Weakness (CWE)
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
1,765 results · Clear filters · Feed
-
High 7.3
Incomplete protection of personal password settings
Improper initialization of default settings in TeamViewer Remote Client prior version 15.51.5 for Windows, Linux and macOS, allow a low privileged user to elevate privileges by changing the personal password setting and establishing a remote connection to a l…
-
High 7.8CVE-2024-0197 Public exploit
Privilege Escalation in Thales SafeNet Sentinel HASP LDK
A flaw in the installer for Thales SafeNet Sentinel HASP LDK prior to 9.16 on Windows allows an attacker to escalate their privilege level via local access.
-
High 7.8CVE-2023-7016 Public exploit
Privilege Escalation in SafeNet Authentication Client
A flaw in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to execute code at a SYSTEM level via local access.
-
High 7.8
Privilege Escalation in SafeNet Authentication Client Installer
A flaw in the Windows Installer in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to escalate their privilege level via local access.
-
High 7.1
User can manually send request at manager permission to modify system configurations
As a manager, you should not be able to modify a series of settings. In the UI this is indeed hidden as a convenience for the role since most managers would not be savvy enough to modify these settings. They can use their token to still modify those settings …
-
High 7.5
On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the pr…
-
High 7.8
In sanitizeSbn of NotificationManagerService.java, there is a possible way to launch an activity from the background du…
-
High 8.8
Local privilege escalation vulnerability could affect OpenText Operations Agent on Non-Windows platforms.
Local privilege escalation vulnerability affects OpenText Operations Agent product versions 12.15 and 12.20-12.25 when installed on Non-Windows platforms. The vulnerability could allow local privilege escalation.
-
High 7.9
An improper privilege management vulnerability [CWE-269] vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, …
-
High 7.8
Local privilege escalation in Windows products
Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET’s file operations to delete files without having proper permission.
-
High 7.2
Dell SupportAssist for Home PCs Installer Executable file version prior to 3.13.2.19 used for initial installation has …
-
High 8.8
The Plack::Middleware::XSRFBlock package before 0.0.19 for Perl allows attackers to bypass a CSRF protection mechanism …
-
High 7.0
Insecure Permissions vulnerability in Forescout SecureConnector v.11.3.06.0063 allows a local attacker to escalate priv…
-
High 7.8
Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Op…
-
High 7.7
Delegated Admin Virtual Attribute Provider Privilege Escalation
Delegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory Server.
-
High 8.8
MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation
MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin`…
-
High 8.8CVE-2024-21888 EPSS 85%
A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.…
-
High 7.8
Privilege Elevation via Telerik Test Studio
In Telerik Test Studio versions prior to v2023.3.1330, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik Test Studio install is present, a lower privileged user has th…
-
High 7.8
Privilege Elevation via Telerik Reporting Installer
In Telerik Reporting versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik Reporting install is present, a lower privileged user has the ability…
-
High 7.8
Privilege Elevation via Telerik JustDecompile Installer
In Telerik JustDecompile versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik JustDecompile install is present, a lower privileged user has the…
-
High 7.6
Privilege Escalation Vulnerability in ONTAP 9
ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 and 9.13.1P4 are susceptible to a vulnerability which could allow an authenticated user with multiple remote accounts with differing roles to perform actions via REST API beyond their intende…
-
High 8.8
IBM Merge Healthcare eFilm Workstation SYSTEM Privilege Escalation
An improper privilege management vulnerability exists in IBM Merge Healthcare eFilm Workstation. A local, authenticated attacker can exploit this vulnerability to escalate privileges to SYSTEM.
-
High 8.8CVE-2023-43317 Public exploit
An issue in Coign CRM Portal v.06.06 allows a remote attacker to escalate privileges via the userPermissionsList parame…
-
High 7.8
An improper access control vulnerability in Trend Micro Deep Security 20.0 and Trend Micro Cloud One - Endpoint and Wor…
-
High 7.4
An exposed dangerous function vulnerability in the Trend Micro Apex One agent could allow a local attacker to escalate …
-
High 8.8
A malicious devtools extension could have been used to escalate privileges. This vulnerability affects Firefox < 122, F…
-
High 7.5
The nearby module has a privilege escalation vulnerability. Successful exploitation of this vulnerability may affect av…
-
High 7.5
Vulnerability of permissions being not strictly verified in the WMS module. Successful exploitation of this vulnerabili…
-
High 7.5
Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerabili…
-
High 7.5
Data confidentiality vulnerability in the ScreenReader module. Successful exploitation of this vulnerability may affect…
-
High 8.3
An improper privilege management vulnerability [CWE-269] in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 a…
-
High 8.4
IBM Db2 for Windows privilege escalation
IBM Db2 for Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow a local user to escalate their privileges to the SYSTEM user using the MSI repair functionality. IBM X-Force ID: 270402.
-
High 8.5
Arbitrary remote code execution within wrangler dev Workers sandbox
The V8 inspector intentionally allows arbitrary code execution within the Workers sandbox for debugging. wrangler dev would previously start an inspector server listening on all network interfaces. This would allow an attacker on the local network to connect …
-
High 7.1
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause i…
-
High 7.8
Sandbox Accounts for Events vulnerable to privilege escalation to read running events data
Sandbox Accounts for Events provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially read data from the events table by sending request payloads to the events AP…
-
High 8.0
Improper Privilege Management in GitHub Enterprise Server management console leads to privilege escalation
Improper privilege management in all versions of GitHub Enterprise Server allows users with authorized access to the management console with an editor role to escalate their privileges by making requests to the endpoint used for bootstrapping the instance. Th…
-
High 7.2
MOVEit Transfer Group Admin Privilege Escalation
In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path associated with group administrators has been identified. It is possible for a group administrator to elevate a group …
-
High 8.5
Arbitrary File Read As Root Via GoTTY Page
Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability allows an unauthorised user to escalate and read sensitive files as if they were root. This issue affects Pandora FMS: from 700 through 773.
-
High 8.2
Misassignment of privileges can cause DOS attack
Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability causes that a bad privilege assignment could cause a DOS attack that affects the availability of the Pandora FMS server. This issue affects Pando…
-
High 7.0
APM Java Agent Local Privilege Escalation
A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running the APM Java agent. By using this vulnerability, an attacker could execute code at a potentially higher …