Weakness (CWE)
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
3,028 results · Feed
-
High 7.8
HP has identified a potential vulnerability in BIOS firmware of some Workstation products. Firmware updates are being r…
-
High 7.8
Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privileg…
-
High 7.8
Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which m…
-
High 7.8
Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which m…
-
High 7.8
HPSFViewer might allow Escalation of Privilege. This potential vulnerability was remediated on July 29th, 2022. Custome…
-
Medium 6.3
Metabase subject to Improper Privilege Management
Metabase is an open source data analytics platform. Affected versions are subject to Improper Privilege Management. As intended, recipients of dashboards subscriptions can view the data as seen by the creator of that subscription. This allows someone with gre…
-
High 8.8
Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrar…
-
High 8.8
Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrar…
-
High 8.8
Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrar…
-
High 8.8
Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrar…
-
Medium 6.5
glpi vulnerable to Unauthorized access to data export
GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having access to the standard interface can export data of almost any GLPI item type, even those on which us…
-
High 7.8
Incorrect access control in Aternity agent in Riverbed Aternity before 12.1.4.27 allows for local privilege escalation.…
-
Medium 4.7
Issue with whitespace in JWT roles in OpenSearch
OpenSearch is an open source distributed and RESTful search engine. OpenSearch uses JWTs to store role claims obtained from the Identity Provider (IdP) when the authentication backend is SAML or OpenID Connect. There is an issue in how those claims are proces…
-
High 7.8
An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivilege…
-
High 7.8
An issue was discovered in the quarantine feature of Elastic Endpoint Security and Elastic Endgame for Windows, which c…
-
High 8.8
A privilege escalation vulnerability was identified in Nessus versions 8.10.1 through 8.15.8 and 10.0.0 through 10.4.1.…
-
High 7.5
Use of default credentials vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenti…
-
High 7.8
Symantec Endpoint Protection, prior to 14.3 RU6 (14.3.9210.6000), may be susceptible to a Elevation of Privilege vulner…
-
High 8.8
Insufficient permission check in the VQL copy() function
Rapid7 Velociraptor allows users to be created with different privileges on the server. Administrators are generally allowed to run any command on the server including writing arbitrary files. However, lower privilege users are generally forbidden from writin…
-
Medium 5.3
It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT t…
-
High 7.8
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environme…
-
High 8.8
Vulnerability in the Oracle Communications Convergence product of Oracle Communications Applications (component: Admin …
-
Medium 4.4
Product security bypass vulnerability in ACC prior to version 8.3.4 allows a locally logged-in attacker with administra…
-
Medium 4.9
H C Mingham-Smith Ltd - Tardis 2000 Privilege escalation
H C Mingham-Smith Ltd - Tardis 2000 Privilege escalation.Version 1.6 is vulnerable to privilege escalation which may allow a malicious actor to gain system privileges.
-
High 7.1
Norton, Avira, Avast and AVG Antivirus for Windows Privilege Escalation
Norton, Avira, Avast and AVG Antivirus for Windows may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normal…
-
High 7.8
A vulnerability in the ClearPass OnGuard Windows agent could allow malicious users on a Windows instance to elevate the…
-
High 7.8
A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their u…
-
High 7.8
A vulnerability in the ClearPass OnGuard macOS agent could allow malicious users on a macOS instance to elevate their u…
-
Medium 6.4
authentik allows existing authenticated users to create arbitrary accounts
authentik is an open-source Identity provider focused on flexibility and versatility. In versions prior to 2022.10.4, and 2022.11.4, any authenticated user can create an arbitrary number of accounts through the default flows. This would circumvent any policy …
-
Medium 4.2
Improper Privilege Management in usememos/memos
Improper Privilege Management in GitHub repository usememos/memos prior to 0.9.1.
-
Critical 9.8
h3c firewall <= 3.10 ESS6703 has a privilege bypass vulnerability.
-
High 7.8CVE-2022-37706 Public exploit
enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and t…
-
High 8.1
Incorrect Use of Privileged APIs in usememos/memos
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0.
-
High 7.2
CVE-2022-38757 ZENworks
A vulnerability has been identified in Micro Focus ZENworks 2020 Update 3a and prior versions. This vulnerability allows administrators with rights to perform actions (e.g., install a bundle) on a set of managed devices, to be able to exercise these rights on…
-
High 8.8
A privilege escalation vulnerability exists in the oslo.privsep functionality of OpenStack git master 05194e7618 and pr…
-
High 8.8
OpenStack Kolla sudo privilege escalation vulnerability
A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. A misconfiguration in /etc/sudoers within a container can lead to increased privileges.
-
High 7.8
Proofpoint Enterprise Protection Local Privilege Escalation
Proofpoint Enterprise Protection (PPS/PoD) contains a vulnerability which allows the pps user to escalate to root privileges due to unnecessary permissions. This affects all versions 8.19.0 and below.
-
Critical 9.8
Some smartphones have configuration issues. Successful exploitation of this vulnerability may cause privilege escalatio…
-
High 7.8CVE-2022-42046 Public exploit
wfshbr64.sys and wfshbr32.sys specially crafted IOCTL allows arbitrary user to perform local privilege escalation
-
High 7.2
vRealize Operations (vROps) contains a privilege escalation vulnerability. VMware has evaluated the severity of this is…