CWE-250: Execution with Unnecessary Privileges
The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
Also known as Excessive Agency.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- jupyterlab jupyterlab-desktop JupyterLab Desktop: TCC Bypass via Misconfigured Node Fuses 5.5 Medium
- jupyterlab jupyterlab-desktop JupyterLab Desktop: TCC Bypass via Insecure Entitlements (macOS) 5.5 Medium
- tubitak bilgem software technologies research institute pardus-usb-formatter Improper Device Validation Allows Privileged Disk Formatting in TÜBİTAK BİLGEM's pardus-usb-formatter 6.6 Medium
- google chrome Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a... 9.6 Critical
- google chrome Privilege elevation in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote... No score
- suse rancher Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller 9.1 Critical
- minecanton209 novumos NovumOS: Nova Interpreter Privilege Escalation 8.6 High
- cgm clininet Remote Code Execution in CGM CLININET 9.0 Critical
- oracle corporation graalvm enterprise edition, graalvm for jdk, java se +2 more Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition... 2.6 Low
- google chrome Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to... 9.6 Critical
- google chrome Use after free in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker... 8.8 High
- red hat openshift container platform 4.19, openshift container platform 4.20, openshift container platform 4.21 +2 more +4 more Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution 8.8 High
- google chrome Privilege elevation in Installer in Google Chrome on on Windows prior to 155.0.8059.79 allowed a... 5.5 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +18 more +20 more Windows Host Guardian Service Tampering Vulnerability 5.5 Medium
- nvidia aistore framework NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec... 10.0 Critical
- ibm aspera enterprise webapps IBM Aspera Enterprise Webapps Execution with Unnecessary Privileges 6.2 Medium
- agno agno-agi agno Delegation Feature _default_tools.py member_agent.run unnecessary privileges 5.3 Medium
- mjob mjobtime mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx 9.3 Critical
- red hat openshift container platform 4, openshift container platform 4.19, openshift container platform 4.20 +3 more +5 more Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret 6.8 Medium
- google chrome Privilege elevation in Sandbox in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote... 8.3 High
- hcl icontrol HCL iControl is affected by multiple security vulnerabilities 8.8 High
- accellion kiteworks, kiteworks core +1 more Kiteworks Core before version 9.5.0 is vulnerable to Local Privilege Escalation 7.8 High
- taskcluster Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`) 8.7 High
- pollen-robotics reachy-mini-os Reachy Mini Wireless: Local Privilege Escalation via Unrestricted sudo systemctl Grant 7.8 High
- No product listed FastAdmin Database Management database.php unnecessary privileges 8.5 High
- suse rancher, rancher fleet +1 more Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters 8.8 High
- webpros cpanel Execution with unnecessary privileges in cPanel allows remote authenticated users to execute... 9.4 Critical
- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 more IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities 4.4 Medium
- zohocorp manageengine opmanager, manageengine firewall analyzer +1 more Privilege Escalation vulnerability 8.1 High
- 1panel-dev maxkb MaxKB: Prompt-injectable agent can lead to command execution 10.0 Critical
- red hat confidential compute attestation, enterprise linux 8, enterprise linux 9 +2 more +4 more Cri-o: cri-o checkpoint restore bypasses destination security context 8.8 High
- webrecorder browsertrix Browsertrix: Arbitrary Command Injection due to Improper Command Sanitization in Git URLs specified as Custom Behaviors 9.4 Critical
- red hat enterprise linux 8, enterprise linux 9, enterprise linux 9.6 extended update support +1 more +3 more Leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld --validate-config as root and can load mysql-writable plugins 7.3 High
- gohugoio hugo Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS 9.3 Critical
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 more Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior... 3.4 Low
- google chrome Privilege elevation in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker... 8.3 High
- microsoft sharepoint server subscription edition, sharepoint server +1 more Microsoft Office SharePoint Elevation of Privilege Vulnerability 8.8 High
- microsoft sharepoint server subscription edition, sharepoint server +1 more Microsoft Office SharePoint Information Disclosure Vulnerability 6.5 Medium
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 more Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior... 9.3 Critical
- dalibo postgresql anonymizer PostgreSQL Anonymizer: Privilege escalation to superuser via anon.anonymize_database_parallel() 6.4 Medium
- elastic kibana Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure 6.5 Medium
- No product listed A local privilege escalation vulnerability exists in the Restricted Access (Kiosk) Mode... 7.8 High
- google chrome Privilege elevation in Import in Google Chrome prior to 151.0.7922.173 allowed a remote attacker... 8.8 High
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13 +4 more +6 more Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestwork 9.9 Critical
- nvidia cumulus linux, cumulus linux ga +1 more NVIDIA Cumulus Linux contains a vulnerability in the user management component, where an... 7.8 High
- redhat insights-client, red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13 +5 more +7 more Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege 6.5 Medium
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 more Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard rbac (*/*/*) 9.9 Critical
- ibm i IBM i is Affected By Improper Validation Vulnerability in Line Printer Daemon [] 8.2 High
- ibm i IBM i is Affected By A Privilege Escalation Vulnerability [] 8.8 High
- ibm i IBM i is Affected By Multiple Vulnerabilities in SQL 8.8 High
- Show olderLoading…