Skip to content
OpenAdvisories

Weakness (CWE)

CWE-274: Improper Handling of Insufficient Privileges

Base Draft Mapping discouraged

The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation.

Source: MITRE CWE-274

All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • Medium 5.7
    CVE-2026-62764

    Apache Accumulo: A user can trigger a graceful shutdown of services without the relevant system permissions

    Improper Handling of Insufficient Privileges vulnerability in Apache Accumulo. An authenticated, but low-privileged user without system permissions may issue a remote command to gracefully shutdown system components (compaction-coordinator, compactor, gc, man…

    Apache Software Foundation Apache Accumulo
  • Medium 5.3
    CVE-2025-54511

    Improper handling of insufficient privileges in the AMD Secure Processor (ASP) could allow an attacker to provide an in…

    AMD AMD Instinct™ MI210 AMD Instinct™ MI250 AMD Radeon™ PRO V620
  • Medium 4.3
    CVE-2026-33005

    Apache OpenMeetings: Insufficient checks in FileWebService

    Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings. Any registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name an…

    Apache Software Foundation Apache OpenMeetings org.apache.openmeetings:openmeetings-parent Maven
  • Medium 4.3
    CVE-2025-62175

    Mastodon streaming API fails to disconnect disabled and suspended users

    Mastodon is a free, open-source social network server based on ActivityPub. In versions before 4.4.6, 4.3.14, and 4.2.27, disabling or suspending a user account does not disconnect the account from the streaming API. This allows disabled or suspended accounts…

    mastodon mastodon
  • Medium 6.2
    CVE-2025-31275

    A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6. A sandboxed …

    Apple macOS macOS
  • Medium 6.7
    CVE-2025-20177

    Cisco IOS XR Software Image Verification Bypass Vulnerability

    A vulnerability in the boot process of Cisco IOS XR Software could allow an authenticated, local attacker to bypass Cisco IOS XR image signature verification and load unverified software on an affected device. To exploit this vulnerability, the attacker must …

    Cisco Cisco IOS XR Software iOS Network devices
  • Medium 4.7
    CVE-2024-12666

    ClassCMS User Management Page admin insufficient privileges

    A vulnerability has been found in ClassCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin?do=admin:user:editPost of the component User Management Page. The manipulation leads to improper han…

  • Medium 5.5
    CVE-2024-20324

    A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, low-privileged, local attacker to acc…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 6.7
    CVE-2023-32494

    Dell PowerScale OneFS, 8.0.x-9.5.x, contains an improper handling of insufficient privileges vulnerability. A local pri…

    Dell PowerScale OneFS
  • Medium 5.3
    CVE-2022-0668

    JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when …

    jfrog JFrog Artifactory
  • Medium 5.4
    CVE-2022-25782

    Insufficient privilege checks on object access and updates.

    Improper Handling of Insufficient Privileges vulnerability in Web UI of Secomea GateManager allows logged in user to access and update privileged information. This issue affects: Secomea GateManager versions prior to 9.7.

    Secomea GateManager
  • Medium 5.4
    CVE-2022-23160

    Dell PowerScale OneFS, versions 8.2.0-9.3.0, contains an Improper Handling of Insufficient Permissions vulnerability. A…

    Dell PowerScale OneFS
  • Medium 5.0
    CVE-2021-32006

    GateManager information leak for LinkManager Users

    This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Permission Issues vulnerability in LinkManager web portal of Secomea GateManager allows logged in LinkManager user to access stored SiteManager backup files.

    Secomea GateManager
  • Medium 5.6
    CVE-2018-6693

    Endpoint Security for Linux Threat Prevention (ENSLTP) privilege escalation vulnerability

    An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of check to time of use (TOCTOU) race condition during a specific scanning sequence, the unprivileged …

    McAfee Endpoint Security for Linux Threat Prevention (ENSLTP) Linux
  • Medium 4.4
    CVE-2017-3912

    McAfee Application Control and Change Control (MACC) - password management security feature bypass (SFB) leading to an authentication bypass

    Bypassing password security vulnerability in McAfee Application and Change Control (MACC) 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility.

    McAfee McAfee Application Control and Change Control (MACC)
  • Medium 6.8
    CVE-2018-6674

    Privilege escalation vulnerability in McAfee VSE when McTray run with elevated privileges

    Privilege Escalation vulnerability in Microsoft Windows client (McTray.exe) in McAfee VirusScan Enterprise (VSE) 8.8 prior to Patch 13 allows local users to spawn unrelated processes with elevated privileges via the system administrator granting McTray.exe el…

    McAfee VirusScan Enterprise (VSE)