Weakness (CWE)
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
3,027 results · Feed
-
High 7.8
Privilege Elevation via Telerik Reporting Installer
In Telerik Reporting versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik Reporting install is present, a lower privileged user has the ability…
-
High 7.8
Privilege Elevation via Telerik JustDecompile Installer
In Telerik JustDecompile versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik JustDecompile install is present, a lower privileged user has the…
-
Medium 6.3
Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines
Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, which could allow a local user to acquire root permissions by modifying the updatescript.js, inserting special code inside the script and creating the done.txt file.…
-
High 7.6
Privilege Escalation Vulnerability in ONTAP 9
ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 and 9.13.1P4 are susceptible to a vulnerability which could allow an authenticated user with multiple remote accounts with differing roles to perform actions via REST API beyond their intende…
-
High 8.8
IBM Merge Healthcare eFilm Workstation SYSTEM Privilege Escalation
An improper privilege management vulnerability exists in IBM Merge Healthcare eFilm Workstation. A local, authenticated attacker can exploit this vulnerability to escalate privileges to SYSTEM.
-
Critical 9.8CVE-2024-22922 Public exploit
An issue in Projectworlds Vistor Management Systemin PHP v.1.0 allows a remtoe attacker to escalate privileges via a cr…
-
High 8.8CVE-2023-43317 Public exploit
An issue in Coign CRM Portal v.06.06 allows a remote attacker to escalate privileges via the userPermissionsList parame…
-
High 7.8
An improper access control vulnerability in Trend Micro Deep Security 20.0 and Trend Micro Cloud One - Endpoint and Wor…
-
High 7.4
An exposed dangerous function vulnerability in the Trend Micro Apex One agent could allow a local attacker to escalate …
-
Medium 6.7
A plug-in manager origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attack…
-
High 8.8
A malicious devtools extension could have been used to escalate privileges. This vulnerability affects Firefox < 122, F…
-
High 7.5
The nearby module has a privilege escalation vulnerability. Successful exploitation of this vulnerability may affect av…
-
High 7.5
Vulnerability of permissions being not strictly verified in the WMS module. Successful exploitation of this vulnerabili…
-
High 7.5
Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerabili…
-
High 7.5
Data confidentiality vulnerability in the ScreenReader module. Successful exploitation of this vulnerability may affect…
-
Medium 5.5
This issue was addressed with improved data protection. This issue is fixed in macOS Ventura 13. An app with root privi…
-
Critical 9.1
Azure IPAM solution Elevation of Privilege Vulnerability
Azure IPAM (IP Address Management) is a lightweight solution developed on top of the Azure platform designed to help Azure customers manage their IP Address space easily and effectively. By design there is no write access to customers' Azure environments as t…
-
High 8.3
An improper privilege management vulnerability [CWE-269] in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 a…
-
High 8.4
IBM Db2 for Windows privilege escalation
IBM Db2 for Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow a local user to escalate their privileges to the SYSTEM user using the MSI repair functionality. IBM X-Force ID: 270402.
-
Medium 6.6
Permissions and Access Control Vulnerability in ZTE Red Magic 8 Pro
Permissions and Access Control Vulnerability in ZTE Red Magic 8 Pro
-
Medium 5.4
Craft CMS Privilege Escalation
Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4…
-
Medium 6.5
Leverage the kruise-daemon pod to list all secrets in the entire cluster
Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1, and 1.5.2, an attacker who has gained root privilege of the node that kruise-daemon run can leverage the kruise-daemo…
-
Critical 9.8
An issue was discovered on GL.iNet devices through 4.5.0. Attackers can invoke the add_user interface in the system mod…
-
Critical 10.0
User Build misconfiguration resulting in local escalation of privilege
In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges neede…
-
Critical 10.0
An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in EoP
An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in Elevation of Privilege
-
High 8.5
Arbitrary remote code execution within wrangler dev Workers sandbox
The V8 inspector intentionally allows arbitrary code execution within the Workers sandbox for debugging. wrangler dev would previously start an inspector server listening on all network interfaces. This would allow an attacker on the local network to connect …
-
High 7.1
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause i…
-
Medium 6.0
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause i…
-
Low 3.3
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause d…
-
Medium 4.0
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause d…
-
Low 3.3
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause d…
-
Medium 4.0
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause d…
-
Medium 4.3
MeterSphere horizontal privilege escalation vulnerability of resources in project scope.
MeterSphere is a one-stop open source continuous testing platform. Prior to 2.10.10-lts, the authenticated attackers can update resources which don't belong to him if the resource ID is known. This issue if fixed in 2.10.10-lts. There are no known workarounds.
-
Medium 6.6
Sudo: improper handling of ipa_hostname leads to privilege mismanagement
A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after ret…
-
High 7.8
Sandbox Accounts for Events vulnerable to privilege escalation to read running events data
Sandbox Accounts for Events provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially read data from the events table by sending request payloads to the events AP…
-
Medium 6.5
Improper Privilege Management allows for arbitrary workflows to be run
Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped PAT. To exploit this, a workflow must have already existed in the target repo. This vulnerability affected all versions of GitHub Enterprise Server si…
-
High 8.0
Improper Privilege Management in GitHub Enterprise Server management console leads to privilege escalation
Improper privilege management in all versions of GitHub Enterprise Server allows users with authorized access to the management console with an editor role to escalate their privileges by making requests to the endpoint used for bootstrapping the instance. Th…
-
Low 2.7
PAN-OS: XML API Keys Revoked by Read-Only PAN-OS Administrator
An improper privilege management vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to revoke active XML API keys from the firewall and disrupt XML API usage.
-
Critical 9.1
Escalation of Privileges in SAP BTP Security Services Integration Library ([Python] cloud-pysec)
SAP BTP Security Services Integration Library ([Python] sap-xssec) - versions < 4.1.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
-
Critical 9.1
Escalation of Privileges in SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library)
SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unau…