Weakness (CWE)
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
661 results · Clear filters · Feed
-
Medium 6.7
Dell PowerScale InsightIQ, version 5.1, contain an Improper Privilege Management vulnerability. A high privileged attac…
-
Medium 6.2
Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS, Zoom Rooms Client for macOS - Improper Privilege Management
Improper privilege management in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.5 may allow a privileged user to conduct an escalation of privilege via local access.
-
Medium 6.6
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected …
-
Medium 6.4
Privilege escalation vulnerability
Privilege escalation vulnerability identified in OpenText ArcSight Intelligence.
-
Medium 6.4
Harbor fails to validate the user permissions when updating project configurations
Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations.
-
Medium 5.8
An issue was discovered in WithSecure Elements Agent through 23.x for macOS, WithSecure Elements Client Security throug…
-
Medium 4.7
The Argo CD web terminal session does not handle the revocation of user permissions properly.
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD has a Web-based terminal that allows users to get a shell inside a running pod, just as they would with kubectl exec. Starting in version 2.6.0, when the administrator enables t…
-
Medium 6.5
The improper privilege management vulnerability in the Zyxel WBE660S firmware version 6.70(ACGG.3) and earlier versions…
-
Medium 6.5
Potential vulnerabilities have been identified in the HP Display Control software component within the HP Application E…
-
Medium 6.0
Admin Can Escalate Privileges to SuperAdmin Using Manual PUT Request
Improper privilege management in Yugabyte Platform allows authenticated admin users to escalate privileges to SuperAdmin via a crafted PUT HTTP request, potentially leading to unauthorized access to sensitive system functions and data.
-
Medium 4.9
Dell ECS, versions prior to 3.8.1, contain a privilege elevation vulnerability in user management. A remote high privil…
-
Medium 5.8
Improper Privilege Management allows for access to unauthorized repository content during migration
An improper privilege management vulnerability allowed users to migrate private repositories without having appropriate scopes defined on the related Personal Access Token. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and…
-
Medium 6.0
Rockwell Automation Unsecured Private Keys in FactoryTalk® System Services
The v6.40 release of Rockwell Automation FactoryTalk® Policy Manager CVE-2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html and CVE-2022-1161 https://www.rockwellautomation.com/en-us/trust-center/securit…
-
Medium 6.7
In DevmemIntFreeDefBackingPage of devicemem_server.c, there is a possible arbitrary code execution due to a logic error…
-
Medium 6.3
In updateServicesLocked of AccessibilityManagerService.java, there is a possible way for an app to be hidden from the S…
-
Medium 6.3
In increment_annotation_count of stats_event.c, there is a possible out of bounds write due to a missing bounds check. …
-
Medium 6.8CVE-2024-37726 Public exploit
Insecure Permissions vulnerability in Micro-Star International Co., Ltd MSI Center v.2.0.36.0 allows a local attacker t…
-
Medium 6.7
Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local …
-
Medium 6.7
Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local …
-
Medium 6.7
Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local …
-
Medium 6.8
Vulnerability of unauthorized screenshot capturing in the WMS module Impact: Successful exploitation of this vulnerabil…
-
Medium 6.1
Permission Bypass allowing attackers to disable HDCP 2.2 encryption by not completing the HDCP Key Exchange initializat…
-
Medium 6.8CVE-2024-5909 Public exploit
Cortex XDR Agent: Local Windows User Can Disable the Agent
A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a low privileged local Windows user to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform mal…
-
Medium 5.2
Cortex XDR Agent: Local Privilege Escalation (PE) Vulnerability
A privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices enables a local user to execute programs with elevated privileges. However, execution does require the local user to successfully exploit a race condition,…
-
Medium 5.4
Improper privilege management
An improper privilege management vulnerability exists in Tenable Security Center where an authenticated, remote attacker could view unauthorized objects and launch scans without having the required privileges
-
Medium 5.9
A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.11.0), Mendix Applicatio…
-
Medium 6.8
HP PC BIOS May 2024 Security Updates for Potential Stack Buffer Overflows
Potential vulnerabilities have been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerabilities.
-
Medium 6.8
Ariane Allegro Scenario Player through 2024-03-05, when Ariane Duo kiosk mode is used, allows physically proximate atta…
-
Medium 6.5
Privilege Escalation in TYPO3 CMS
The workspace/ version preview link created by a privileged (backend) user could be abused to obtain certain editing permission, if the admin panel is configured to be shown. A valid preview link is required to exploit this vulnerability.
-
Medium 6.5
** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the command “show_allsessions” in Zy…
-
Medium 6.7
** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the SUID executable binary in Zyxel …
-
Medium 6.5
TYPO3 Broken Access Control in Localization Handling
It has been discovered that backend users having limited access to specific languages are capable of modifying and creating pages in the default language which actually should be disallowed. A valid backend user account is needed in order to exploit this vuln…
-
Medium 5.4
Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily map physical memor…
-
Medium 6.8
WordPress Salon booking system plugin < 8.7 - Editor+ Privilege Escalation vulnerability
Improper Privilege Management vulnerability in Salon Booking System Salon booking system allows Privilege Escalation.This issue affects Salon booking system: from n/a through 8.6.
-
Medium 6.7
Uncontrolled search path for some Intel(R) CST software before version 2.1.10300 may allow an authenticated user to pot…
-
Medium 6.7
Uncontrolled search path element in some Intel(R) VTune(TM) Profiler software before version 2024.0 may allow an authen…
-
Medium 6.7
An issue was discovered in Samsung Magician 8.0.0 on macOS. Because it is possible to tamper with the directory and exe…
-
Medium 6.5
Neo4j Cypher component mishandles IMMUTABLE privileges
The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access.
-
Medium 6.7
In atf spm, there is a possible way to remap physical memory to virtual memory due to a logic error. This could lead to…
-
Medium 6.5
Jenkins Git server Plugin does not perform a permission check
Jenkins Git server Plugin 114.v068a_c7cc2574 and earlier does not perform a permission check for read access to a Git repository over SSH, allowing attackers with a previously configured SSH public key but lacking Overall/Read permission to access these repos…