CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- drupal private content, private content project content +1 morePrivate content - Moderately critical - Access bypass - SA-CONTRIB-2024-0125.5 Medium
- couchbase serverAn issue was discovered in Couchbase Server before 7.2.x before 7.2.4. otpCookie is shown with...8.6 High
- gitlabIncorrect Privilege Assignment in GitLab6.7 Medium
- beyondtrust privilege management for windowsAn issue was discovered in BeyondTrust Privilege Management for Windows before 24.1. When an low...6.3 Medium
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +10 more +12 moreBIG-IP Appliance mode iAppsLX vulnerability6.0 Medium
- mitsubishi electric corporation melsec iq-r series safety cpu r08sfcpu, melsec iq-r series safety cpu r120sfcpu, melsec iq-r series safety cpu r16sfcpu +13 more +15 moreIncorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R...6.5 Medium
- lenovo tablet, tab m10 plus gen 3 tb125fu firmware, tab m8 hd tb8505f firmware +4 more +6 moreA privilege escalation vulnerability was reported in some Lenovo tablet products that could allow...6.8 Medium
- zoom, zoom video communications, inc. desktop client for windows, zoom vdi client for windows, and zoom sdks for windows before version 5.16.10, zoom meeting software development kit +2 more +4 moreZoom Desktop Client for Windows - Improper Access Control8.8 High
- ibm cics transaction gateway, cics transaction gateway containers +1 moreIBM CICS Transaction Gateway improper access controls4.0 Medium
- bd facschorusIncorrect User Management3.2 Low
- userproplugin userpro, userpro community and user profile wordpress plugin community and user profile wordpress plugin +1 moreUserPro <= 5.1.4 - Authenticated (Subscriber+) Privilege Escalation8.8 High
- microfocus fortify scancentral dastA potential Privilege Escalation vulnerability in opentext Fortify ScanCentral DAST API.8.2 High
- google androidIn createFromParcel of UsbConfiguration.java, there is a possible background activity launch (BAL...7.8 High
- hashicorp vault, vault enterprise +1 moreVault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets7.6 High
- hashicorp vault, vault enterprise +1 moreVault Enterprise's Sentinel RGP Policies Allowed For Cross-Namespace Denial of Service4.2 Medium
- webmedia ban usersBAN Users <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update & Privilege Escalation8.8 High
- searchbloxCVE-2020-101298.8 High
- samsung android, mobile devices, samsung mobile devices +2 moreParcel mismatch in AuthenticationConfig prior to SMR Aug-2023 Release 1 allows local attacker to...8.4 High
- samsung android, samsung mobile devices +1 moreImproper privilege management vulnerability in MMIGroup prior to SMR Aug-2023 Release 1 allows...8.4 High
- hashicorp consul, consul enterprise +1 moreJWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access7.4 High
- google androidIn startActivityInner of ActivityStarter.java, there is a possible way to launch an activity into...7.8 High
- jetbrains teamcityIn JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain...5.4 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreSamba: check attribute access rights for ldap adds of computers7.5 High
- hashicorp nomad, nomad enterprise +1 moreNomad Search API Leaks Information About CSI Plugins5.3 Medium
- hashicorp nomad, nomad enterprise +1 moreNomad ACL Policies without Label are Applied to Unexpected Resources4.1 Medium
- hashicorp terraform enterpriseTerraform Enterprise Agent Pool Controls Allowed Unauthorized Workspaces To Target an Agent Pool5.0 Medium
- ibm spectrum protect backup-archive client, spectrum protect +1 moreIBM Spectrum Protect Backup-Archive Client privilege escalation8.4 High
- amazon aws cloud development kit, aws aws-cdk +1 moreAWS CDK EKS overly permissive trust policies6.6 Medium
- gitlabIncorrect Privilege Assignment in GitLab4.4 Medium
- hashicorp consul, consul enterprise +1 moreConsul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner8.7 High
- kubernetes minikube[minikube] Network Port exposure in minikube running on macOS using Docker driver9.8 Critical
- wpdataaccess wp data access, peterschulznl wp data access – app builder for tables, forms, charts, maps & dashboards +1 moreWP Data Access <= 5.3.7 - Authenticated (Subscriber+) Privilege Escalation7.5 High
- arubanetworks clearpass policy manager, hewlett packard enterprise (hpe) aruba clearpass policy manager +1 moreAuthenticated Information Disclosure in ClearPass Policy Manager Web-Based Management Interface7.6 High
- google androidIn onAttach of SettingsPreferenceFragment.java, there is a possible bypass of Factory Reset...7.8 High
- hitachi storage plug-in for vmware vcenter, storage plug-in +1 morePrivilege Escalation Vulnerability in Hitachi Storage Plug-in for VMware vCenter7.6 High
- hitachi storage plug-in for vmware vcenter, storage plug-in +1 morePrivilege Escalation Vulnerability in Hitachi Storage Plug-in for VMware vCenter5.9 Medium
- ahorner text-helpers, texthelpers project texthelpers +1 moreahorner text-helpers translation.rb reverse tabnabbing6.3 Medium
- click studios passwordstate, passwordstate browser extension chrome +1 moreClick Studios Passwordstate Browser Extension Provisioning improper authorization5.0 Medium
- click studios passwordstate, passwordstate browser extension chrome +1 moreClick Studios Passwordstate API authorization4.3 Medium
- facepay project facepayFacepay camera.php authorization6.3 Medium
- dot tech smart campus systemDot Tech Smart Campus System findUser information disclosure4.3 Medium
- house rental system project rental system, unspecified house rental system +1 moreHouse Rental System POST Request tenant-engine.php unrestricted upload6.3 Medium
- human resource management system project resource management system, itsourcecode human resource management system +1 moreSourceCodester Human Resource Management System Content-Type employee.php unrestricted upload7.3 High
- feminer wms, warehouse management system project management system +1 moreFeMiner wms unrestricted upload6.3 Medium
- rinvizle event registration systemSourceCodester Event Registration System unrestricted upload4.7 Medium
- aureus erpjerryhanjj ERP Commodity Management inventory.php uploadImages unrestricted upload6.3 Medium
- aureus erp, huaxiaerp huaxia erp +1 moreHuaxia ERP Retail Management list information disclosure4.3 Medium
- apple ipados, macos, tvos +2 more +4 moreThis issue was addressed by removing additional entitlements. This issue is fixed in tvOS 16.1,...5.5 Medium
- easyii cms, easyiicms +1 moreeasyii CMS File Upload Management Upload.php file unrestricted upload6.3 Medium
- statamic cms, xjyunjing yunjing content management system +1 moreYunjing CMS upload_img.html unrestricted upload6.3 Medium
- Show moreLoading…