CWE-250 (page 2)
Page 2 of 4 — CVEs classified under CWE-250, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-36186 | High | 7.4 | 2025-11-07 | IBM Db2 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) under specific configurations could allow a local user to execute malic… |
CVE-2025-10885 | High | 7.8 | 2025-11-06 | A maliciously crafted file, when executed on the victim's machine, can lead to privilege escalation to NT AUTHORITY/SYSTEM due to an insufficient validation of… |
CVE-2025-43990 | High | 7.3 | 2025-11-05 | Dell Command Monitor (DCM), versions prior to 10.12.3.28, contains an Execution with Unnecessary Privileges vulnerability. A low privileged attacker with local… |
CVE-2025-33003 | High | 7.8 | 2025-10-31 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow a non-root user to gain higher privileges/capabilities within the scope of a container… |
CVE-2025-34274 | Critical | 9.8 | 2025-10-30 | Nagios Log Server versions prior to 2024R2.0.3 contain an execution with unnecessary privileges vulnerability as it runs its embedded Logstash process as the r… |
CVE-2021-47700 | High | 7.8 | 2025-10-30 | Nagios XI versions prior to 5.8.7 used a temporary directory for Highcharts exports with overly permissive ownership/permissions under the Apache user. Local o… |
CVE-2020-36868 | High | 7.8 | 2025-10-30 | Nagios XI versions prior to 5.7.3 contain a privilege escalation vulnerability in the getprofile.sh helper script. The script performed profile retrieval and i… |
CVE-2018-25123 | High | 7.8 | 2025-10-30 | Nagios XI versions prior to 5.5.7 contain a privilege escalation vulnerability in the MRTG graphing component. MRTG-related processes/scripts executed with exc… |
CVE-2025-36137 | High | 7.2 | 2025-10-30 | IBM Sterling Connect Direct for Unix 6.2.0.7 through 6.2.0.9 iFix004, 6.4.0.0 through 6.4.0.2 iFix001, and 6.3.0.2 through 6.3.0.5 iFix002 incorrectly assigns… |
CVE-2025-62503 | Medium | 4.6 | 2025-10-30 | User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action. |
CVE-2025-62402 | Medium | 5.4 | 2025-10-30 | API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Da… |
CVE-2025-43017 | Critical | 9.8 | 2025-10-28 | HP ThinPro 8.1 System management application failed to verify user's true id. HP has released HP ThinPro 8.1 SP8, which includes updates to mitigate potential… |
CVE-2025-6949 | | 2025-10-17 | An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A critical authorization flaw in… | |
CVE-2025-6894 | | 2025-10-17 | An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the API authorization l… | |
CVE-2025-6893 | | 2025-10-17 | An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in broken access control h… | |
CVE-2025-61909 | Medium | 4.4 | 2025-10-16 | Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icin… |
CVE-2025-34515 | Critical | 9.8 | 2025-10-16 | Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an execution with unnecessary privileges vulnerability in sync_project.sh that allows an attacke… |
CVE-2025-57780 | High | 8.8 | 2025-10-15 | A vulnerability exists in F5OS-A and F5OS-C system that may allow an authenticated attacker with local access to escalate their privileges. A successful explo… |
CVE-2025-8486 | High | 7.8 | 2025-10-15 | A potential vulnerability was reported in PC Manager that could allow a local authenticated user to execute code with elevated privileges. |
CVE-2025-61958 | High | 8.7 | 2025-10-15 | A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administrator role to bypass tmsh restrictions… |
CVE-2025-59481 | High | 8.7 | 2025-10-15 | A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with at least resource adm… |
CVE-2025-50505 | High | 7.8 | 2025-10-07 | Clash Verge Rev thru 2.2.3 (fixed in 2.3.0) forces the installation of system services(clash-verge-service) by default and exposes key functions through the un… |
CVE-2025-36356 | Critical | 9.3 | 2025-10-06 | IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow a locally authenticated us… |
CVE-2025-58432 | High | 7.8 | 2025-09-17 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and all prior versions, the /v2_1/files/file/up… |
CVE-2025-58431 | Medium | 6.2 | 2025-09-17 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and earlier, the /v2_1/files/file/download endp… |
CVE-2025-37128 | Medium | 6.8 | 2025-09-16 | A vulnerability in the web API of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to terminate arbitrary running… |
