CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- oracle cost managementVulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost...8.8 High
- oracle spares managementVulnerability in the Oracle Spares Management product of Oracle E-Business Suite (component:...8.8 High
- oracle hr intelligenceVulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component:...7.2 High
- oracle siebel crm, oracle corporation siebel crm cloud applications +1 moreVulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component:...8.8 High
- oracle process manufacturing product developmentVulnerability in the Oracle Process Manufacturing Product Development product of Oracle E...8.8 High
- oracle solarisVulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The...7.1 High
- oracle jd edwards enterpriseone toolsVulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component:...8.8 High
- oracle enterprise command center frameworkVulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business...9.9 Critical
- oracle enterprise command center frameworkVulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business...9.9 Critical
- oracle enterprise command center frameworkVulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business...9.6 Critical
- oracle enterprise command center frameworkVulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business...9.9 Critical
- oracle jd edwards enterpriseone general ledgerVulnerability in the JD Edwards EnterpriseOne General Ledger product of Oracle JD Edwards ...9.9 Critical
- oracle siebel crm, oracle corporation siebel crm integration +1 moreVulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). ...8.8 High
- oracle vm virtualboxVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA...6.0 Medium
- oracle vm virtualboxVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA...7.5 High
- oracle enterprise manager base platformVulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager...7.2 High
- oracle enterprise manager base platformVulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager...9.9 Critical
- oracle webcenter contentVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component:...8.7 High
- oracle identity manager connectorVulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component:...9.9 Critical
- oracle weblogic serverVulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). ...6.6 Medium
- oracle peoplesoft enterprise pt peopletoolsVulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component...8.2 High
- oracle peoplesoft enterprise pt peopletoolsVulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component...8.4 High
- openclawOpenClaw < 2026.5.12 - Bootstrap Token Replay via Pending Pairing Scope Widening2.3 Low
- openclawOpenClaw < 2026.4.2 - Shell Positional Parameters Bypass in Inline-Eval Checks7.6 High
- dell emc vxrail applianceapi-gateway container running with root privilege would allow an attacker to escape the container...7.0 High
- mozilla firefox, thunderbird +1 moreInformation disclosure, sandbox escape in the Security: Process Sandboxing component4.7 Medium
- mozilla firefox, thunderbird, red hat enterprise linux 10 +15 more +17 morePrivilege escalation in the Graphics: WebRender component8.8 High
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset7.5 High
- nokia sr linuxA local privilege escalation vulnerability in Nokia SR Linux6.3 Medium
- dvdfab virtual driveDVDFab Virtual Drive Signed Kernel Driver dvdfabio.sys privileges management8.5 High
- No product listedAn issue in Iru, Inc Kandji Agent before v.4.7.5(5374) allows a local attacker to escalate...8.4 High
- No product listedAn issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate...7.8 High
- openclawOpenClaw < 2026.5.18 - Identity Header Forgery via Trusted-Proxy Configuration7.4 High
- google chromeInappropriate implementation in Mojo in Google Chrome on Windows prior to 149.0.7827.115 allowed...8.8 High
- cyberark software, a palo alto networks company idira endpoint privilege managerIdira Endpoint Privilege Manager Agent: Local Privilege Escalation via Internal Communication or File Operation Manipulation8.9 High
- apple macosThe issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app...7.8 High
- fissionFission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption8.5 High
- fissionFission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation9.9 Critical
- fissionFission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container4.9 Medium
- fissionFission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape9.9 Critical
- fissionFission Container Executor Function PodSpec Injection Leading to Node Escape9.9 Critical
- fissionFission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover9.9 Critical
- amentotech doctreat coreDoctreat Core <= 1.6.8 - Unauthenticated Privilege Escalation9.8 Critical
- stiofan events calendar for geodirectoryEvents Calendar for GeoDirectory <= 2.3.28 - Authenticated (Subscriber+) Privilege Escalation8.8 High
- juev nebula-meshnebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints6.9 Medium
- apache http serverApache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules5.5 Medium
- altium enterprise serverPath Traversal in Altium Enterprise Server Collaboration Service Allows Privilege Escalation9.4 Critical
- arista networks eos / cloudvision exchange (cvx)Arista CloudVision Exchange (CVX) Cluster Privilege Escalation via MCS Redis Session8.7 High
- google chromeInappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an...6.3 Medium
- google chromeInappropriate implementation in ImageCapture in Google Chrome prior to 149.0.7827.53 allowed a...7.5 High
- Show moreLoading…