CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter8.8 High
- dokan pro, wedevs dokan pro +1 moreDokan Pro <= 5.0.4 - Authenticated (Vendor+) Privilege Escalation via update_capabilities REST Endpoint8.8 High
- google chromeInappropriate implementation in CredentialProvider in Google Chrome on Windows prior to 150.0...7.8 High
- google chromeInsufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 allowed...9.6 Critical
- phpmyfaqphpMyFAQ - Privilege Escalation via Missing Self-Rights Constraint in GroupController::updatePermissions8.7 High
github.com/fission/fissionGoFission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec8.1 High- nokia mantaray nmA Sudo Privilege Escalation Vulnerability in Nokia MantaRay NM7.8 High
- gitea act runnerGitea act_runner - Container Hardening Bypass via Workflow Container Options9.4 Critical
- pravel invoice generatorInvoice Generator <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter9.8 Critical
- freebsdMissing permission check in thr_kill2(2)5.5 Medium
- cap-go capgoSupabase Capgo - Unauthenticated Cross-Tenant Build-Time Accounting Poisoning via record_build_time RPC8.8 High
motioneyePyPImotionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE)9.8 Critical- gogsGogs: Write-level collaborators can mutate admin-only repository settings via API7.1 High
- cap-go capgoCapgo - Authorization Bypass in API Key Management via App-Limited Keys8.7 High
- redhat openshift container platform, windows machine config operator, red hat openshift container platform 4 +5 more +7 moreWindows-machine-config-operator: windows-machine-config-operator: wicd csr extra-organization allows privilege escalation to system:masters8.8 High
- appsbd viteposVitepos < 3.4.2 - Outlet Manager+ Privilege Escalation8.8 High
- cap-go capgoCapgo - Privilege Escalation via SECURITY DEFINER Function apply_usage_overage7.2 High
- cap-go capgoCapgo - Scope Escalation via API Key Creation in /functions/v1/apikey8.7 High
- cap-go capgoCapgo - Improper 2FA Enforcement Logic via Team Security Settings5.1 Medium
- daytonaio daytonaDaytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape4.2 Medium
- strimzi strimzi-kafka-operatorStrimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator5.4 Medium
- red hat streams for apache kafka 2, streams for apache kafka 3.2.1, strimzi strimzi-kafka-operator +2 moreStrimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`8.0 High
- util-linuxutil-linux LIBMOUNT_FORCE_MOUNT2 allows nosuid and noexec bypass7.0 High
- steeltoeoss steeltoe.management.endpoint, steeltoe.management.endpointbase +1 moreSteeltoe's sensitive actuators (heapdump/env) only require Restricted permission6.5 Medium
- cisco umbrella virtual appliance, umbrella insights virtual appliance +1 moreCisco Umbrella Virtual Appliance Privilege Escalation Vulnerability6.0 Medium
- azuriom cmsBroken Access Control in Azuriom CMS Server Routes Allows Account Takeover8.6 High
- contest-gallery contest gallery – upload & vote photos, media, sell with paypal & stripeContest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter8.8 High
- google androidIn setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier...10.0 Critical
- google androidIn SettingsLib, there is a possible way to disable system components due to a logic error in the...7.8 High
- google chromeInappropriate implementation in Media in Google Chrome prior to 149.0.7827.155 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.155...8.8 High
- oracle corporation outsourced mfg for discrete industries, oracle outsourced manufacturing for discrete industries +1 moreVulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business...8.8 High
- oracle corporation outsourced mfg for discrete industries, oracle outsourced manufacturing for discrete industries +1 moreVulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business...8.8 High
- oracle hr intelligenceVulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component:...7.5 High
- oracle hr intelligenceVulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component:...7.2 High
- oracle universal work queueVulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component:...7.5 High
- oracle universal work queueVulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component:...9.9 Critical
- oracle project portfolio analysisVulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite ...8.8 High
- oracle project portfolio analysisVulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite ...8.8 High
- oracle subledger accountingVulnerability in the Oracle Subledger Accounting product of Oracle E-Business Suite (component:...7.5 High
- oracle subledger accountingVulnerability in the Oracle Subledger Accounting product of Oracle E-Business Suite (component:...7.5 High
- oracle corporation hrms (uk), oracle human resources management system +1 moreVulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll)....7.2 High
- oracle qualityVulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal...8.8 High
- oracle qualityVulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal...8.8 High
- oracle process manufacturing process planningVulnerability in the Oracle Process Manufacturing Process Planning product of Oracle E-Business...8.8 High
- oracle cost managementVulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost...8.8 High
- oracle isetupVulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger...8.8 High
- oracle corporation complex maintenance, repair and overhaul, oracle complex maintenance repair and overhaul +1 moreVulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business...7.5 High
- oracle corporation complex maintenance, repair and overhaul, oracle complex maintenance repair and overhaul +1 moreVulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business...7.5 High
- oracle applications managerVulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component:...9.9 Critical
- Show moreLoading…