CVE-2025-56557 | Critical | 9.1 | 2025-09-16 | An issue discovered in the Tuya Smart Life App 5.6.1 allows attackers to unprivileged control Matter devices via the Matter protocol. |
CVE-2025-57119 | Critical | 9.8 | 2025-09-16 | An issue in Online Library Management System v.3.0 allows an attacker to escalate privileges via the adminlogin.php component and the Login function |
CVE-2024-47120 | Medium | 6.4 | 2025-09-10 | IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7, and 10.0.8 could allow a privileged user to escalate their privileges and attack surface on the h… |
CVE-2025-42958 | Critical | 9.1 | 2025-09-09 | Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high privileged unauthorized users to read, modi… |
CVE-2022-38695 | High | 7.8 | 2025-09-01 | In BootRom, there's a possible unchecked command index. This could lead to local escalation of privilege with no additional execution privileges needed. |
CVE-2022-38694 | High | 7.8 | 2025-09-01 | In BootRom, there is a possible unchecked write address. This could lead to local escalation of privilege with no additional execution privileges needed. |
CVE-2022-38691 | High | 7.8 | 2025-09-01 | In BootROM, there is a possible missing validation for Certificate Type 0. This could lead to local escalation of privilege with no additional execution privil… |
CVE-2025-0080 | High | 7.8 | 2025-08-26 | In multiple locations, there is a possible way to overlay the installation confirmation dialog due to a tapjacking/overlay attack. This could lead to local esc… |
CVE-2025-0079 | High | 7.8 | 2025-08-26 | In multiple locations, there is a possible way that avdtp and avctp channels could be unencrypted due to a logic error in the code. This could lead to local es… |
CVE-2025-0078 | High | 8.8 | 2025-08-26 | In main of main.cpp, there is a possible way to bypass SELinux due to a logic error in the code. This could lead to local escalation of privilege with no addit… |
CVE-2025-50753 | High | 8.4 | 2025-08-26 | Mitrastar GPT-2741GNAC-N2 devices are provided with access through ssh into a restricted default shell.The command "deviceinfo show file" is supposed to be use… |
CVE-2025-33120 | High | 7.8 | 2025-08-22 | IBM QRadar SIEM 7.5 through 7.5.0 UP13 could allow an authenticated user to escalate their privileges via a misconfigured cronjob due to execution with unneces… |
CVE-2025-21110 | Medium | 6.7 | 2025-08-14 | Dell Data Lakehouse, versions prior to 1.5.0.0, contains an Execution with Unnecessary Privileges vulnerability. A high privileged attacker with local access c… |
CVE-2025-8907 | High | 7.0 | 2025-08-13 | A vulnerability was found in H3C M2 NAS V100R006. Affected by this vulnerability is an unknown functionality of the component Webserver Configuration. The mani… |
CVE-2025-40767 | High | 7.8 | 2025-08-12 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application runs docker containers witho… |
CVE-2025-3892 | Medium | 6.7 | 2025-08-12 | ACAP applications can be executed with elevated privileges, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis d… |
CVE-2025-42943 | Medium | 4.5 | 2025-08-12 | SAP GUI for Windows may allow the leak of NTML hashes when specific ABAP frontend services are called with UNC paths. For a successful attack, the attacker nee… |
CVE-2025-55077 | High | 7.4 | 2025-08-07 | Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote Micros… |
CVE-2025-33109 | High | 7.5 | 2025-07-24 | IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 is vulnerable to a privilege escalation caused by an invalid database authority check. A bad actor could execute a database… |
CVE-2025-43487 | Medium | 6.8 | 2025-07-23 | A potential privilege escalation through Sudo vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The firmware flaw do… |
CVE-2025-46116 | High | 8.8 | 2025-07-21 | An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where an a… |
CVE-2025-24331 | Medium | 6.4 | 2025-07-02 | The Single RAN baseband OAM service is intended to run as an unprivileged service. However, it initially starts with root privileges and assigns certain capabi… |
CVE-2025-6019 | High | 7.0 | 2025-06-19 | A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to… |
