CWE-280: Improper Handling of Insufficient Permissions or Privileges
The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.
A kind of CWE-755 Improper Handling of Exceptional Conditions.
From the CWE List. © The MITRE Corporation.
Newest
- enalean tuleapInitial effort field does not respect field permissions in the Taskboard REST card representation in Tuleap4.3 Medium
- enalean tuleapArtifact permissions are not verified in the Cross Tracker Search widget in Tuleap5.3 Medium
- abb ac500 v3An attacker who successfully exploited these vulnerabilities could cause enable command execution...7.3 High
- dell update package framework, update package (dup) framework +1 moreDell Update Package Framework, versions prior to 22.01.02, contain(s) a Local Privilege...8.2 High
- imagination technologies graphics ddkGPU DDK - Security: Exploitable PVRSRVBridgePhysmemWrapExtMem may lead to overwrite read-only file/memory (e.g. libc.so)7.8 High
- hcl software bigfix inventoryHCL BigFix Inventory is affected by an access control vulnerability3.1 Low
- ruijie reyee osRuijie Reyee OS Improper Handling of Insufficient Permissions or Privileges9.2 Critical
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - MLIST/PM render state buffers writable allowing arbitrary writes to kernel memory pages8.1 High
- microfocus application automation toolsMultiple missing permission checks1.8 Low
- microfocus application automation toolsMultiple missing permission checks1.8 Low
- enalean tuleap, tuleap enterprise +1 moreTuleap lists trackers in the quick add actions of the backlog without any permissions check4.3 Medium
- enalean tuleapPermissions are incorrectly verified for project administrators in the cross tracker search widget4.9 Medium
- enalean tuleap, tuleap enterprise +1 moreTuleap does not properly check permissions for email notifications in trackers4.8 Medium
- ruijie rg-nbs2009g-p firmwareAn issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain...9.8 Critical
- planet gs-4210-24p2s firmware, gs-4210-24pl4c firmware, planet technology gs-4210-24p2s hardware 3.0 +1 more +3 morePLANET Technology switch devices - SSH server DoS attack7.5 High
- anji-plus aj-report, report +1 moreanji-plus AJ-Report Authentication Bypass9.8 Critical
- reputeinfosystems bookingpress, appointment booking calendar plugin and scheduling plugin – bookingpress +1 moreBookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Arbitrary File Upload8.8 High
- gentoo webminImproper handling of insufficient permissions or privileges vulnerability exists in ajaxterm...8.8 High
- matrix-org matrix-appservice-ircMalicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to4.3 Medium
- conduitImproper Handling of Insufficient Permissions or Privileges in Conduit8.1 High
- tecno com.transsion.carlcareImproper permission settings in com.transsion.carlcare9.8 Critical
- salonbookingsystem salon booking system, wordpresschef salon booking system – free version +1 moreSalon booking system <= 9.9 - Missing Authorization4.3 Medium
- wagtailImproper Handling of Insufficient Permissions in Wagtail5.5 Medium
- nautobotNautobot dynamic-group-members doesn't enforce permission restrictions on member objects6.3 Medium
- veeam backup enterprise manager, backup & replication, backup \& replication +2 moreVeeam Backup Enterprise Manager allows high-privileged users to read backup session logs.2.7 Low
- jetbrains teamcityIn JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope of the...5.5 Medium
- apple macosA downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in...3.3 Low
- wagtailPermission check bypass when editing a model with per-field restrictions in wagtail2.7 Low
- tcl 30z firmwareVarious software builds for the following TCL devices (30Z, A3X, 20XE, 10L) leak the device IMEI...8.8 High
- foxit pdf reader, pdf editor +1 moreIn Foxit PDF Reader and Editor before 2024.1, Local Privilege Escalation could occur during...7.8 High
- acquia mauticSensitive Data Exposure due to inadequate user permission settings8.3 High
- matrix-org matrix-appservice-ircTruncated content of messages can be leaked from matrix-appservice-irc4.3 Medium
- huawei emui, harmonyos +1 moreVulnerability of package name verification being bypassed in the HwIms module. Impact: Successful...7.5 High
- huawei emui, harmonyos +1 moreVulnerability of insufficient permission verification in the app management module. Impact:...7.5 High
- android pixel, google android +1 morethere is a possible way to bypass due to a logic error in the code. This could lead to local...7.8 High
- google androidIn onCreate of WifiDialogActivity.java, there is a possible way to bypass the...7.8 High
- apple macosThe issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6.3, macOS...7.8 High
- zscaler client connectorRevert password check incorrect type validation7.3 High
- elspec g5 digital fault recorder, elspec-ltd g5dfr firmware +1 moreAn issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before....8.8 High
- elspec g5 digital fault recorder, elspec-ltd g5dfr firmware +1 moreAn issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. The...5.3 Medium
- common-services so flexibiliteAn issue was discovered in Common-Services "So Flexibilite" (soflexibilite) module for PrestaShop...7.5 High
- redhat 3scale, red hat 3scale api management platform 2 +1 moreApicast: use_3scale_oidc_issuer_endpoint of token introspection policy isn't compatible with rh-sso 7.5 or later versions6.3 Medium
- oppo usercenter credit sdk, usercenter credit software development kit +1 moreOPPO Usercenter Credit sdk9.1 Critical
- dell supportassist client consumer, supportassist for home pcs +1 moreDell SupportAssist for Business PCs version 3.4.0 contains a local Authentication Bypass...6.3 Medium
- pixelfedInsufficient authorization allowing elevated access to resources in pixelfed9.9 Critical
- dell power manager, power manager (dpm) +1 moreDell Power Manager, versions prior to 3.14, contain an Improper Authorization vulnerability in...7.8 High
- quarkus, red hat build of optaplanner 8, build of quarkus 2.13.9.final +4 more +6 moreQuarkus: json payload getting processed prior to security checks when rest resources are used with annotations.8.6 High
- google androidIn convertToComponentName of DreamService.java, there is a possible way to launch arbitrary...7.8 High
- m-files serverImproper Permission Handling in M-Files Server4.3 Medium
- zoom rooms, zoom video communications, inc. rooms for macos +1 moreImproper privilege management in Zoom Rooms for macOS before version 5.16.0 may allow an...7.8 High
- Show moreLoading…