Weakness (CWE)
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
3,028 results · Feed
-
High 7.8
An access issue existed with privileged API calls. This issue was addressed with additional restrictions. This issue is…
-
High 7.1
A logic issue was addressed with improved state management. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, ma…
-
High 8.5
In some SAP standard roles in SAP Business Planning and Consolidation - versions - SAP_BW 750, 751, 752, 753, 754, 755,…
-
High 7.8
Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability
Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability
-
Medium 6.4
Invite code reuse via cookie manipulation in sentry
Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts whe…
-
Medium 6.5
Incorrect privilege assignment in M-Files Web Server
Incorrect Privilege Assignment in M-Files Web (Classic) in M-Files before 22.8.11691.0 allows low privilege user to change some configuration.
-
Medium 6.7
Privilege Chaining with the user admin role in dhis2-core
DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. Affected versions are subject to a privilege escalation vulnerability. A DHIS2 user with authority to manage users can assign superuser privileg…
-
High 8.8
Elevation of privilege in the Azure SQL Data Source in Devolutions Remote Desktop Manager 2022.3.13 to 2022.3.24 allows…
-
Critical 9.8
WordPress ARMember Plugin <= 5.5.1 is vulnerable to Privilege Escalation
Unauth. Privilege Escalation vulnerability in ARMember premium plugin <= 5.5.1 on WordPress.
-
Medium 6.0
Improper Privilege Management in ikus060/rdiffweb
Improper Privilege Management in GitHub repository ikus060/rdiffweb prior to 2.5.2.
-
High 7.3
Avast and AVG Antivirus for Windows vulnerable to Privilege Escalation
A vulnerability within the malware removal functionality of Avast and AVG Antivirus allowed an attacker with write access to the filesystem, to escalate his privileges in certain scenarios. The issue was fixed with Avast and AVG Antivirus version 22.10.
-
Medium 6.7
In Wi-Fi, there is a possible memory access violation due to a logic error. This could lead to local escalation of priv…
-
High 8.8
An issue was discovered in Veritas NetBackup Flex Scale through 3.0. An attacker with non-root privileges may escalate …
-
Low 2.0
Incorrect privilege assignment in M-Files Web Server
Incorrect privilege assignment issue in M-Files Web in M-Files Web versions before 22.5.11436.1 could have changed permissions accidentally.
-
Medium 6.5
Improper Privilege Management in GitHub Enterprise Server leading to page creation and deletion
An improper privilege management vulnerability was identified in GitHub Enterprise Server that allowed users with improper privileges to create or delete pages via the API. To exploit this vulnerability, an attacker would need to be added to an organization's…
-
Low 2.4
Incorrect privilege assignment in M-Files Server
Incorrect privilege assignment in M-Files Server versions before 22.3.11164.0 and before 22.3.11237.1 allows user to read unmanaged objects.
-
Critical 9.1CVE-2022-41923 Public exploit
Grails Spring Security Core plugin vulnerable to privilege escalation
Grails Spring Security Core plugin is vulnerable to privilege escalation. The vulnerability allows an attacker access to one endpoint (i.e. the targeted endpoint) using the authorization requirements of a different endpoint (i.e. the donor endpoint). In some …
-
High 7.5
A CWE-269: Improper Privilege Management vulnerability exists that could cause a denial of service of the Ethernet comm…
-
Critical 9.8
A potential security vulnerability has been identified in OMEN Gaming Hub and in HP Command Center which may allow esca…
-
High 7.2
WordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Auth. WordPress Options Change vulnerability
Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin <= 9.7.1 on WordPress.
-
High 7.8
INTELBRAS SG 2404 MR 20180928-rel64938 allows authenticated attackers to arbitrarily create Administrator accounts via …
-
Critical 9.8
Dolibarr vulnerable to privilege escalation
Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API.
-
High 7.8
In Zoho ManageEngine Mobile Device Manager Plus before 10.1.2207.5, the User Administration module allows privilege esc…
-
Critical 9.6
Vela Insecure Defaults
Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela Server and Vela Worker prior to version 0.16.0 and Vela UI prior to version 0.17.0, some default configurations for Vela allow exploitation and cont…
-
High 7.5
PHOENIX CONTACT: FL MGUARD DM version 1.12.0 and 1.13.0 Improper Privilege Management
In Phoenix Contact: FL MGUARD DM version 1.12.0 and 1.13.0 access to the Apache web server being installed as part of the FL MGUARD DM on Microsoft Windows does not require login credentials even if configured during installation.Attackers with network access…
-
Critical 9.8
Symantec Endpoint Detection and Response (SEDR) Appliance, prior to 4.7.0, may be susceptible to a privilege escalation…
-
High 7.3
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Prote…
-
High 7.3
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Prote…
-
Medium 6.7
Improper Privilege Management vulnerability in Hewlett Packard Enterprise Nimble Storage Hybrid Flash Arrays and Nimble…
-
High 8.6
Improper handling of registry symbolic links in Bitdefender Engines
An Improper Access Control vulnerability in the bdservicehost.exe component, as used in Bitdefender Engines for Windows, allows an attacker to delete privileged registry keys by pointing a Registry symlink to a privileged key. This issue affects: Bitdefender …
-
High 7.8
A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-004 Catalina, m…
-
High 7.8
This issue was addressed with improved checks. This issue is fixed in tvOS 16, iOS 16, watchOS 9. An app may be able to…
-
High 7.8
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 15.7 and iPadOS 15.7, macOS Ventur…
-
High 8.1
spring-security-oauth2-client vulnerable to Privilege Escalation
Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client (via the br…
-
Medium 6.5
Automatic User Roles Switcher < 1.1.2 - Subscriber+ Privilege Escalation
The Automatic User Roles Switcher WordPress plugin before 1.1.2 does not have authorisation and proper CSRF checks, allowing any authenticated users like subscriber to add any role to themselves, such as administrator
-
Medium 4.3
Improper privilege management vulnerability in summary report management in Synology Presto File Server before 2.1.2-16…
-
High 8.8
Execution with Unnecessary Privileges in JupyterApp
Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in `jupyter_core` that stems from `jupyter_core` executing untrusted files in CWD. This vu…
-
High 8.8
Brocade Webtools in Brocade Fabric OS versions before Brocade Fabric OS versions v9.1.1, v9.0.1e, and v8.2.3c could all…
-
Medium 6.7
Dell PowerScale OneFS, versions 8.2.x-9.4.0.x, contain a privilege context switching error. A local authenticated malic…
-
High 7.3
F5OS vulnerability CVE-2022-41835
In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.5.0, excessive file permissions in F5OS allows an authenticated local attacker to execute limited set of commands in a container and impact the F5OS controller.