CVE-2025-36048 | High | 7.2 | 2025-06-18 | IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 could allow a privileged user to escalate their privileges when handling external entities due t… |
CVE-2025-1411 | High | 7.8 | 2025-06-15 | IBM Security Verify Directory Container 10.0.0.0 through 10.0.3.1 could allow a local user to execute commands as root due to execution with unnecessary privil… |
CVE-2025-33108 | High | 8.5 | 2025-06-14 | IBM Backup, Recovery and Media Services for i 7.4 and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges du… |
CVE-2025-49581 | High | 8.8 | 2025-06-13 | XWiki is a generic wiki platform. Any user with edit right on a page (could be the user's profile) can execute code (Groovy, Python, Velocity) with programming… |
CVE-2024-13090 | High | 7.0 | 2025-06-10 | A privilege escalation vulnerability may enable a service account to elevate its privileges. The sudo rules configured for a local service account were exce… |
CVE-2025-5196 | Medium | 6.6 | 2025-05-26 | A vulnerability has been found in Wing FTP Server up to 7.4.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the com… |
CVE-2025-33103 | High | 8.5 | 2025-05-17 | IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 product IBM TCP/IP Connectivity Utilities for i contains a privilege escalation vulnerability. A malicious actor with command… |
CVE-2025-0921 | Medium | 6.5 | 2025-05-15 | Execution with Unnecessary Privileges vulnerability in multiple services of Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONI… |
CVE-2025-1137 | High | 7.5 | 2025-05-10 | IBM Storage Scale 5.2.2.0 and 5.2.2.1, under certain configurations, could allow an authenticated user to execute privileged commands due to improper input neu… |
CVE-2025-3925 | High | 7.8 | 2025-05-07 | BrightSign players running BrightSign OS series 4 prior to v8.5.53.1 or series 5 prior to v9.0.166 contain an execution with unnecessary privileges vulnerabi… |
CVE-2024-6030 | High | 7.0 | 2025-04-30 | Tesla Model S oFono Unnecessary Privileges Sandbox Escape Vulnerability. This vulnerability allows local attackers to escape the sandbox on affected Tesla Mode… |
CVE-2025-23181 | High | 8.0 | 2025-04-29 | CWE-250: Execution with Unnecessary Privileges |
CVE-2025-23180 | High | 8.0 | 2025-04-29 | CWE-250: Execution with Unnecessary Privileges |
CVE-2025-1951 | High | 8.4 | 2025-04-22 | IBM Hardware Management Console - Power Systems V10.2.1030.0 and V10.3.1050.0 could allow a local user to execute commands as a privileged user due to executio… |
CVE-2025-32445 | Critical | 9.9 | 2025-04-15 | Argo Events is an event-driven workflow automation framework for Kubernetes. A user with permission to create/modify EventSource and Sensor custom resources ca… |
CVE-2025-0120 | High | 7.0 | 2025-04-11 | A vulnerability with a privilege management mechanism in the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-admini… |
CVE-2025-23009 | High | 7.2 | 2025-04-10 | A local privilege escalation vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client which allows an attacker to trigger an arbitrary file deleti… |
CVE-2025-23008 | High | 7.2 | 2025-04-10 | An improper privilege management vulnerability in the SonicWall NetExtender Windows (32 and 64 bit) client allows a low privileged attacker to modify configura… |
CVE-2025-3364 | Medium | 6.7 | 2025-04-08 | The SSH service of PowerStation from HGiga has a Chroot Escape vulnerability, allowing attackers with root privileges to bypass chroot restrictions and access… |
CVE-2024-11821 | Medium | 4.3 | 2025-03-20 | A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a… |
CVE-2024-48013 | High | 8.8 | 2025-03-17 | Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Execution with Unnecessary Privileges vulnerability. A low pri… |
CVE-2025-22368 | | 2025-03-11 | The authenticated SCU firmware command of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS commands are… | |
CVE-2025-22367 | | 2025-03-11 | The authenticated time setting capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS command ar… | |
CVE-2025-22366 | | 2025-03-11 | The authenticated firmware update capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS command… | |
CVE-2024-2240 | High | 7.2 | 2025-02-14 | Docker daemon in Brocade SANnav before SANnav 2.3.1b runs without auditing. The vulnerability could allow a remote authenticated attacker to execute various at… |
