Weakness (CWE)
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
3,028 results · Feed
-
High 7.3
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Agent (Wind…
-
Medium 4.1
Data leakage in Adobe connector for SPE edition of SLM
Data leakage in Adobe connector in Snow Software SPE 9.27.0 on Windows allows privileged user to observe other users data.
-
Medium 5.4
BUG-000142922 Incomplete permission changes in specific cases.
Changes to user permissions in Portal for ArcGIS 10.9.1 and below are incompletely applied in specific use cases. This issue may allow users to access content that they are no longer privileged to access.
-
High 7.5
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
Critical 9.9
Rancher Webhook is misconfigured during upgrade process
Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. A failure in the update logic of Rancher's admission Webhook may lead to the misconfiguration of the Webhook. This component enforces validation rules and security checks…
-
Critical 9.3CVE-2022-3405 Public exploit
Code execution and sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The followin…
-
Medium 5.3
A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be…
-
Medium 5.7
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
Medium 6.6
Clusternet has potential risk which can be leveraged to make a cluster-level privilege escalation
Clusternet is a general-purpose system for controlling Kubernetes clusters across different environments. An issue in clusternet prior to version 0.15.2 can be leveraged to lead to a cluster-level privilege escalation. The clusternet has a deployment called `…
-
Critical 9.1
Improper privilege management vulnerability in CyberPower PowerPanel Business
Improper privilege management vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earl…
-
High 8.8
Improper Privilege Management in microweber/microweber
Improper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4.
-
High 7.8
SolarWinds Platform Local Privilege Escalation Vulnerability
The SolarWinds Platform was susceptible to the Local Privilege Escalation Vulnerability. This vulnerability allows a local adversary with a valid system user account to escalate local privileges.
-
High 7.8
A local privilege escalation (LPE) vulnerability in UI Desktop for Windows (Version 0.59.1.71 and earlier) allows a mal…
-
High 8.0
kubewarden: Excessive permissions for kubewarden-controller-manager-cluster-role
An Improper Privilege Management vulnerability in SUSE kubewarden allows attackers to read arbitrary secrets if they get access to the ServiceAccount kubewarden-controller This issue affects: SUSE kubewarden kubewarden-controller versions prior to 1.6.0.
-
High 8.2
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
High 7.8CVE-2023-21987 Public exploit
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
High 7.0
Vulnerability in the Oracle Solaris product of Oracle Systems (component: NSSwitch). Supported versions that are affect…
-
Medium 5.5
A CWE-269: Improper Privilege Management vulnerability exists that could cause a local user to perform a denial of serv…
-
Medium 6.4
Apache Spark proxy-user privilege escalation from malicious configuration class
In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-rela…
-
High 8.1
OpenFeature Operator vulnerable to Cluster-level Privilege Escalation
The OpenFeature Operator allows users to expose feature flags to applications. Assuming the pre-existence of a vulnerability that allows for arbitrary code execution, an attacker could leverage the lax permissions configured on `open-feature-operator-controll…
-
Critical 9.8
An issue found in WHOv.1.0.28, v.1.0.30, v.1.0.32 allows an attacker to cause a escalation of privileges via the TTMult…
-
High 7.8
An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges via the update_info f…
-
High 7.7CVE-2023-1326 Public exploit
local privilege escalation in apport-cli
A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unprivileged users to run sudo apport-cli, less is configured as the pager, and the terminal size can be …
-
Critical 9.3
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading t ...
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading to a priv…
-
Critical 9.0
TightVNC before v2.8.75 allows attackers to escalate privileges on the host operating system via replacing legitimate f…
-
High 8.3
A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.…
-
Critical 9.8
An issue found in POWERAMP audioplayer build 925 bundle play and build 954 allows a remote attacker to gain privileges …
-
Medium 6.7
In adsp, there is a possible out of bounds write due to improper input validation. This could lead to local escalation …
-
High 7.8
In mmsdk, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local code ex…
-
Medium 6.5
Fields GLPI plugin vulnerable to unauthorized write access to additional fields
Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows any authenticated user to write data to any fields container, including those to which they have no co…
-
High 8.1
GLPI vulnerable to account takeover by authenticated user
GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, an authenticated user can modify emails of any user, and can therefore takeover another user account through the "forgotten password" fe…
-
Medium 6.5
Bhima version 1.27.0 allows a remote attacker to update the privileges of any account registered in the application via…
-
High 7.8
An issue was discovered in Acuant AsureID Sentinel before 5.2.149. It allows elevation of privileges because it opens N…
-
High 8.4
An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. During installation, an EXE gets executed out of C:\W…
-
Medium 4.7
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer handler, where improper privile…
-
High 7.2
Improper Privilege Management in thorsten/phpmyfaq
Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
High 7.8
A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the Q…
-
High 7.8
A vulnerability exists in FlexNet Manager Suite releases 2015 R2 SP3 and earlier (including FlexNet Manager Platform 9.…
-
Medium 6.4
Permissions bypass in Apiman could enable authenticated attacker to unpermitted API Key
Apiman is a flexible and open source API Management platform. Due to a missing permissions check, an attacker with an authenticated Apiman Manager account may be able to gain access to API keys they do not have permission for if they correctly guess the URL, …
-
Critical 9.8
Some smartphones have configuration issues. Successful exploitation of this vulnerability may cause kernel privilege es…