Weakness (CWE)
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
1,765 results · Clear filters · Feed
-
High 7.3
Teleopti WFM Administration privileges management
A vulnerability, which was classified as critical, was found in Teleopti WFM 7.1.0. This affects an unknown part of the component Administration. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely. The expl…
-
High 8.8
Privilege Escalation
The user access rights validation in the web server of the Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 was insufficient. This would allow a non-administrator user to obtain administrator user access rights.
-
High 7.9
McAfee MCPR privilege escalation
Improper privilege management vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local user to modify a configuration file and perform a LOLBin (Living off the land) attack. This could result in the user gaining elev…
-
High 7.3
ASUS Control Center - Broken Access Control
ASUS Control Center API has a broken access control vulnerability. An unauthenticated remote attacker can call privileged API functions to perform partial system operations or cause partial disrupt of service.
-
High 8.8
GE Voluson S8 Windows Operating System Patches privileges management
A vulnerability classified as critical was found in GE Voluson S8. Affected is the underlying Windows XP operating system. Missing patches might introduce an excessive attack surface. Access to the local network is required for this attack to succeed.
-
High 8.8
Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 - Authenticated Privilege Escalation
Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 allow any authenticated attacker, including a subscriber or customer-level attacker, to gain administrative privileges via the "abb_uninstall_template" (both) and "jupiterx_core_cp_uninstall_template" …
-
High 7.3
Solare Solar-Log Flash Memory privileges management
A vulnerability was found in Solare Solar-Log 2.8.4-56/3.5.2-85. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Flash Memory. The manipulation leads to privilege escalation. The attack can be laun…
-
High 7.3
MONyog Ultimate Cookie privileges management
A vulnerability, which was classified as critical, was found in MONyog Ultimate 6.63. This affects an unknown part of the component Cookie Handler. The manipulation of the argument HasServerEdit/IsAdmin leads to privilege escalation. It is possible to initiat…
-
High 7.3
Demokratian install3.php privileges management
A vulnerability classified as critical has been found in Demokratian. This affects an unknown part of the file install/install3.php. The manipulation leads to privilege escalation. It is possible to initiate the attack remotely. The exploit has been disclosed…
-
High 8.1
Cardo Systems Scala Rider Q3 Cardo-Updater api privileges management
A vulnerability classified as critical has been found in Cardo Systems Scala Rider Q3. Affected is the file /cardo/api of the Cardo-Updater. Unauthenticated remote code execution with root permissions is possible. Firewalling or disabling the service is recom…
-
High 7.5
Improper Privilege Management in Cilium
Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Prior to versions 1.9.16, 1.10.11, and 1.11.15, if an attacker is able to perform a container escape of a container running as root…
-
High 7.7
Unauthorized takeover for new versions of some platform-specific gems
RubyGems is a package registry used to supply software for the Ruby language ecosystem. An ordering mistake in the code that accepts gem uploads allowed some gems (with platforms ending in numbers, like `arm64-darwin-21`) to be temporarily replaced in the CDN…
-
High 8.8
API Privilege Escalation in alextselegidis/easyappointments
API Privilege Escalation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Full system takeover.
-
High 7.1
Privilege Escalation in argo-workflows
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XH…
-
High 7.2
Privilege escalation for users with create/update permissions in Global Roles
A Improper Privilege Management vulnerability in SUSE Rancher allows users with the restricted-admin role to escalate to full admin. This issue affects: SUSE Rancher Rancher versions prior to 2.5.13; Rancher versions prior to 2.6.4.
-
High 8.8
Metasys privilege management
Under certain circumstances improper privilege management in Metasys ADS/ADX/OAS servers versions 10 and 11 could allow an authenticated user to elevate their privileges to administrator.
-
High 8.8CVE-2022-1227 Public exploit
Podman publishes a malicious image to public registries
A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. Th…
-
High 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
-
High 7.3
Cisco SD-WAN vManage Software Privilege Escalation Vulnerability
A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as the root user. The attacker must be authenticated on the affected system as a low-priv…
-
High 7.8
JIMS: Local Privilege Escalation vulnerability via repair functionality
An Improper Privilege Management vulnerability in the Windows Installer framework used in the Juniper Networks Juniper Identity Management Service (JIMS) allows an unprivileged user to trigger a repair operation. Running a repair operation, in turn, will trig…
-
High 7.8
Improper Privilege Management in McAfee Agent for Windows
A local privilege escalation vulnerability in MA for Windows prior to 5.7.6 allows a local low privileged user to gain system privileges through running the repair functionality. Temporary file actions were performed on the local user's %TEMP% directory with …
-
High 8.8
Improper Privilege Management in MinIO
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. A security issue was found where an non-admin user is able to create service accounts for root or other admin users and then is able to assume their access polic…
-
High 8.0
FGAC API Key privilege escalation in Grafana
Grafana is an open-source platform for monitoring and observability. When fine-grained access control is enabled and a client uses Grafana API Key to make requests, the permissions for that API Key are cached for 30 seconds for the given organization. Because…
-
High 7.3
A local privilege escalation vulnerability caused by incorrect permission assignment in some directories of the Zyxel A…
-
High 8.8
Low privilege user is able to exploit the service and gain SYSTEM privileges in UltraVNC server
UltraVNC is a free and open source remote pc access software. A vulnerability has been found in versions prior to 1.3.8.0 in which the DSM plugin module, which allows a local authenticated user to achieve local privilege escalation (LPE) on a vulnerable syste…
-
High 7.9
Improper access control vulnerability in dynamic receiver in ApkInstaller prior to SMR MAR-2022 Release allows unauthor…
-
High 7.3
A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SI…
-
High 7.5
ICSA-22-053-01 GE Proficy CIMPLICITY-IPM
Exploitation of this vulnerability may result in local privilege escalation and code execution. GE maintains exploitation of this vulnerability is only possible if the attacker has login access to a machine actively running CIMPLICITY, the CIMPLICITY server i…
-
High 7.3
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation …
-
High 7.8
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation …
-
High 7.8
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation …
-
High 7.8
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation …
-
High 8.8
Privilege escalation in Defender
x26-Cogs is a repository of cogs made by Twentysix for the Red Discord bot. Among these cogs is the Defender cog, a tool for Discord server moderation. A vulnerability in the Defender cog prior to version 1.10.0 allows users with admin privileges to issue com…
-
High 8.2
Execution with Unnecessary Privileges in ipython
IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not p…
-
High 7.5
Agent-to-controller security bypass in Jenkins Debian Package Builder Plugin
Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agents to invoke command-line `git` at an attacker-specified path on the controller, allowing attackers able to control agent processes to invoke arbitrary OS comman…
-
High 8.2
Permissions granted to applications can be hidden from the user at install time
Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app …
-
High 7.1
Improper Privilege Management in shelljs/shelljs
shelljs is vulnerable to Improper Privilege Management
-
High 7.1
Potential product security bypass vulnerability in McAfee Application and Change Control (MACC) prior to version 8.3.4 …
-
High 8.8
User privilege escalation in MinIO
MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version `REL…
-
High 7.8
Mesa Labs AmegaView Improper Privilege Management
Mesa Labs AmegaView Versions 3.0 and prior has insecure file permissions that could be exploited to escalate privileges on the device.