Weakness (CWE)
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
1,765 results · Clear filters · Feed
-
High 7.8CVE-2024-21111 Public exploit
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
High 7.8
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affec…
-
High 8.8
Dusk plugin may allow unfettered user authentication in misconfigured installs
wn-dusk-plugin (Dusk plugin) is a plugin which integrates Laravel Dusk browser testing into Winter CMS. The Dusk plugin provides some special routes as part of its testing framework to allow a browser environment (such as headless Chrome) to act as a user in …
-
High 7.8
Windows Storage Elevation of Privilege Vulnerability
Windows Storage Elevation of Privilege Vulnerability
-
High 7.8
Microsoft Brokering File System Elevation of Privilege Vulnerability
Microsoft Brokering File System Elevation of Privilege Vulnerability
-
High 7.2
Microsoft Defender for IoT Elevation of Privilege Vulnerability
Microsoft Defender for IoT Elevation of Privilege Vulnerability
-
High 7.8
Microsoft Brokering File System Elevation of Privilege Vulnerability
Microsoft Brokering File System Elevation of Privilege Vulnerability
-
High 8.2
CVE
NVIDIA ChatRTX for Windows contains a vulnerability in the UI, where an attacker can cause improper privilege management by sending open file requests to the application. A successful exploit of this vulnerability might lead to local escalation of privileges,…
-
High 7.5
Vulnerability of starting activities in the background in the ActivityManagerService (AMS) module. Impact: Successful e…
-
High 7.8
In pblS2mpuResume of s2mpu.c, there is a possible mitigation bypass due to a logic error in the code. This could lead t…
-
High 8.8
Yubico ykman-gui (aka YubiKey Manager GUI) before 1.2.6 on Windows, when Edge is not used, allows privilege escalation …
-
High 7.9
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper privilege management security vulnerability…
-
High 7.1
Improper Privilege Management in uvdesk/community-skeleton
Improper Privilege Management in uvdesk/community-skeleton
-
High 8.4
Apache Fineract: Under certain circumstances, this vulnerability allowed users, without specific permissions, to escalate their privileges to any role.
Improper Privilege Management vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5. Users are recommended to upgrade to version 1.9.0, which fixes the issue.
-
High 7.6CVE-2024-28247 Public exploit
Pihole Authenticated Arbitrary File Read with root privileges
The Pi-hole is a DNS sinkhole that protects your devices from unwanted content without installing any client-side software. A vulnerability has been discovered in Pihole that allows an authenticated user on the platform to read internal server files arbitrari…
-
High 7.2
A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker can e…
-
High 8.5
Elevation of privileges vulnerability
By leveraging the vulnerability, lower-privileged users of Content Manager can manipulate Content Manager clients to elevate privileges and perform unauthorized operations.
-
High 8.1
Unauthorized RCE in migration-tools
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Privilege Management vulnerability in openEuler migration-tools on Linux allows Command Injection, Restful Privilege Elevation. This vulnerability is associat…
-
High 7.1
IdentityIQ Authorization of QuickLink Target Identities Vulnerability
This vulnerability allows an authenticated user to perform a Lifecycle Manager flow or other QuickLink for a target user outside of the defined QuickLink Population.
-
High 7.8
In the Windows installer in Atos Eviden CardOS API before 5.5.5.2811, Local Privilege Escalation can occur.(from a regu…
-
High 7.8
Local Privilege Escalation
As a part of Tenable’s vulnerability disclosure program, a vulnerability in a Nessus plugin was identified and reported. This vulnerability could allow a malicious actor with sufficient permissions on a scan target to place a binary in a specific filesystem l…
-
High 8.6
Buildah: buildah: container escape via improper bind mount validation
A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mou…
-
High 7.3
Privilege Escalation Abusing installer in SupportApp
Support App is an opensource application specialized in managing Apple devices. It's possible to abuse a vulnerability inside the postinstall installer script to make the installer execute arbitrary code as root. The cause of the vulnerability is the fact tha…
-
High 8.8
An issue in NETGEAR-DGND4000 v.1.1.00.15_1.00.15 allows a remote attacker to escalate privileges via the next_file para…
-
High 8.8
Academy LMS – eLearning and online course solution for WordPress <= 1.9.19 - Authenticated (Subscriber+) Privilege Escalation
The Academy LMS – eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.9.19. This is due to plugin allowing arbitrary user meta updates through the saved_user_inf…
-
High 8.8
TIBCO FTL Privilege Escalation
The FTL Server component of TIBCO Software Inc.'s TIBCO FTL - Enterprise Edition contains a vulnerability that allows a low privileged attacker with network access to execute a privilege escalation on the affected ftlserver. Affected releases are TIBCO Softwa…
-
High 7.8
Windows Error Reporting Service Elevation of Privilege Vulnerability
Windows Error Reporting Service Elevation of Privilege Vulnerability
KEV Jun 13, 2024 -
High 7.5
Account Takeover via Session Fixation in Zitadel [Bypassing MFA]
Zitadel is an open source identity management system. Zitadel uses a cookie to identify the user agent (browser) and its user sessions. Although the cookie was handled according to best practices, it was accessible on subdomains of the ZITADEL instance. An at…
-
High 7.8
In ppcfw_init_secpolicy of ppcfw.c, there is a possible permission bypass due to uninitialized data. This could lead to…
-
High 7.8
In strncpy of strncpy.c, there is a possible out of bounds write due to a missing bounds check. This could lead to loca…
-
High 7.8
In onSkipButtonClick of FaceEnrollFoldPage.java, there is a possible way to access the file the app cannot access due t…
-
High 7.8
In policy_check of fvp.c, there is a possible out of bounds write due to a missing bounds check. This could lead to loc…
-
High 7.8
In config_gov_time_windows of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could …
-
High 7.8
In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local …
-
High 7.8
In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a l…
-
High 7.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.4. An app may be…
-
High 8.4
A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macO…
-
High 8.1CVE-2024-22752 Public exploit
Insecure permissions issue in EaseUS MobiMover 6.0.5 Build 21620 allows attackers to gain escalated privileges via use …
-
High 7.6
Improper privilege management in Just-in-time (JIT) elevation module in Devolutions Server 2023.3.14.0 and earlier allo…
-
High 7.5
An issue was discovered in Presta World "Account Manager - Sales Representative & Dealers - CRM" (prestasalesmanager) m…