Weakness (CWE)
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
1,765 results · Clear filters · Feed
-
High 8.8
Nagios NDOUtils before 2.1.4 allows privilege escalation from nagios to root because certain executable files are owned…
-
High 7.2
JetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation
The JetFormBuilder plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.4.1. This is due to improper restriction on user meta fields. This makes it possible for authenticated attackers, with administrator-level …
-
High 8.8
Apache Linkis Basic management services: Privilege Escalation Attack vulnerability
In Apache Linkis <= 1.5.0, Privilege Escalation in Basic management services where the attacking user is a trusted account allows access to Linkis's Token information. Users are advised to upgrade to version 1.6.0, which fixes this issue.
-
High 8.8
Insecure Permission vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s…
-
High 8.0
WordPress WPForms User Registration plugin <= 2.1.0 - Authenticated Privilege Escalation vulnerability
Improper Privilege Management vulnerability in WPForms, LLC. WPForms User Registration allows Privilege Escalation.This issue affects WPForms User Registration: from n/a through 2.1.0.
-
High 7.2
WordPress CTX Feed plugin <= 6.5.6 - Arbitrary Options Update vulnerability
Improper Privilege Management vulnerability in WebAppick CTX Feed allows Privilege Escalation.This issue affects CTX Feed: from n/a through 6.5.6.
-
High 8.8
WordPress PowerPack for Beaver Builder plugin <= 2.33.0 - Contributor+ Privilege Escalation vulnerability
Improper Privilege Management vulnerability in IdeaBox PowerPack for Beaver Builder allows Privilege Escalation.This issue affects PowerPack for Beaver Builder: from n/a through 2.33.0.
-
High 8.8
WordPress PowerPack Pro for Elementor plugin <= 2.10.14 - Contributor+ Privilege Escalation vulnerability
Improper Privilege Management vulnerability in IdeaBox PowerPack Pro for Elementor allows Privilege Escalation.This issue affects PowerPack Pro for Elementor: from n/a through 2.10.14.
-
High 7.8
The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Monterey …
-
High 7.8
The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ve…
-
High 8.4
The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ve…
-
High 8.8
Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm
An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm.
-
High 8.3
RaspAP allows an attacker to escalate privileges
RaspAP before 3.1.5 allows an attacker to escalate privileges: the www-data user has write access to the restapi.service file and also possesses Sudo privileges to execute several critical commands without a password.
-
High 7.0
The MSI installer for Splashtop Streamer for Windows before 3.7.0.0 uses a temporary folder with weak permissions durin…
-
High 7.8
Insecure Permissions vulnerability in Deepin dde-file-manager 6.0.54 and earlier allows privileged operations to be cal…
-
High 8.8
Elevation of Privilege
AdvaBuild uses a command queue to launch certain operations. An attacker who gains access to the command queue can use it to launch an attack by running any executable on the AdvaBuild node. The executables that can be run are not limited to AdvaBuild specifi…
-
High 8.2
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
High 8.0
WordPress WP User Switch plugin <= 1.1.0 - Privilege Escalation vulnerability
Improper Privilege Management vulnerability in IqbalRony WP User Switch allows Privilege Escalation.This issue affects WP User Switch: from n/a through 1.1.0.
-
High 7.3
-
High 8.5
Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges
Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows
-
High 8.5
Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges
Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Virtual Delivery Agent for Windows used by Citrix Virtual Apps and Desktops and Citrix DaaS
-
High 8.6
JasperReports Server Driver upload vulnerability
Vulnerability in Jaspersoft JasperReport Servers.This issue affects JasperReport Servers: from 8.0.4 through 9.0.0.
-
High 8.8
ProfileGrid – User Profiles, Groups and Communities <= 5.8.9 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.8.9. This is due to a lack of validation on user-supplied data in the 'pm_upload_image' AJAX action. Thi…
-
High 7.4
In DevmemIntUnexportCtx of devicemem_server.c, there is a possible arbitrary code execution due to a race condition. Th…
-
High 7.4CVE-2024-31320 Public exploit
In setSkipPrompt of AssociationRequest.java , there is a possible way to establish a companion device association witho…
-
High 7.8
In CompanionDeviceManagerService.java, there is a possible way to pair a companion device without user acceptance due t…
-
High 7.8
In onCreate of multiple files, there is a possible way to trick the user into granting health permissions due to tapjac…
-
High 7.8
In multiple locations, there is a possible way to reveal images across users data due to a logic error in the code. Thi…
-
High 7.8
In availableToWriteBytes of MessageQueueBase.h, there is a possible out of bounds write due to an incorrect bounds chec…
-
High 7.8
In DevmemXIntUnreserveRange of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in…
-
High 7.8
In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalat…
-
High 7.8
In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalat…
-
High 8.8
WordPress BookYourTravel theme <= 8.18.17 - Subscriber+ Privilege Escalation vulnerability
Improper Privilege Management vulnerability in themeenergy BookYourTravel allows Privilege Escalation.This issue affects BookYourTravel: from n/a through 8.18.17.
-
High 8.8
WordPress Zephyr Project Manager plugin <= 3.3.97 - Privilege Escalation vulnerability
Improper Privilege Management vulnerability in Dylan James Zephyr Project Manager allows Privilege Escalation.This issue affects Zephyr Project Manager: from n/a through 3.3.97.
-
High 8.8
WordPress Ultimate Addons for elementor plugin <= 1.36.31 - Privilege Escalation vulnerability
Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Elementor allows Privilege Escalation.This issue affects Ultimate Addons for Elementor: from n/a through 1.36.31.
-
High 8.8
An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privil…
-
High 7.8
Improper privilege management in Jungo WinDriver before 12.1.0 allows local attackers to escalate privileges and execut…
-
High 7.5
An issue discovered in MSP360 Backup Agent v7.8.5.15 and v7.9.4.84 allows attackers to obtain network share credentials…
-
High 7.8
Improper privilege management in Jungo WinDriver before 12.5.1 allows local attackers to escalate privileges and execut…
-
High 7.8
Improper privilege management in Jungo WinDriver before 12.2.0 allows local attackers to escalate privileges and execut…