CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- levelfourstorefront shopping cart & ecommerce storeShopping Cart & eCommerce Store <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action7.2 High
- fireplugins firebox – woocommerce popup builder, exit intent popup, email optin & cart abandonmentFireBox <= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege Escalation8.8 High
- connectwise screenconnectScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions9.9 Critical
- google android xrIn MicroXR Blobstore, there is a possible way to access other app's files due to a missing...10.0 Critical
- google android, android wear +1 moreIn checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive...10.0 Critical
- microsoft sql server 2017 (cu 31), sql server 2017 (gdr), sql server 2019 (cu 32) +9 more +11 moreMicrosoft SQL Server Elevation of Privilege Vulnerability8.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows Universal Plug and Play (UPnP) Device Host Information Disclosure Vulnerability5.5 Medium
- red hat build of apache camel - hawtio 4Hawtio-operator: hawtio-operator: cluster-wide secrets read/write granted to operator serviceaccount8.2 High
- elenavanengelenmaslova mocknest-serverlesselenavanengelenmaslova mocknest-serverless AWS GitHub OIDC Deployment Helper Script github-oidc-role.yaml privileges management5.1 Medium
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior...7.8 High
- very good plugins wp fusion (pro)WP Fusion (Pro) <= 3.47.13 - Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' Parameter7.5 High
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior...5.5 Medium
- zohocorp manageengine endpoint centralPrivilege Escalation6.3 Medium
- zohocorp manageengine endpoint centralPrivilege Escalation6.3 Medium
- zohocorp manageengine endpoint centralPrivilege Escalation5.0 Medium
- zohocorp manageengine endpoint centralPrivilege Escalation5.7 Medium
- sourcecodester syllabus-aligned learning management & examination systemSourceCodester Syllabus-Aligned Learning Management & Examination System auth.php register privileges management6.9 Medium
- surecartSureCart < 4.6.3 - Subscriber+ Administrator Account Takeover8.8 High
- tenda cp3Tenda CP3 Redirect.cpp SetRedirectEnable privileges management9.4 Critical
- getgrav grav-plugin-apigrav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag8.7 High
- tyche softwares abandoned cart pro for woocommerceAbandoned Cart Pro for WooCommerce <= 10.7.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation8.8 High
- lupsonline seo flow by lupsonlineSEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key Authentication9.8 Critical
- stackstorm st2StackStorm st2 API Key auth.py privileges management5.3 Medium
- stackstorm st2StackStorm st2 NoOp RBAC backend actionexecutions.py privileges management5.3 Medium
- No product listedInsecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows the...8.8 High
- No product listedAn issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via...9.1 Critical
- No product listedAn issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the...9.8 Critical
- wwbn avideoWWBN AVideo Authentication Bypass via Non-Expiring video_id_hash9.3 Critical
- seppmail ag secure email gatewayOS command injection in privileged configuration handling8.6 High
- craftcms cmsCraft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance9.2 Critical
- jeff farthing theme my loginTheme My Login 7.0 - 7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation5.4 Medium
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action8.1 High
- unknown jetbackupJetBackup 3.1.7.9 - 3.1.23.3 - Subscriber+ Privilege Escalation via Restore Admin User Selection7.1 High
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'9.8 Critical
- google chromeImproper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a...4.2 Medium
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 moreAuthentication Bypass Vulnerabilities Leading to Information Disclosure, Unauthorized Modification, and Service Disruption in AOS-CX8.2 High
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 moreAuthenticated Privilege Escalation Vulnerability via Broken Access Control in AOS-CX6.5 Medium
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 morePrivilege Escalation via Unauthorized Access to Sensitive Session Information5.7 Medium
- arubanetworks fabric composerLocal Privilege Escalation Vulnerability in HPE Networking Fabric Composer2.5 Low
- arubanetworks fabric composerLocal Privilege Escalation in HPE Networking Fabric Composer4.4 Medium
- arubanetworks fabric composerAuthenticated Privilege Escalation via Broken Access Control in HPE Networking Fabric Composer API6.5 Medium
- arubanetworks fabric composerAuthenticated Sensitive Information Disclosure in HPE Networking Fabric Composer6.5 Medium
- arubanetworks fabric composerLocal Privilege Escalation leads to Arbitrary Code Execution in HPE Networking Fabric Composer7.0 High
- arubanetworks fabric composerAuthenticated Privilege Escalation via Broken Access Control in HPE Networking Fabric Composer7.1 High
- arubanetworks fabric composerAuthenticated Privilege Escalation Leading to Unauthorized State Changes in HPE Networking Fabric Composer Web-Based Management Interface7.1 High
- arubanetworks fabric composerAuthenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API7.6 High
- arubanetworks fabric composerLocal Privilege Escalation Vulnerabilities in HPE Networking Fabric Composer7.8 High
- arubanetworks fabric composerUnauthenticated Privilege Escalation allows Administrative Access in HPE Networking Fabric Composer API8.1 High
- cleo harmonyCleo Harmony JWT Refresh Token connections privileges management6.9 Medium
- scriptsbundle nokri – job board wordpress themeNokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter9.8 Critical
- Show moreLoading…