Weakness (CWE)
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
3,027 results · Feed
-
High 7.8
In config_gov_time_windows of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could …
-
High 7.8
In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local …
-
High 7.8
In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a l…
-
High 7.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.4. An app may be…
-
High 8.4
A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macO…
-
Medium 6.0
User with permissions to create a data source can CRUD all data sources
A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.
-
High 8.1CVE-2024-22752 Public exploit
Insecure permissions issue in EaseUS MobiMover 6.0.5 Build 21620 allows attackers to gain escalated privileges via use …
-
High 7.6
Improper privilege management in Just-in-time (JIT) elevation module in Devolutions Server 2023.3.14.0 and earlier allo…
-
Critical 9.0
SAML implementation allows privilege escalation
In Blue Planet® products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation. Only products using SAML authentication are affected. Blue Planet® has released software updates that address this vulnerability for the aff…
-
Critical 9.8CVE-2023-38944 EPSS 16%
An issue in Multilaser RE160V firmware v12.03.01.09_pt and Multilaser RE163V firmware v12.03.01.10_pt allows attackers …
-
Critical 9.8
SQL Injection vulnerability in MyPrestaModules "Product Catalog (CSV, Excel) Import" (simpleimportproduct) modules for …
-
High 7.5
An issue was discovered in Presta World "Account Manager - Sales Representative & Dealers - CRM" (prestasalesmanager) m…
-
Medium 6.3
Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed Privilege Escalation
An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed an attacker to use the Enterprise Actions GitHub Connect download token to fetch private repository data. An attacker would require an account on the server…
-
High 7.3
Incomplete protection of personal password settings
Improper initialization of default settings in TeamViewer Remote Client prior version 15.51.5 for Windows, Linux and macOS, allow a low privileged user to elevate privileges by changing the personal password setting and establishing a remote connection to a l…
-
High 7.8CVE-2024-0197 Public exploit
Privilege Escalation in Thales SafeNet Sentinel HASP LDK
A flaw in the installer for Thales SafeNet Sentinel HASP LDK prior to 9.16 on Windows allows an attacker to escalate their privilege level via local access.
-
High 7.8CVE-2023-7016 Public exploit
Privilege Escalation in SafeNet Authentication Client
A flaw in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to execute code at a SYSTEM level via local access.
-
High 7.8
Privilege Escalation in SafeNet Authentication Client Installer
A flaw in the Windows Installer in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to escalate their privilege level via local access.
-
Critical 9.8CVE-2024-24402 Public exploit
An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/…
-
High 7.1
User can manually send request at manager permission to modify system configurations
As a manager, you should not be able to modify a series of settings. In the UI this is indeed hidden as a convenience for the role since most managers would not be savvy enough to modify these settings. They can use their token to still modify those settings …
-
Medium 4.4
The issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Ventura 13.6.3, ma…
-
Medium 6.7
VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative acces…
-
High 7.5
On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the pr…
-
High 7.8
In sanitizeSbn of NotificationManagerService.java, there is a possible way to launch an activity from the background du…
-
High 8.8
Local privilege escalation vulnerability could affect OpenText Operations Agent on Non-Windows platforms.
Local privilege escalation vulnerability affects OpenText Operations Agent product versions 12.15 and 12.20-12.25 when installed on Non-Windows platforms. The vulnerability could allow local privilege escalation.
-
High 7.9
An improper privilege management vulnerability [CWE-269] vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, …
-
High 7.8
Local privilege escalation in Windows products
Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET’s file operations to delete files without having proper permission.
-
High 7.2
Dell SupportAssist for Home PCs Installer Executable file version prior to 3.13.2.19 used for initial installation has …
-
High 8.8
The Plack::Middleware::XSRFBlock package before 0.0.19 for Perl allows attackers to bypass a CSRF protection mechanism …
-
Critical 10.0
OpenObserve Privilege Escalation Vulnerability in Users API
OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been identified in the "/api/{org_id}/users" endpoint. This vulnerability allows any authenticated regular…
-
Critical 9.1
OpenObserve Unauthorized Access Vulnerability in Users API
OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability has been identified in the "/api/{org_id}/users/{email_id}" endpoint. This vulnerability allows any a…
-
Critical 9.8
An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API…
-
Medium 6.7
Certain WithSecure products allow Local Privilege Escalation. This affects WithSecure Client Security 15 and later, Wit…
-
High 7.0
Insecure Permissions vulnerability in Forescout SecureConnector v.11.3.06.0063 allows a local attacker to escalate priv…
-
Medium 5.3
Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Op…
-
High 7.8
Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Op…
-
Medium 6.2
IBM Security Access Manager Container privilege escalation
IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a local user to escalate their privileges due to an improper security configurat…
-
High 7.7
Delegated Admin Virtual Attribute Provider Privilege Escalation
Delegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory Server.
-
High 8.8
MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation
MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin`…
-
High 8.8CVE-2024-21888 EPSS 85%
A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.…
-
High 7.8
Privilege Elevation via Telerik Test Studio
In Telerik Test Studio versions prior to v2023.3.1330, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik Test Studio install is present, a lower privileged user has th…