSS data not provided; no confirmed active exploitation (not in CISA KEV) or public exploit code identified at time of analysis.
OpenXiangShan NEMU emulator's RISC-V Hypervisor extension implementation allows VS-mode guest writes to the sie (supervisor interrupt-enable) CSR to corrupt machine-level mie state, breaking privilege isolation between virtualization layers. Fixed in commit 55295c4 per GitHub PR #938. Despite CVSS 9.8 Critical rating with network attack vector (AV:N), the EPSS score of 0.03% (9th percentile) indicates extremely low observed exploitation probability, and the vulnerability specifically affects RISC-V emulator environments rather than typical network-accessible services. No CISA KEV listing or public exploit identified at time of analysis, suggesting this is a theoretical high-severity issue in specialized research/development contexts rather than an imminent widespread threat.
Apache Cassandra 5.0 through 5.0.6 in mTLS environments using MutualTlsAuthenticator allows authenticated users with only CREATE permission to escalate privileges to superuser via certificate identity manipulation through the ADD IDENTITY command. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, with SSVC indicating non-automatable exploitation but total technical impact. Apache released patch version 5.0.7+ addressing this privilege escalation flaw (CWE-267: Privilege Defined With Unsafe Actions).
Improper access control in REB500 firmware allows authenticated users with low privileges to read and modify unauthorized directories via the DAC protocol. An attacker with valid credentials can escalate their file system access beyond their intended permissions, potentially compromising sensitive data or system integrity. No patch is currently available for this vulnerability.
Authenticated users with Installer role in REB500 firmware can bypass directory access controls to read and modify files outside their authorized scope. This privilege escalation affects systems where installer accounts are provisioned, enabling unauthorized data access and manipulation. No patch is currently available.
The Drupal Role Delegation module versions 1.3.0 through 1.5.0 contains an unsafe privilege definition vulnerability that permits authenticated users with delegation permissions to escalate their privileges within the application. An attacker with limited account access could exploit this flaw to gain elevated permissions and modify system settings or access restricted functionality. No patch is currently available for this vulnerability.
Asterisk's REST Interface (ARI) allows a caller holding only read-only credentials to invoke write-capable dialplan functions - most notably FILE() - through the setChannelVar operation, even when live_dangerously is set to no in asterisk.conf, so a supposedly low-privilege ARI user can write files on the PBX host. Affected releases are Asterisk 20.x through 20.20.0, 21.x through 21.12.2, 22.x through 22.10.0, 23.x through 23.4.0, plus Certified Asterisk 20.7-cert10 and 22.8-cert2 and earlier; exposure requires the Asterisk HTTP server to be enabled and reachable and the attacker to already hold valid read-only ARI credentials. No public exploit code was identified at time of analysis, and vendor patches are available in 20.20.1, 21.12.3, 22.10.1, 23.4.1, Certified 20.7-cert11 and Certified 22.8-cert3.
Local privilege escalation in Colorful iGameCenter 2.0.0.82 allows an attacker who already holds a low-privileged session on the host to gain full control of the machine by abusing the AMDRyzenMasterDriver.sys kernel driver. The driver's Dispatch Handler passes an attacker-supplied SystemBuffer straight into MmMapIoSpace, so a crafted IOCTL lets a user-mode caller map arbitrary physical memory, breaking the kernel/user boundary and yielding high confidentiality, integrity, and availability impact across the security scope. Exploitation is strictly local (the assessed vector is AV:L/AC:L/PR:L/UI:N/S:C with all impacts High), no public exploit code has been identified at time of analysis, and the vendor was contacted but did not respond, so no vendor patch is confirmed.
Authenticated users with low-level Viewer permissions in Red Hat Satellite 6.19 (and upstream Foreman) can exploit template preview endpoints to disclose sensitive data, including host root passwords. In non-default configurations where Safemode protections are disabled, the flaw can escalate to arbitrary command execution as the Foreman system account. No public exploit code or active exploitation has been identified at time of analysis; the CVSS score of 9.1 reflects high confidentiality impact, though the RCE component requires an insecure configuration.
Privilege escalation to cluster-admin in Red Hat Advanced Cluster Management for Kubernetes (ACM) lets a user holding only namespace-scoped 'edit' rights on an ACM hub namespace take over the entire cluster. By creating a Channel pointing to an attacker-controlled Helm repository and a Subscription referencing it, the app-subscription controller (multicluster-operators-subscription) applies the chart with its own elevated authority and without enforcing the subscription-admin role or namespace confinement, letting the chart install cluster-scoped objects such as a ClusterRoleBinding to cluster-admin. No public exploit identified at time of analysis, and EPSS is low (0.25%), but the technical impact is total and the flaw directly contradicts ACM's documented namespace-confinement guarantee.
Arbitrary command execution in F5 BIG-IP and BIG-IQ Certificate Manager allows highly privileged attackers with Certificate Manager role to run OS commands by modifying configuration objects. The vulnerability requires network access and high privileges (PR:H) but enables scope change (S:C) with high confidentiality and integrity impact. Vendor-released patch available per F5 Security Advisory K000160971. EPSS data not provided; no confirmed active exploitation (not in CISA KEV) or public exploit code identified at time of analysis.
OpenXiangShan NEMU emulator's RISC-V Hypervisor extension implementation allows VS-mode guest writes to the sie (supervisor interrupt-enable) CSR to corrupt machine-level mie state, breaking privilege isolation between virtualization layers. Fixed in commit 55295c4 per GitHub PR #938. Despite CVSS 9.8 Critical rating with network attack vector (AV:N), the EPSS score of 0.03% (9th percentile) indicates extremely low observed exploitation probability, and the vulnerability specifically affects RISC-V emulator environments rather than typical network-accessible services. No CISA KEV listing or public exploit identified at time of analysis, suggesting this is a theoretical high-severity issue in specialized research/development contexts rather than an imminent widespread threat.
Apache Cassandra 5.0 through 5.0.6 in mTLS environments using MutualTlsAuthenticator allows authenticated users with only CREATE permission to escalate privileges to superuser via certificate identity manipulation through the ADD IDENTITY command. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, with SSVC indicating non-automatable exploitation but total technical impact. Apache released patch version 5.0.7+ addressing this privilege escalation flaw (CWE-267: Privilege Defined With Unsafe Actions).
Improper access control in REB500 firmware allows authenticated users with low privileges to read and modify unauthorized directories via the DAC protocol. An attacker with valid credentials can escalate their file system access beyond their intended permissions, potentially compromising sensitive data or system integrity. No patch is currently available for this vulnerability.
Authenticated users with Installer role in REB500 firmware can bypass directory access controls to read and modify files outside their authorized scope. This privilege escalation affects systems where installer accounts are provisioned, enabling unauthorized data access and manipulation. No patch is currently available.
The Drupal Role Delegation module versions 1.3.0 through 1.5.0 contains an unsafe privilege definition vulnerability that permits authenticated users with delegation permissions to escalate their privileges within the application. An attacker with limited account access could exploit this flaw to gain elevated permissions and modify system settings or access restricted functionality. No patch is currently available for this vulnerability.