CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- arubanetworks edgeconnect sd-wan orchestrator, hewlett packard enterprise (hpe) edgeconnect sd-wan gateways, hpe edgeconnect operating system +2 moreAuthorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator9.9 Critical
- stylemixthemes consulting - business, finance wordpress themeConsulting - Business, Finance WordPress Theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation via AJAX8.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the Enterprise Policies component8.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the Session Restore component8.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the DevTools component8.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the Graphics: CanvasWebGL component8.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the Crash Reporting component8.8 High
- mozilla firefox, firefox mobile +1 morePrivilege escalation in Firefox for Android8.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the DOM: Service Workers component8.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the WebExtensions component8.8 High
- arraytics eventin – event calendar, tickets, registration, booking & woocommerceEventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter7.5 High
- sourcecodester college notes gallery management systemSourceCodester College Notes Gallery Management System Registration Flow signup.php privileges management6.9 Medium
- No product listedIncorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9...8.8 High
- apple ipados, tvos, visionos +3 more +5 moreA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and...3.3 Low
- apple ipados, macos, tvos +4 more +6 moreA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and...3.3 Low
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...5.5 Medium
- apple ipados, macos, tvos +3 more +5 moreA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and...5.5 Medium
- apple ipados, macos, ios and ipados +1 more +3 moreA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and...8.2 High
- apple ipados, visionos, watchos +2 more +4 moreA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and...5.5 Medium
- apple ipados, macos, safari +5 more +7 moreA permissions issue was addressed by removing the vulnerable code. This issue is fixed in Safari...6.5 Medium
- android systemOctober CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls3.3 Low
- soarkey studentmanagementSoarkey StudentManagement Registration Workflow register.html RegisterServlet.doPost privileges management6.9 Medium
- apache software foundation syncopeApache Syncope: Delegating users can grant unowned Roles9.8 Critical
- parallels desktop for macParallels Desktop local privilege escalation via appliance extract argument injection7.8 High
- logitech logi options+Local privilege escalation in the Logi Options+ updater service on Windows8.5 High
- jaychouchannel tourism-management-systemjaychouchannel Tourism-Management-System User Register Endpoint UsersController.java privileges management6.9 Medium
- lenve vhrlenve vhr HrMapper.xml HrInfoController.updateHr privileges management5.3 Medium
- unknown simple membershipSimple Membership < 4.7.8 - Subscriber+ Membership Level Escalation via PayPal Standard subsc_ref5.4 Medium
- unknown user registration & membershipUser Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership Purchase7.5 High
- unknown user registration & membershipUser Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Administrator7.2 High
- xuxueli xxl-jobXuxueli xxl-job JobGroupController.java privileges management5.3 Medium
- memberpress corporate accountsMemberPress Corporate Accounts <= 1.5.39 - Authenticated (Subscriber+) Privilege Escalation via Mass Assignment in Sub-Account Creation8.8 High
- unknown add user autocompleteAdd User Autocomplete < 1.2 - Subscriber+ Privilege Escalation8.8 High
- unknown wp componentWP Component <= 2.2.4 - Unauthenticated Privilege Escalation via Arbitrary Blog Option Update9.8 Critical
- unknown temporary login without passwordTemporary Login Without Password 1.5 - 1.9.8 - Multisite Subsite Admin+ Network Super Admin Privilege Escalation7.2 High
- perforce puppet enterpriseCommand Injection in Puppet Enterprise8.6 High
- multivendorxMultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator7.2 High
- ibm aspera enterprise webappsMultiple vulnerabilities in IBM Aspera Enterprise Webapps8.8 High
- ibm db2IBM® Db2® is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions8.1 High
- ibm websphere application serverIBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities6.3 Medium
- openpanel-dev openpanelOpenPanel through 2.3.0 Read-Only Access Level Enforcement Bypass via Mutations7.2 High
- cap-go capgo.appcapgo.app through 12.207.1 Privilege Escalation via invite_new_user_to_org8.6 High
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +3 more +5 moreCrun: crun: rootful krun with passt executes container payload as host root7.8 High
- themegrill registration form for woocommerceRegistration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id7.2 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion7.1 High
- hewlett packard enterprise (hpe) clearpass policy manager (cppm)Privilege Escalation in ClearPass OnGuard Agent6.5 Medium
- grokability snipe-itSnipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay7.4 High
- eset spol. s.r.o. av remover (standalone)Local privilege escalation vulnerability in ESET AV Remover8.5 High
- yith woocommerce waitlist premiumYITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user8.8 High
- publishpress user role editor – publishpress capabilities: access control and user rolesPublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant7.2 High
- Show moreLoading…