Weakness (CWE)
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
3,028 results · Feed
-
Unscored —
In ActivityStarter, there is a possible background activity launch due to an unsafe PendingIntent. This could lead to l…
-
High 7.8
The installer (aka openvpn-client-installer) in Securepoint SSL VPN Client before 2.0.40 allows local privilege escalat…
-
High 7.4
IBM i privilege escalation
Management Central as part of IBM i 7.2, 7.3, 7.4, and 7.5 Navigator contains a local privilege escalation vulnerability. A malicious actor with command line access to the operating system can exploit this vulnerability to elevate privileges to gain root acce…
-
Medium 4.9
IBM i privilege escalation
Management Central as part of IBM i 7.2, 7.3, 7.4, and 7.5 Navigator contains a local privilege escalation vulnerability. A malicious actor with command line access to the operating system can exploit this vulnerability to elevate privileges to gain component…
-
Unscored —
A local privilege escalation vulnerability in SonicWall Directory Services Connector Windows MSI client 4.1.21 and earl…
-
High 7.8
VMware Tools contains a local privilege escalation vulnerability. A malicious actor with local user access to a guest v…
-
Unscored —
HP Print and Scan Doctor for Windows may potentially be vulnerable to escalation of privilege. HP is releasing software…
-
High 7.5
An authenticated XCC user can change permissions for any user through a crafted API command.
-
High 7.8
Local Privilege Escalation in ClearPass OnGuard Linux Agent
A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges to those of a higher role. A successful exploit allows malicious users to execute arbitrary code with root level privileges o…
-
Unscored —
The leakage of the client secret in Tokueimaru_waiting Line 13.6.1 allows attackers to obtain the channel access token …
-
Unscored —
The leakage of the client secret in Onigiriya-musubee Line 13.6.1 allows attackers to obtain the channel access token a…
-
Unscored —
The leakage of the client secret in TonTon-Tei Line v13.6.1 allows attackers to obtain the channel access token and sen…
-
Unscored —
The leakage of the client secret in VISION MEAT WORKS TrackDiner10/10_mc Line v13.6.1 allows attackers to obtain the ch…
-
Medium 4.4
Junction Delete leading to elevation of privilege
Zscaler Client Connector Installer on Windows before version 3.4.0.124 improperly handled directory junctions during uninstallation. A local adversary may be able to delete folders in an elevated context.
-
Medium 6.6
VMware Fusion installer local privilege escalation
VMware Fusion(13.x prior to 13.5) contains a local privilege escalation vulnerability that occurs during installation for the first time (the user needs to drag or copy the application to a folder from the '.dmg' volume) or when installing an upgrade. A malic…
-
High 7.8
Pleaser privilege escalation vulnerability
please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)
-
Unscored —
An issue discovered in IXP Data Easy Install v.6.6.14884.0 allows local attackers to gain escalated privileges via weak…
-
Unscored —
An issue found in IXP Data Easy Install v.6.6.14884.0 allows a local attacker to gain privileges via a static XOR key.
-
Unscored —
A privilege escalation vulnerability exists within the Qumu Multicast Extension v2 before 2.0.63 for Windows. When a st…
-
High 8.8
SonicOS post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunnel allows users to e…
-
High 8.2
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
High 7.8CVE-2023-20598 Public exploit
An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOC…
-
Medium 6.7
Grafana privilege escalation vulnerability
Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Or…
-
Medium 4.3
In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an…
-
Medium 4.9
IBM i privilege escalation
Backup, Recovery, and Media Services (BRMS) for IBM i 7.2, 7.3, and 7.4 contains a local privilege escalation vulnerability. A malicious actor with command line access to the host operating system can elevate privileges to gain component access to the host op…
-
Unscored —
D-Link device DIR-820L 1.05B03 is vulnerable to Insecure Permissions.
-
Unscored —
An issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, before 22.7 and before 31.7.1 allows atta…
-
Medium 4.9
IBM i privilege escalation
IBM Directory Server for IBM i contains a local privilege escalation vulnerability. A malicious actor with command line access to the host operating system can elevate privileges to gain component access to the host operating system. IBM X-Force ID: 263584.
-
High 8.8
Privilege Escalation Vulnerability in SnapCenter
SnapCenter versions 4.8 through 4.9 are susceptible to a vulnerability which may allow an authenticated SnapCenter Server user to become an admin user on a remote system where a SnapCenter plug-in has been installed.
-
Medium 5.5
Synaptics-DisplayLink-privilege escalation vulnerability via a dynamic library sideloading
It is possible to sideload a compromised DLL during the installation at elevated privilege.
-
Unscored —
Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of thi…
-
Unscored —
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may cau…
-
High 8.4
Microsoft Office Elevation of Privilege Vulnerability
Microsoft Office Elevation of Privilege Vulnerability
-
High 7.0
Windows Error Reporting Service Elevation of Privilege Vulnerability
Windows Error Reporting Service Elevation of Privilege Vulnerability
-
Medium 6.5
CVE-2023-5214 - Privilege Escalation in Puppet Bolt
In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified.
-
Unscored —
An issue was discovered in WatchGuard EPDR 8.0.21.0002. Due to a weak implementation of message handling between WatchG…
-
Critical 9.8
A CWE-269: Improper Privilege Management vulnerability exists that could cause a remote code execution when the transfe…
-
High 7.8
A local privilege escalation vulnerability in SonicWall Net Extender MSI client for Windows 10.2.336 and earlier versio…
-
High 8.8
Privilege Escalation in VASA
A flaw exists in VASA which allows users with access to a vSphere/ESXi VMware admin on a FlashArray to gain root access through privilege escalation.
-
Medium 4.3
Employee without any access rights can list all installed modules in Prestashop
PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list all modules without any access rights: method `ajaxProcessGetPossibleHookingListForModule` doesn't check access rights. This issue has been …