Weakness (CWE)
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
3,028 results · Feed
-
High 7.5
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
High 7.7
Avaya Aura Communication Manager Privilege Escalation Vulnerabilities
Privilege escalation related vulnerabilities were discovered in Avaya Aura Communication Manager that may allow local administrative users to escalate their privileges. This issue affects Communication Manager versions 8.0.0.0 through 8.1.3.3 and 10.1.0.0.
-
High 7.8CVE-2022-41032 Public exploit
NuGet Client Elevation of Privilege Vulnerability
NuGet Client Elevation of Privilege Vulnerability
-
Critical 9.8
Improper Privilege Management in tooljet/tooljet
Account Takeover :: when see the info i can see the hash pass i can creaked it ............... Account Takeover :: when see the info i can see the forgot_password_token the hacker can send the request and changed the pass
-
High 7.7
Avaya Aura Application Enablement Services weak permissions in web application
A vulnerability related to weak permissions was detected in Avaya Aura Application Enablement Services web application, allowing an administrative user to modify accounts leading to execution of arbitrary code as the root user. This issue affects Application …
-
High 7.8
RealVNC VNC Server before 6.11.0 and VNC Viewer before 6.22.826 on Windows allow local privilege escalation via MSI ins…
-
High 8.8
Smart eVision - Improper Privilege Management
Smart eVision has an improper privilege management vulnerability. A remote attacker with general user privilege can exploit this vulnerability to escalate to administrator privilege, and then perform arbitrary system command or disrupt service.
-
High 8.8
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. This occurs bec…
-
High 7.8
A logic issue was addressed with improved state management. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big …
-
High 7.8
An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.6 and iPadOS 15.6, m…
-
High 7.8
This issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An…
-
High 7.8
This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5. An app may be able to gain r…
-
Medium 4.4
This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.4, iOS 15.5 and iPadOS …
-
Medium 4.4
This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.4. An app with root pri…
-
Medium 6.7
The “LANDesk(R) Management Agent” service exposes a socket and once connected, it is possible to launch commands only f…
-
High 7.8
A local privilege escalation vulnerability in UI Desktop for Windows (Version 0.55.1.2 and earlier) allows a malicious …
-
Medium 6.5
Liferay Portal and Liferay DXP Fails to Check Permissions in Translation Module
The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page's XLIFF …
-
Medium 5.3
Improper Privilege Management in octoprint/octoprint
Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3.
-
High 7.5
Festo: CPX-CEC-C1 and CMXX, Missing Authentication for Critical Webpage Function
Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service.
-
High 8.8
A vulnerability in Suprema BioStar (aka Bio Star) 2 v2.8.16 allows attackers to escalate privileges to System Administr…
-
Critical 9.8
The location module has a vulnerability of bypassing permission verification.Successful exploitation of this vulnerabil…
-
Medium 6.5CVE-2020-36603 Public exploit
The HoYoVerse (formerly miHoYo) Genshin Impact mhyprot2.sys 1.0.0.0 anti-cheat driver does not adequately restrict unpr…
-
High 8.8
Parsing issue in matrix-org/node-irc leading to room takeovers
matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. Attackers can specify a specific string of characters, which would confuse the bridge into combining an attacker-owned channel and an existing channel, allowing them to grant themselves pe…
-
Medium 4.3
IRC mode parameter confusion in matrix-appservice-irc
matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. The Internet Relay Chat (IRC) protocol allows you to specify multiple modes in a single mode command. Due to a bug in the underlying matrix-org/node-irc library, affected versions of matri…
-
Medium 5.9
Custom permission misuse vulnerability in SystemUI prior to SMR Sep-2022 Release 1 allows attacker to use some protecte…
-
Medium 5.0
GoCD Windows installations outside default location inadequately restrict installation file permissions
GoCD is a continuous delivery server. Windows installations via either the server or agent installers for GoCD prior to 22.2.0 do not adequately restrict permissions when installing outside of the default location. This could allow a malicious user with local…
-
High 8.1
XWiki.WebHome vulnerable to Improper Privilege Management in XWiki resolving groups
XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Starting in versions 11.3.7, 11.0.3, and 12.0RC1, it is possible to exploit a bug in XWikiRights resolution of groups to obtain privilege escalation. More specifically, edi…
-
High 7.8
Avaya IP Office Privilege Escalation Vulnerability
A privilege escalation vulnerability was discovered in Avaya IP Office Admin Lite and USB Creator that may potentially allow a local user to escalate privileges. This issue affects Admin Lite and USB Creator 11.1 Feature Pack 2 Service Pack 1 and earlier vers…
-
High 7.8
This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5, watchOS 8.7, iOS 15.6 and iP…
-
High 8.8
Improper Privilege Management in com.xuxueli:xxl-job
XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low Privilege account.
-
Medium 6.5CVE-2022-20361 Public exploit
In btif_dm_auth_cmpl_evt of btif_dm.cc, there is a possible vulnerability in Cross-Transport Key Derivation due to Weak…
-
Medium 6.2CVE-2022-20360 Public exploit
In setChecked of SecureNfcPreferenceController.java, there is a missing permission check. This could lead to local esca…
-
Medium 4.0
In shouldAllowFgsWhileInUsePermissionLocked of ActiveServices.java, there is a possible way to start foreground service…
-
High 7.5
In onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due to a confused deputy. T…
-
Medium 4.2
remap_pfn_range' here may map out of size kernel memory (for example, may map the kernel area), and because the 'vma->v…
-
Medium 6.4
VMware vRealize Operations contains a privilege escalation vulnerability. A malicious actor with administrative network…
-
High 7.4
The SystemUI module has a privilege escalation vulnerability. Successful exploitation of this vulnerability can cause m…
-
Medium 6.5
Azure Site Recovery Elevation of Privilege Vulnerability
Azure Site Recovery Elevation of Privilege Vulnerability
-
Medium 6.5
Azure Site Recovery Elevation of Privilege Vulnerability
Azure Site Recovery Elevation of Privilege Vulnerability
-
Medium 6.5
Azure Site Recovery Elevation of Privilege Vulnerability
Azure Site Recovery Elevation of Privilege Vulnerability