Weakness (CWE)
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
1,765 results · Clear filters · Feed
-
High 8.4
An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. During installation, an EXE gets executed out of C:\W…
-
High 7.2
Improper Privilege Management in thorsten/phpmyfaq
Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
High 7.8
A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the Q…
-
High 7.8
A vulnerability exists in FlexNet Manager Suite releases 2015 R2 SP3 and earlier (including FlexNet Manager Platform 9.…
-
High 7.1
An issue was discovered in Veritas NetBackup before 8.3.0.2. BPCD allows an unprivileged user to specify a log file pat…
-
High 8.8
Hippo4j privilege escalation issue
An issue found in OpenGoofy Hippo4j v.1.4.3 allows attackers to escalate privileges via the ThreadPoolController of the tenant Management module.
-
High 8.8
MinIO is vulnerable to privilege escalation on Linux/MacOS
Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attac…
KEV Sep 19, 2023 -
High 7.8
Windows Accounts Picture Elevation of Privilege Vulnerability
Windows Accounts Picture Elevation of Privilege Vulnerability
-
High 7.8
Local Privilege Escalation in ClearPass OnGuard Linux Agent
A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges to those of a higher role. A successful exploit allows malicious users to execute arbitrary code with root level privileges o…
-
High 8.8
OpenDoas through 6.8.2, when TIOCSTI is available, allows privilege escalation because of sharing a terminal with the o…
-
High 7.2
Company admin role gives excessive privileges in eZ Platform Ibexa
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges.
-
High 7.8
An improper access control vulnerability in the Trend Micro Apex One agent could allow a local attacker to gain elevate…
-
High 7.8
A improper privilege management in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.6,…
-
High 7.8
systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible s…
-
High 7.8CVE-2022-45988 Public exploit
starsoftcomm CooCare 5.304 allows local attackers to escalate privileges and execute arbitrary commands via a crafted f…
-
High 7.8
This issue was addressed with improved checks. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, tvOS 16. An app may…
-
High 7.8
A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6, macOS Big Sur 1…
-
High 7.8
Privilege Escalation to NT AUTHORITY\SYSTEM on the vulnerable VDA
A vulnerability has been identified that, if exploited, could result in a local user elevating their privilege level to NT AUTHORITY\SYSTEM on a Citrix Virtual Apps and Desktops Windows VDA.
-
High 8.8
Apache ShenYu Admin ultra vires
Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu. ShenYu Admin allows low-privilege low-level administrators create users with higher privileges than their own. This issue affects Apache ShenYu: 2.5.0. Upgrade to Apache …
-
High 7.8
PC settings tool Ver10.1.26.0 and earlier, PC settings tool Ver11.0.22.0 and earlier allows a attacker to write to the …
-
High 7.8
ASUS EC Tool driver (aka d.sys) 1beb15c90dcf7a5234ed077833a0a3e900969b60be1d04fcebce0a9f8994bdbb, as signed by ASUS and…
-
High 7.8
Failure to validate privileges during installation of AMD Ryzen™ Master may allow an attacker with low privileges to mo…
-
High 7.5
The multi-screen collaboration module has a privilege escalation vulnerability. Successful exploitation of this vulnera…
-
High 7.8
An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivilege…
-
High 7.2
Rancher: Privilege escalation via promoted roles
A Improper Privilege Management vulnerability in SUSE Rancher, allows users with access to the escalate verb on PRTBs to escalate permissions for any -promoted resource in any cluster. This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher…
-
High 7.8
The components wfshbr64.sys and wfshbr32.sys in Another Eden before v3.0.20 and before v2.14.200 allows attackers to pe…
-
High 8.4
VMware Workstation contains an arbitrary file deletion vulnerability. A malicious actor with local user privileges on t…
-
High 8.8
As part of our Security Development Lifecycle, a potential privilege escalation issue was identified internally. This c…
-
High 7.8
HP has identified a potential vulnerability in BIOS firmware of some Workstation products. Firmware updates are being r…
-
High 7.8
Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privileg…
-
High 7.8
Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which m…
-
High 7.8
Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which m…
-
High 7.8
HPSFViewer might allow Escalation of Privilege. This potential vulnerability was remediated on July 29th, 2022. Custome…
-
High 8.8
Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrar…
-
High 8.8
Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrar…
-
High 8.8
Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrar…
-
High 8.8
Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrar…
-
High 7.8
Incorrect access control in Aternity agent in Riverbed Aternity before 12.1.4.27 allows for local privilege escalation.…
-
High 7.8
An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivilege…
-
High 7.8
An issue was discovered in the quarantine feature of Elastic Endpoint Security and Elastic Endgame for Windows, which c…