Weakness (CWE)
CWE-282: Improper Ownership Management
The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.
How to prevent it (1 mitigation)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Source: MITRE CWE-282
18 results · Clear filters · Feed
-
Medium 4.3
Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout
Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records the checkout target user's id in the created_by column instead of the authenticated caller's id. Authenticated attacker…
-
Medium 6.3
OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer
In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks …
-
Medium 6.0
An improper ownership management vulnerability has been identified in Moxa’s Secure Router. Because of improper ownersh…
-
Medium 4.3
Jenkins HashiCorp Vault Plugin exposes system-scoped Vault credentials
Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to.
-
Medium 4.3
IBM OpenPages with Watson information disclosure
IBM OpenPages with Watson 8.3 and 9.0 could allow an authenticated user to obtain sensitive information that should only be available to privileged users.
-
Medium 4.3
IBM InfoSphere Information Server file manipulation
IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow an authenticated user to delete another user's comments due to improper ownership management.
-
Medium 5.3
PeerTube Arbitrary Playlist Creation via ActivityPub Protocol
This vulnerability allows any attacker to add playlists to a different user’s channel using the ActivityPub protocol. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associated channel to the …
-
Medium 4.3
PeerTube Arbitrary Playlist Creation via REST API
The vulnerability allows an existing user to add playlists to a different user’s channel using the PeerTube REST API. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associated channel to the …
-
Medium 5.4
Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-013
Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 7.X-1.0 before 7.X-1.2.
-
Medium 5.3
Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010
Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 0.0.0 before 2.0.2.
-
Medium 5.4
IBM OpenPages information disclosure
IBM OpenPages 9.0 could allow an authenticated user to obtain sensitive information such as configurations that should only be available to privileged users.
-
Medium 6.4
Users can impersonate import requesters if their actor IDs coincide in ImportDump
ImportDump is a mediawiki extension designed to automate user import requests. A user's local actor ID is stored in the database to tell who made what requests. Therefore, if a user on another wiki happens to have the same actor ID as someone on the central w…
-
Medium 6.3CVE-2024-8949 Public exploit
SourceCodester Online Eyewear Shop Cart Content Master.php improper ownership management
A vulnerability classified as critical has been found in SourceCodester Online Eyewear Shop 1.0. This affects an unknown part of the file /classes/Master.php of the component Cart Content Handler. The manipulation of the argument cart_id/id leads to improper …
-
Medium 6.3
A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LX…
-
Medium 4.3
A valid, authenticated LXCA user may be able to unmanage an LXCA managed device in through the LXCA web interface witho…
-
Medium 6.3
meetyoucrop big-whale Admin Module all.api improper ownership management
A vulnerability was found in meetyoucrop big-whale 1.1 and classified as critical. Affected by this issue is some unknown functionality of the file /auth/user/all.api of the component Admin Module. The manipulation of the argument id leads to improper ownersh…
-
Medium 4.3
Improper Ownership Management in GitLab
An information disclosure issue in GitLab CE/EE affecting all versions starting from 13.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows an attacker to extract non-protected CI/CD variables by tricking a user to visit a fork with a ma…
-
Medium 6.7
Cortex XDR Agent: Unintended Program Execution Leads to Local Privilege Escalation (PE) Vulnerability
A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with file creation privilege in the Windows root directory (such as C:\) to execute a program with eleva…