CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Security Feature Bypass Vulnerability7.1 High
- altium enterprise server, on-prem enterprise server +1 moreStored Cross-Site Scripting in Altium Enterprise Server Workflow Engine Allows Privilege Escalation8.0 High
- ludashi driverA local information disclosure vulnerability exists in the Ludashi driver before 5.1025 due to a...7.3 High
- rocket.chatRocket.Chat Unauthorized Access to OAuth App Details7.7 High
- anysphere cursorCursor has a Terminal Tool Allowlist Bypass via Environment Variables7.2 High
- bluspark global bluvoyixAdministrator Account Creation Vulnerability in BLUVOYIX10.0 Critical
- hewlett packard enterprise (hpe) virtual intranet access (via)Local Privilege Escalation Vulnerability in HPE Aruba Networking Virtual Intranet Access (VIA) Client for Linux7.8 High
- tenable nessus agentLocal Privilege Escalation7.3 High
- termixTermix has a Stored XSS in File Manager leading to Local File Inclusion (LFI) in Electron and Session Hijacking in Browser8.0 High
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field9.8 Critical
- zte mf258k, mf258k pro firmware +1 moreZTE MF258K Pro Version Server has a Configuration Defect Vulnerability4.3 Medium
- rustfsRustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting5.7 Medium
- efacec qc 60/90/120PRIVILEGE ESCALATION VIA SUDO COMMAND8.6 High
- apache streampipesApache StreamPipes: Leverage of User ID for Privilege Escalation8.1 High
- asfhtgkdavid theshittheshit vulnerable to unsafe loading of user-owned Python rules when running as root.6.7 Medium
- n8nSelf-hosted n8n has Legacy Code node that enables arbitrary file read/write7.1 High
- hanwha vision co., ltd. qnv-c8012, hanwhavision knb-2000 firmware, knb-5000n firmware +254 more +256 moreInadequate account permissions management6.3 Medium
- honor magic osPrivilege Bypass in ADB2.2 Low
- k7computing k7 ultimate securityAn issue was discovered in K7 Ultimate Security 17.0.2045. A Local Privilege Escalation (LPE)...7.7 High
- cmssuperheroes flex store usersFlex Store Users <= 1.1.0 - Unauthenticated Privilege Escalation9.8 Critical
- galetteGalette has a privilege escalation vulnerability4.9 Medium
- hikvision ds-7104hghi-f1, ds-7104hghi-f1 firmware, ds-7204hghi-f1 +1 more +3 moreThere is a privilege escalation vulnerability in some Hikvision DVR products. Due to the improper...6.2 Medium
- belden hisecosHiSecOS 04.0.01 Privilege Escalation via User Role Modification8.7 High
- tecno pova6 pro 5g, transsion hios +1 moreFactory Mode App Exists Privilege Escalation Issue Allowing Third-Party Apps to Open ADB6.5 Medium
- drivelockAn issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25...9.8 Critical
- drivelockAn issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1...7.8 High
- drivelockAn issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1...9.9 Critical
- advantech susiAn Improper Access Control vulnerability in Advantech SUSI driver (susi.sys) allows attackers to...8.5 High
- apple macos, ios and ipados +1 moreA logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.8.3,...7.8 High
- apple macosThe issue was addressed by adding additional logic. This issue is fixed in macOS Sequoia 15.7.3....7.8 High
- parse-community parse-serverParse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management6.9 Medium
- apustheme wp cardealerWP CarDealer <= 1.2.16 - Unauthenticated Privilege Escalation9.8 Critical
- google cloud dialogflow cxPrivilege Escalation in Dialogflow CX via Webhook Admin Role8.7 High
- algosec firewall analyzerPrivilege Escalation via Misconfigured Sudoers Entry for Local Users in AlgoSec Firewall Analyzer6.1 Medium
- huawei harmonyosInput verification vulnerability in the compression and decompression module. Impact: Successful...8.4 High
- google cloud apigee-xImproper access control in Google Cloud Apigee-X allows cross-tenant Analytics modification and log data access.7.6 High
- canonical maasPrivilege Escalation in MAAS via Websocket Request Manipulation7.7 High
- plugin-alliance installation managerA local privilege escalation vulnerability exists in the Plugin Alliance InstallationHelper...6.2 Medium
- plugin-alliance installation managerA local privilege escalation vulnerability exists in the InstallationHelper service included with...6.2 Medium
- designthemes lmsDesignThemes LMS <= 1.0.4 - Unauthenticated Privilege Escalation9.8 Critical
- elextensions elex wordpress helpdesk & customer ticketing system, elula wsdesk +1 moreELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.2 - Authenticated (Contributor+) Privilege Escalation via eh_crm_edit_agent AJAX Action6.3 Medium
- entrust nshield 5c firmware, nshield connect xc base firmware, nshield connect xc high firmware +2 more +4 moreEntrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a Physically Proximate Attacker to Escalate Privileges by enabling…6.8 Medium
- entrust nshield 5c firmware, nshield connect xc base firmware, nshield connect xc high firmware +2 more +4 moreEntrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a...7.2 High
- entrust nshield 5c firmware, nshield connect xc base firmware, nshield connect xc high firmware +2 more +4 moreThe Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through...9.8 Critical
- snipeitapp snipe-itSnipe-IT is vulnerable to stored cross-site scripting5.4 Medium
- zentaoZenTao File control.php delete privileges management5.3 Medium
- apache kvrocksApache Kvrocks: RESET command grants admin privileges5.4 Medium
- qode interactive tiare membershipTiare Membership <= 1.2 - Unauthenticated Privilege Escalation9.8 Critical
- directorythemes tigerTiger <= 101.2.1 - Authenticated (Subscriber+) Privilege Escalation8.8 High
- directorythemes tigerTiger <= 101.2.1 - Unauthenticated Privilege Escalation9.8 Critical
- Show moreLoading…