Weakness (CWE)
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
1,765 results · Clear filters · Feed
-
High 8.8
A privilege escalation vulnerability was identified in Nessus versions 8.10.1 through 8.15.8 and 10.0.0 through 10.4.1.…
-
High 7.5
Use of default credentials vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenti…
-
High 7.8
Symantec Endpoint Protection, prior to 14.3 RU6 (14.3.9210.6000), may be susceptible to a Elevation of Privilege vulner…
-
High 8.8
Insufficient permission check in the VQL copy() function
Rapid7 Velociraptor allows users to be created with different privileges on the server. Administrators are generally allowed to run any command on the server including writing arbitrary files. However, lower privilege users are generally forbidden from writin…
-
High 7.8
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environme…
-
High 8.8
Vulnerability in the Oracle Communications Convergence product of Oracle Communications Applications (component: Admin …
-
High 7.1
Norton, Avira, Avast and AVG Antivirus for Windows Privilege Escalation
Norton, Avira, Avast and AVG Antivirus for Windows may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normal…
-
High 7.8
A vulnerability in the ClearPass OnGuard Windows agent could allow malicious users on a Windows instance to elevate the…
-
High 7.8
A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their u…
-
High 7.8
A vulnerability in the ClearPass OnGuard macOS agent could allow malicious users on a macOS instance to elevate their u…
-
High 7.8CVE-2022-37706 Public exploit
enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and t…
-
High 8.1
Incorrect Use of Privileged APIs in usememos/memos
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0.
-
High 7.2
CVE-2022-38757 ZENworks
A vulnerability has been identified in Micro Focus ZENworks 2020 Update 3a and prior versions. This vulnerability allows administrators with rights to perform actions (e.g., install a bundle) on a set of managed devices, to be able to exercise these rights on…
-
High 8.8
A privilege escalation vulnerability exists in the oslo.privsep functionality of OpenStack git master 05194e7618 and pr…
-
High 8.8
OpenStack Kolla sudo privilege escalation vulnerability
A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. A misconfiguration in /etc/sudoers within a container can lead to increased privileges.
-
High 7.8
Proofpoint Enterprise Protection Local Privilege Escalation
Proofpoint Enterprise Protection (PPS/PoD) contains a vulnerability which allows the pps user to escalate to root privileges due to unnecessary permissions. This affects all versions 8.19.0 and below.
-
High 7.8CVE-2022-42046 Public exploit
wfshbr64.sys and wfshbr32.sys specially crafted IOCTL allows arbitrary user to perform local privilege escalation
-
High 7.2
vRealize Operations (vROps) contains a privilege escalation vulnerability. VMware has evaluated the severity of this is…
-
High 7.8
An access issue existed with privileged API calls. This issue was addressed with additional restrictions. This issue is…
-
High 7.1
A logic issue was addressed with improved state management. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, ma…
-
High 8.5
In some SAP standard roles in SAP Business Planning and Consolidation - versions - SAP_BW 750, 751, 752, 753, 754, 755,…
-
High 7.8
Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability
Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability
-
High 8.8
Elevation of privilege in the Azure SQL Data Source in Devolutions Remote Desktop Manager 2022.3.13 to 2022.3.24 allows…
-
High 7.3
Avast and AVG Antivirus for Windows vulnerable to Privilege Escalation
A vulnerability within the malware removal functionality of Avast and AVG Antivirus allowed an attacker with write access to the filesystem, to escalate his privileges in certain scenarios. The issue was fixed with Avast and AVG Antivirus version 22.10.
-
High 8.8
An issue was discovered in Veritas NetBackup Flex Scale through 3.0. An attacker with non-root privileges may escalate …
-
High 7.5
A CWE-269: Improper Privilege Management vulnerability exists that could cause a denial of service of the Ethernet comm…
-
High 7.2
WordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Auth. WordPress Options Change vulnerability
Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin <= 9.7.1 on WordPress.
-
High 7.8
INTELBRAS SG 2404 MR 20180928-rel64938 allows authenticated attackers to arbitrarily create Administrator accounts via …
-
High 7.8
In Zoho ManageEngine Mobile Device Manager Plus before 10.1.2207.5, the User Administration module allows privilege esc…
-
High 7.5
PHOENIX CONTACT: FL MGUARD DM version 1.12.0 and 1.13.0 Improper Privilege Management
In Phoenix Contact: FL MGUARD DM version 1.12.0 and 1.13.0 access to the Apache web server being installed as part of the FL MGUARD DM on Microsoft Windows does not require login credentials even if configured during installation.Attackers with network access…
-
High 7.3
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Prote…
-
High 7.3
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Prote…
-
High 8.6
Improper handling of registry symbolic links in Bitdefender Engines
An Improper Access Control vulnerability in the bdservicehost.exe component, as used in Bitdefender Engines for Windows, allows an attacker to delete privileged registry keys by pointing a Registry symlink to a privileged key. This issue affects: Bitdefender …
-
High 7.8
A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-004 Catalina, m…
-
High 7.8
This issue was addressed with improved checks. This issue is fixed in tvOS 16, iOS 16, watchOS 9. An app may be able to…
-
High 7.8
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 15.7 and iPadOS 15.7, macOS Ventur…
-
High 8.1
spring-security-oauth2-client vulnerable to Privilege Escalation
Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client (via the br…
-
High 8.8
Execution with Unnecessary Privileges in JupyterApp
Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in `jupyter_core` that stems from `jupyter_core` executing untrusted files in CWD. This vu…
-
High 8.8
Brocade Webtools in Brocade Fabric OS versions before Brocade Fabric OS versions v9.1.1, v9.0.1e, and v8.2.3c could all…
-
High 7.3
F5OS vulnerability CVE-2022-41835
In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.5.0, excessive file permissions in F5OS allows an authenticated local attacker to execute limited set of commands in a container and impact the F5OS controller.