Weakness (CWE)
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
3,026 results · Feed
-
High 8.8
WordPress Zephyr Project Manager plugin <= 3.3.97 - Privilege Escalation vulnerability
Improper Privilege Management vulnerability in Dylan James Zephyr Project Manager allows Privilege Escalation.This issue affects Zephyr Project Manager: from n/a through 3.3.97.
-
High 8.8
WordPress Ultimate Addons for elementor plugin <= 1.36.31 - Privilege Escalation vulnerability
Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Elementor allows Privilege Escalation.This issue affects Ultimate Addons for Elementor: from n/a through 1.36.31.
-
High 8.8
An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privil…
-
Critical 9.8
An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privil…
-
Medium 6.8CVE-2024-37726 Public exploit
Insecure Permissions vulnerability in Micro-Star International Co., Ltd MSI Center v.2.0.36.0 allows a local attacker t…
-
Medium 6.7
Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local …
-
Medium 6.7
Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local …
-
Medium 6.7
Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local …
-
High 7.8
Improper privilege management in Jungo WinDriver before 12.1.0 allows local attackers to escalate privileges and execut…
-
High 7.5
An issue discovered in MSP360 Backup Agent v7.8.5.15 and v7.9.4.84 allows attackers to obtain network share credentials…
-
High 7.8
Improper privilege management in Jungo WinDriver before 12.5.1 allows local attackers to escalate privileges and execut…
-
High 7.8
Improper privilege management in Jungo WinDriver before 12.2.0 allows local attackers to escalate privileges and execut…
-
High 8.8
Improper privilege management in Jungo WinDriver before 12.5.1 allows local attackers to escalate privileges, execute a…
-
High 7.8
Improper privilege management in Jungo WinDriver 6.0.0 through 16.1.0 allows local attackers to escalate privileges and…
-
Low 3.7
Some bbb-record-core files installed with wrong file permission
BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker may be able to exploit the overly elevated file permissions in the `/usr/local/bigbluebutton/core/vendor/bundle/ruby/2.7.0/gems/resque-2.6.0` dir…
-
High 7.3
Lack of Client Validation in Jamf Compliance Editor's Helper Service May Result in Privilege Escalation
The XPC service within the audit functionality of Jamf Compliance Editor before version 1.3.1 on macOS can lead to local privilege escalation.
-
High 8.4
WhatsUp Gold SetAdminPassword Improper Access Control Privilege Escalation Vulnerability
In WhatsUp Gold versions released before 2023.1.3, an Improper Access Control vulnerability in Wug.UI.Controllers.InstallController.SetAdminPassword allows local attackers to modify admin's password.
-
High 8.8
WordPress WishList Member X plugin < 3.26.7 - Authenticated Privilege Escalation vulnerability
Improper Privilege Management vulnerability in Membership Software WishList Member X allows Privilege Escalation.This issue affects WishList Member X: from n/a before 3.26.7.
-
Critical 9.3
When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegat…
-
High 7.7
Improper privilege management vulnerability in Parallels Desktop
Improper privilege management vulnerability in Parallels Desktop Software, which affects versions earlier than 19.3.0. An attacker could add malicious code in a script and populate the BASH_ENV environment variable with the path to the malicious script, execu…
-
High 7.3
Local Privilege Escalation in Quarantine of ESET products for Windows
Local privilege escalation vulnerability allowed an attacker to misuse ESET's file operations during a restore operation from quarantine.
-
Critical 9.8
Insecure Permissions vulnerability in JLINK Unionman Technology Co. Ltd Jlink AX1800 v.1.0 allows a remote attacker to …
-
High 7.8
Privilege escalation vulnerability in the AMS module Impact: Successful exploitation of this vulnerability may affect s…
-
Medium 6.8
Vulnerability of unauthorized screenshot capturing in the WMS module Impact: Successful exploitation of this vulnerabil…
-
Critical 9.8
Incorrect access control in the UART/Serial interface on the LB-LINK BL-W1210M v2.0 router allows attackers to access t…
-
Medium 6.1
Permission Bypass allowing attackers to disable HDCP 2.2 encryption by not completing the HDCP Key Exchange initializat…
-
High 7.8
In AcvpOnMessage of avcp.cpp, there is a possible EOP due to uninitialized data. This could lead to local escalation of…
-
High 7.0
In gpu_pm_power_off_top_nolock of pixel_gpu_power.c, there is a possible compromise of protected memory due to a race c…
-
High 7.7
In prepare_response of lwis_periodic_io.c, there is a possible out of bounds write due to an integer overflow. This cou…
-
High 8.8
AdGuardHome privilege escalation vulnerability
An issue in AdGuardHome v0.93 to latest allows unprivileged attackers to escalate privileges via overwriting the AdGuardHome binary.
-
Medium 6.8CVE-2024-5909 Public exploit
Cortex XDR Agent: Local Windows User Can Disable the Agent
A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a low privileged local Windows user to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform mal…
-
Medium 5.2
Cortex XDR Agent: Local Privilege Escalation (PE) Vulnerability
A privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices enables a local user to execute programs with elevated privileges. However, execution does require the local user to successfully exploit a race condition,…
-
Medium 5.4
Improper privilege management
An improper privilege management vulnerability exists in Tenable Security Center where an authenticated, remote attacker could view unauthorized objects and launch scans without having the required privileges
-
High 8.8
An access control issue in Wvp GB28181 Pro 2.0 allows authenticated attackers to escalate privileges to Administrator v…
-
Medium 5.9
A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.11.0), Mendix Applicatio…
-
Medium 6.8
HP PC BIOS May 2024 Security Updates for Potential Stack Buffer Overflows
Potential vulnerabilities have been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerabilities.
-
High 7.8
Trend Micro Security 17.x (Consumer) is vulnerable to a Privilege Escalation vulnerability that could allow a local att…
-
Critical 9.1
The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS …
-
High 7.8
An issue in SiSoftware SANDRA v31.66 (SANDRA.sys 15.18.1.1) and before allows an attacker to escalate privileges via a …
-
Medium 6.8
Ariane Allegro Scenario Player through 2024-03-05, when Ariane Duo kiosk mode is used, allows physically proximate atta…