CWE-280: Improper Handling of Insufficient Permissions or Privileges
The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.
A kind of CWE-755 Improper Handling of Exceptional Conditions.
From the CWE List. © The MITRE Corporation.
Newest
- dell powerscale onefsDell PowerScale OneFS 8.2.x, 9.0.0.x-9.5.0.x contains an improper handling of insufficient...4.3 Medium
- dell powerscale onefsDell PowerScale OneFS 8.2x -9.5x contains a privilege escalation vulnerability. A local attacker...6.7 Medium
- m-files, m-files client +1 moreElevation of Privilege in M-Files Desktop Client7.5 High
- checkmkUnauthorized scheduling of downtimes via REST API4.3 Medium
- nvidia vgpu software (guest driver - windows), vgpu software (guest driver - linux), vgpu software (virtual gpu manager - citrix hypervisor, vmware vsphere, red hat enterprise linux kvm), nvidia cloud gaming (guest driver - windows), nvidia cloud gaming (guest driver - linux), nvidia cloud gaming (virtual gpu manager - red hat enterprise linux kvm), virtual gpu +1 moreNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a kernel mode layer...7.1 High
- apimanPermissions bypass in Apiman could enable authenticated attacker to unpermitted API Key6.4 Medium
- cilium cilium-cli`cilium-cli` disables etcd authorization for clustermesh clusters4.8 Medium
- xuxueli xxl-jobXuxueli xxl-job allows attacker to obtain sensitive information via the pageList parameter7.5 High
- samsung android, samsung mobile devices +1 moreImproper Handling of Insufficient Permissions or Privileges vulnerability in...5.9 Medium
- wire, wireapp wire-server +1 morewire-server vulnerable to unauthorized removal of Bots from Conversations6.5 Medium
- usememos memos, usememos/memos +1 moreImproper Handling of Insufficient Permissions or Privileges in usememos/memos8.4 High
- google android, samsung mobile devices +1 moreImproper handling of insufficient permissions vulnerability in setSecureFolderPolicy in...6.2 Medium
- liferay portal, digital experience platform +1 moreMissing permissions check in Liferay Portal4.3 Medium
- google android, samsung mobile devices +1 moreImproper access control vulnerability in IpcRxServiceModeBigDataInfo in RIL prior to SMR Nov-2022...5.9 Medium
- google android, samsung mobile devices +1 moreImproper access control vulnerability in BootCompletedReceiver_CMCC in DeviceManagement prior to...5.9 Medium
- samsung shareliveImproper restriction of broadcasting Intent in ShareLive prior to version 13.2.03.5 leaks MAC...5.9 Medium
- samsung mobile waterplugin, samsung galaxy watch plugin +1 moreImproper Handling of Insufficient Permissions or Privileges vulnerability in Waterplugin prior to...5.9 Medium
- dell emc networker, networker management console +1 moreDell EMC NetWorker 19.2.1.x 19.3.x, 19.4.x, 19.5.x, 19.6.x and 19.7.0.0 contain an Improper...6.1 Medium
- hypr serverInsecure Direct Object Reference vulnerability in HYPR Server before version 6.14.1 allows remote...7.5 High
- google android, samsung mobile devices +1 moreImproper handling of insufficient permissions vulnerability in addAppPackageNameToAllowList in...6.2 Medium
- google android, samsung mobile devices +1 moreBroadcasting Intent including the BluetoothDevice object without proper restriction of receivers...4.0 Medium
- google android, samsung mobile devices +1 moreBroadcasting Intent including the BluetoothDevice object without proper restriction of receivers...4.0 Medium
- google android, samsung mobile devices +1 moreBroadcasting Intent including the BluetoothDevice object without proper restriction of receivers...4.0 Medium
- google android, samsung mobile devices +1 moreUnprotected broadcast in sendIntentForToastDumpLog in DisplayToast prior to SMR Jun-2022 Release...4.0 Medium
- eset endpoint antivirus, endpoint security, file security +16 more +18 moreLocal Privilege Escalation in ESET product for Windows7.3 High
- eset endpoint antivirus, endpoint security, file security +16 more +18 moreArbitrary File Deletion in ESET products for Windows7.1 High
- google android, samsung mobile devices +1 moreUnprotected dynamic receiver in Telecom prior to SMR Feb-2022 Release 1 allows untrusted...7.1 High
- nvidia gpu display driver, geforce, nvs +3 more +5 moreNVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver package, where...6.1 Medium
- oracle mysql connectors, quarkus +1 moreImproper Handling of Insufficient Permissions or Privileges in MySQL Connectors Java6.6 Medium
- siemens ruggedcom rox mx5000, ruggedcom rox rx1400, ruggedcom rox rx1500 +17 more +19 moreA vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM...5.3 Medium
- redux.io gutenberg template library & redux framework, redux gutenberg template library \& redux framework +1 moreGutenberg Template Library & Redux Framework <= 4.2.11 Incorrect Authorization check to Arbitrary plugin installation and post deletion7.1 High
- zephyrproject zephyrImproper Handling of Insufficient Permissions or Privileges in zephyr5.9 Medium
- secomea gatemanager, gatemanager 4250 firmware, gatemanager 4260 firmware +2 more +4 moreInsecure Direct Object Reference in GateManager WebUI can cause privilege escalation7.1 High
- dell emc powerscale onefs, powerscale onefs +1 moreDell EMC PowerScale OneFS versions 8.1.2 – 9.1.0 contain an issue where the OneFS SMB directory...5.3 Medium
- apache accumuloApache Accumulo Improper Handling of Insufficient Permissions8.1 High
- cisco duo authentication for windows logon and rdpDuo Authentication for Windows Logon and RDP Privilege Escalation Vulnerability6.6 Medium
- ivanti connect secure, pulsesecure pulse connect secure, ivanti policy secure +1 more +3 moreAn insufficient permission check vulnerability exists in Pulse Connect Secure <9.1R8 that allows...7.2 High
- hackerone nextcloud server, nextcloud server +1 moreImproper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be...4.3 Medium
- palo alto networks pan-osPAN-OS: Custom-role users may escalate privileges7.8 High
- floragunn search guardSearch Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled,...6.5 Medium
- siemens sinema remote connect serverA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Due to...8.8 High
- jenkins, redhat openshift +1 moreMissing permissions check in Jenkins Core4.3 Medium
- redhat jboss enterprise application platform, red hat jboss enterprise application platform 6 for rhel 5, jboss enterprise application platform 6 for rhel 6 +4 more +6 moreJboss enterprise application platform: jboss eap: jbeap: jboss enterprise application platform: unauthorized ejb access via authorization module bypass5.3 Medium