CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- 101gen automation web platform – notifications and otp for woocommerce, advanced country codeAutomation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter9.8 Critical
- No product listedSeclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability...7.8 High
- docmostDocmost: Privilege Escalation - ADMIN Can Invite Users as OWNER5.2 Medium
- goauthentik authentikauthentik: Privilege Escalation to Superuser via Group Hierarchy8.8 High
- david de boer paytium: mollie payment forms & donationsPaytium: Mollie payment forms & donations <= 5.0.3 - Unauthenticated Privilege Escalation via 'pt_form_field[pt-user-role]' Parameter9.8 Critical
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 moreDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an...6.8 Medium
- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 moreIBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities9.1 Critical
- ibm concertMultiple Vulnerabilities in IBM Concert Software9.6 Critical
- arubanetworks analytics and location engine, hewlett packard enterprise (hpe) ale +1 moreAuthenticated Remote File System Access Vulnerability in HPE Networking Analytics and Location Engine (ALE)7.2 High
- netdataNetdata: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution7.0 High
- netdataNetdata: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair7.8 High
- hp inc support assistantHP Support Assistant - Local Escalation of Privilege7.3 High
- niteo cmp – coming soon & maintenance plugin by niteothemesCMP <= 4.1.17 - Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX Action7.2 High
- meta box frontend submissionMeta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter9.8 Critical
- moore threads mtt s80 driver packageMoore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub_140006F0C privileges management9.3 Critical
- sysadminsmedia homeboxHomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching8.1 High
- uvdesk core-framework, community-skeleton +1 moreUVdesk core-framework before 1.1.7 Privilege Escalation via editAgent8.6 High
- mispMISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime8.7 High
- codeastro qr code attendance management systemCodeAstro QR Code Attendance Management System UserController.php save privileges management5.1 Medium
- mcphubsamanhappy MCPHub Template Import Endpoint templateService.ts importTemplate privileges management5.3 Medium
- zte smartlifeEmail enumeration and account ID leakage vulnerabilities in ZTE SmartLife APP4.3 Medium
- aiyiyi121 sxdevopsaiyiyi121 SxDevOps UserSerializer serializers.py update privileges management5.1 Medium
- carazo import and export users and customersImport and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer7.2 High
- carazo import and export users and customersImport and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_users7.2 High
- unknown forminator formsForminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import6.6 Medium
- unknown saml single sign onSAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account Matching8.1 High
- zte smartlifeA password reset vulnerability in ZTE SmartLife APP8.8 High
- zte smartlifeA vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP5.4 Medium
- stiofan userswpUsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Email8.1 High
- unknown wp import export liteWP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Import7.2 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.7.8 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.7.8 High
- pgpartman pg partmanpg_partman has privilege escalation through SQL injection in create_partition_time()9.9 Critical
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.7.8 High
- agronholm anyioAnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups7.0 High
- wpdevelop booking calendarBooking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter7.2 High
- servmask all-in-one wp migration and backupAll-in-One WP Migration and Backup < 7.111 - Authenticated Privilege Escalation to Admin via Import Secret Key Disclosure7.2 High
- dell openmanage server administrator, openmanage server administrator managed node (patch) for windows, openmanage server administrator managed node for rhel 8.10 +3 more +5 moreDell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege...7.2 High
- dell openmanage server administrator, openmanage server administrator managed node (patch) for windows, openmanage server administrator managed node for rhel 8.10 +3 more +5 moreDell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege...8.1 High
- patriksimek vm2vm2 before 3.11.7 Denylist Bypass via fs/promises8.4 High
- patriksimek vm2vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix9.4 Critical
- unknown puppyfwPuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation8.8 High
- unknown choose user role at registrationChoose User Role at Registration for WooCommerce < 1.3.3 - Unauthenticated Privilege Escalation via Registration Role Request7.5 High
- cisco ise passive identity connector, identity services engine software +1 moreCisco Identity Services Engine Hardening Release - Improper Privlege Management Vulnerabilities6.5 Medium
- dell ecsDell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0,...6.7 Medium
- curiosity gmbh workspacePrivilege escalation via legacy access group creation endpoint8.7 High
- themeum tutor lmsTutor LMS 2.7.1 - < 4.0.8 - Read-Only API Key Privilege Escalation via REST Request Misclassification7.2 High
- stellarwp givewpGiveWP < 4.16.8.1 - Unauthenticated Account Takeover via Donor Email Sanitization Mismatch8.1 High
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter9.8 Critical
- oracle vm virtualboxVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). ...8.6 High
- Show moreLoading…