Weakness (CWE)
CWE-269: Improper Privilege Management
Class Draft Mapping discouraged
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
1,765 results · Clear filters · Feed
-
High 8.8
Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). …
-
High 7.2
Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). …
-
High 8.8
Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (component: Internal Operations). Supporte…
-
High 7.2
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Internal Operations). Sup…
-
High 8.8
Vulnerability in the Oracle Project Intelligence product of Oracle E-Business Suite (component: Internal Operations). S…
-
High 7.2
Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Rapid Implementa…
-
High 8.8
Vulnerability in the Oracle Warehouse Management product of Oracle E-Business Suite (component: Internal Operations). S…
-
High 8.8
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported vers…
-
High 7.5
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported vers…
-
High 8.8
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported vers…
-
High 7.6
Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Suppor…
-
High 8.8
Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). …
-
High 8.8
Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Pricing Installation). Supp…
-
High 7.5
Vulnerability in the Oracle Quoting product of Oracle E-Business Suite (component: Internal Operations). Supported vers…
-
High 8.2
Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Supported vers…
-
High 7.5
Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Supported vers…
-
High 7.2
Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations)…
-
High 8.4
Vulnerability in the Oracle Price Protection product of Oracle E-Business Suite (component: Internal Operations). Suppo…
-
High 7.0
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affec…
-
High 8.8
Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations). Support…
-
High 7.8
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). The supported version that is a…
-
High 8.8
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). …
-
High 7.8
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Studio). Supported versions…
-
High 7.5
Vulnerability in the JD Edwards EnterpriseOne HCM Foundation product of Oracle JD Edwards (component: Time Accounting a…
-
High 8.8
Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Install). The supporte…
-
High 7.2
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Integration Business Insight). Su…
-
High 7.8
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_http2.so). The supported ve…
-
High 7.1
Vulnerability in the JD Edwards EnterpriseOne HCM Foundation product of Oracle JD Edwards (component: OW HR PR Foundati…
-
High 7.8
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that …
-
High 8.8
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported vers…
-
High 7.2
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported vers…
-
High 7.2
Vulnerability in the Oracle Project Costing product of Oracle E-Business Suite (component: Enterprise Command Center). …
-
High 7.8
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that ar…
-
High 8.8
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21…
-
High 7.8
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…
-
High 7.8
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…
-
High 7.8
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…
-
High 8.8
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata …
-
High 8.1
praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling destructive action. The `DELETE /workspaces/{workspace_id}` endpoint is gated only by `require_workspace_member(…
-
High 8.1
praisonai-platform: Any workspace member can remove any other member (including the owner) via DELETE /workspaces/{id}/members/{user_id}
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling owner lockout. The `DELETE /workspaces/{workspace_id}/members/{user_id}` endpoint is gated only by `require_work…