CVE-2024-8266 | Medium | 4.4 | 2025-02-13 | An issue was discovered in GitLab CE/EE affecting all versions starting from 17.1 prior to 17.6.0, which allows an attacker with maintainer role to trigger a p… |
CVE-2024-7102 | Critical | 9.6 | 2025-02-13 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.0 which allows an attacker to trigger a pipeline as another use… |
CVE-2024-12673 | High | 7.8 | 2025-02-12 | An improper privilege vulnerability was reported in a BIOS customization feature of Lenovo Vantage on SMB notebook devices which could allow a local attacker t… |
CVE-2024-21924 | High | 8.2 | 2025-02-11 | SMM callout vulnerability within the AmdPlatformRasSspSmm driver could allow a ring 0 attacker to modify boot services handlers, potentially resulting in arbit… |
CVE-2025-22890 | High | 8.8 | 2025-02-06 | Execution with unnecessary privileges issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker performs a specific operation, SYS… |
CVE-2024-49814 | High | 7.8 | 2025-02-06 | IBM Security Verify Access Appliance 10.0.0 through 10.0.3 could allow a locally authenticated user to increase their privileges due to execution with unnecess… |
CVE-2025-20185 | Low | 3.4 | 2025-02-05 | A vulnerability in the implementation of the remote access functionality of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Cisco Secure Email G… |
CVE-2023-37412 | Medium | 4.4 | 2025-01-29 | IBM Aspera Faspex 5.0.0 through 5.0.10 could allow a privileged user to make system changes without proper access controls. |
CVE-2025-24814 | Medium | 5.5 | 2025-01-27 | Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use the "FileSystemConfigSetService" comp… |
CVE-2024-43655 | | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocha… | |
CVE-2024-43654 | High | 8.8 | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Iocharger firmware for AC models allows OS Command Inject… |
CVE-2024-43653 | High | 8.8 | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocha… |
CVE-2024-43652 | High | 8.8 | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iochar… |
CVE-2024-43651 | | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iochar… | |
CVE-2024-43650 | | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Iocharger firmware for AC models allows OS Command Injecti… | |
CVE-2024-43649 | High | 8.8 | 2025-01-09 | Authenticated command injection in the filename of a <redacted>.exe request leads to remote code execution as the root user. This issue affects Iocharger firm… |
CVE-2024-43648 | High | 8.8 | 2025-01-09 | Command injection in the <redacted> parameter of a <redacted>.exe request leads to remote code execution as the root user. This issue affects Iocharger firmwa… |
CVE-2024-47978 | High | 7.8 | 2024-12-25 | Dell NativeEdge, version(s) 2.1.0.0, contain(s) an Execution with Unnecessary Privileges vulnerability. A low privileged attacker with local access could poten… |
CVE-2024-35141 | High | 7.8 | 2024-12-19 | IBM Security Verify Access Docker 10.0.0 through 10.0.6 could allow a local user to escalate their privileges due to execution of unnecessary privileges. |
CVE-2024-31891 | High | 7.8 | 2024-12-14 | IBM Storage Scale GUI 5.1.9.0 through 5.1.9.6 and 5.2.0.0 through 5.2.1.1 contains a local privilege escalation vulnerability. A malicious actor with command… |
CVE-2024-28140 | Medium | 6.1 | 2024-12-11 | The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window. This browser is run with the permissions of the roo… |
CVE-2024-28139 | High | 8.8 | 2024-12-11 | The www-data user can elevate its privileges because sudo is configured to allow the execution of the mount command as root without a password. Therefore, the… |
CVE-2024-49804 | High | 7.8 | 2024-11-29 | IBM Security Verify Access Appliance 10.0.0 through 10.0.8 could allow a locally authenticated non-administrative user to escalate their privileges due to un… |
CVE-2021-38118 | Medium | 5.5 | 2024-11-22 | Possible improper input validation Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000. |
CVE-2024-52799 | High | 8.2 | 2024-11-21 | Argo Workflows Chart is used to set up argo and its needed dependencies through one command. Prior to 0.44.0, the workflow-role has excessive privileges, the w… |
CVE-2024-11075 | High | 8.8 | 2024-11-19 | A vulnerability in the Incoming Goods Suite allows a user with unprivileged access to the underlying system (e.g. local or via SSH) a privilege escalation to t… |