CWE-250 (page 3)
Page 3 of 4 — CVEs classified under CWE-250, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-26074 | High | 7.8 | 2024-11-18 | A vulnerability in system file transfer functions of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to gain escalated privileg… |
CVE-2024-8781 | | 2024-11-18 | Execution with Unnecessary Privileges, : Improper Protection of Alternate Path vulnerability in TR7 Application Security Platform (ASP) allows Privilege Escala… | |
CVE-2024-51722 | Medium | 6.4 | 2024-11-12 | A local privilege escalation vulnerability in the SecuSUITE Server (System Configuration) of SecuSUITE versions 5.0.420 and earlier could allow a successful at… |
CVE-2024-48837 | High | 7.8 | 2024-11-12 | Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Execution with Unnecessary Privileges vulnerability. A low pri… |
CVE-2024-50590 | High | 7.8 | 2024-11-08 | Attackers with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITY\SYSTEM" by overwriting one of two Elef… |
CVE-2024-47903 | Medium | 5.8 | 2024-10-23 | A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 on… |
CVE-2024-20420 | Medium | 5.4 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an authenticated, remote attacker w… |
CVE-2024-9473 | High | 7.8 | 2024-10-09 | A privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a locally authenticated non-administrative Windows user to e… |
CVE-2024-43583 | High | 7.8 | 2024-10-08 | Winlogon Elevation of Privilege Vulnerability |
CVE-2024-8903 | Medium | 4.7 | 2024-09-23 | Local active protection service settings manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Cyber Protect Clou… |
CVE-2024-38813 | High | 7.5 | 2024-09-17 | The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to esc… |
CVE-2024-8767 | Critical | 9.9 | 2024-09-17 | Sensitive data disclosure and manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Backup plugin for cPanel & WH… |
CVE-2024-7387 | Critical | 9.1 | 2024-09-17 | A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute arbitrary commands on… |
CVE-2024-35783 | Critical | 9.1 | 2024-09-10 | A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions < V2020 SP2 Update 5), SIMATIC Informat… |
CVE-2024-42024 | High | 8.8 | 2024-09-07 | A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution on the machine where… |
CVE-2024-45034 | High | 8.8 | 2024-09-07 | Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler… |
CVE-2024-5623 | High | 7.8 | 2024-08-29 | An untrusted search path vulnerability in B&R APROL <= R 4.4-00P3 may be used by an authenticated local attacker to get other users to execute arbitrary code u… |
CVE-2024-5622 | High | 7.8 | 2024-08-29 | An untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL <= R 4.2.-07P3 and <= R 4.4-00P3 may allow an authenticated local attacker… |
CVE-2024-20478 | Medium | 6.5 | 2024-08-28 | A vulnerability in the software upgrade component of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network Controller, formerl… |
CVE-2024-36398 | High | 7.8 | 2024-08-13 | A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application executes a subset of its services as `NT AUTHORITY\SYSTEM`. Th… |
CVE-2024-6913 | High | 8.8 | 2024-07-22 | Execution with unnecessary privileges in PerkinElmer ProcessPlus allows an attacker to spawn a remote shell on the windows system.This issue affects ProcessPlu… |
CVE-2024-20435 | High | 8.8 | 2024-07-17 | A vulnerability in the CLI of Cisco AsyncOS for Secure Web Appliance could allow an authenticated, local attacker to execute arbitrary commands and elevate pri… |
CVE-2024-6834 | Critical | 9.0 | 2024-07-17 | A vulnerability in APIML Spring Cloud Gateway which leverages user privileges by unexpected signing proxied request by Zowe's client certificate. This allows a… |
CVE-2024-21184 | High | 7.2 | 2024-07-16 | Vulnerability in the Oracle Database RDBMS Security component of Oracle Database Server. Supported versions that are affected are 19.3-19.23. Easily exploitab… |
CVE-2024-35154 | High | 7.2 | 2024-07-09 | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote authenticated attacker, who has authorized access to the administrative console, to execute a… |
CVE-2024-32853 | Medium | 4.4 | 2024-07-02 | Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.2 contain an execution with unnecessary privileges vulnerability. A local low privileged attacker could po… |
CVE-2024-3330 | Critical | 9.9 | 2024-06-27 | Vulnerability in Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire for AWS Marketplace allows In the case of the installed Windows client… |
CVE-2023-30998 | High | 7.8 | 2024-06-27 | IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to improper access controls. IBM X-Force ID… |
CVE-2023-30997 | High | 7.8 | 2024-06-27 | IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to improper access controls. IBM X-Force ID… |
CVE-2024-31890 | High | 7.8 | 2024-06-21 | IBM i 7.3, 7.4, and 7.5 product IBM TCP/IP Connectivity Utilities for i contains a local privilege escalation vulnerability. A malicious actor with command lin… |
CVE-2024-3498 | High | 7.8 | 2024-06-14 | Attackers can then execute malicious files by enabling certain services of the printer via the web configuration page and elevate its privileges to root. As fo… |
CVE-2024-27147 | High | 7.4 | 2024-06-14 | The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected… |
CVE-2024-27146 | Medium | 6.7 | 2024-06-14 | The Toshiba printers do not implement privileges separation. As for the affected products/models/versions, see the reference URL. |
CVE-2024-27143 | Critical | 9.8 | 2024-06-14 | Toshiba printers use SNMP for configuration. Using the private community, it is possible to remotely execute commands as root on the remote printer. Using this… |
CVE-2024-0084 | High | 7.8 | 2024-06-13 | NVIDIA vGPU software for Linux contains a vulnerability in the Virtual GPU Manager, where the guest OS could execute privileged operations. A successful exploi… |
CVE-2024-23299 | High | 8.6 | 2024-06-10 | The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to brea… |
CVE-2023-38042 | High | 7.8 | 2024-05-31 | A local privilege escalation vulnerability in Ivanti Secure Access Client for Windows allows a low privileged user to execute code as SYSTEM. |
CVE-2024-35142 | High | 8.4 | 2024-05-31 | IBM Security Verify Access Docker 10.0.0 through 10.0.6 could allow a local user to escalate their privileges due to execution of unnecessary privileges. IBM… |
CVE-2024-34477 | High | 7.8 | 2024-05-27 | configureNFS in lib/common/functions.sh in FOG through 1.5.10 allows local users to gain privileges by mounting a crafted NFS share (because of no_root_squash… |
CVE-2024-5042 | Medium | 6.6 | 2024-05-17 | A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a… |
CVE-2024-27260 | High | 8.4 | 2024-05-16 | IBM AIX could 7.2, 7.3, VIOS 3.1, and VIOS 4.1 allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary comman… |
CVE-2024-27110 | High | 8.4 | 2024-05-14 | Elevation of privilege vulnerability in GE HealthCare EchoPAC products |
CVE-2024-25967 | Medium | 6.7 | 2024-05-14 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an execution with unnecessary privileges vulnerability. A local high privileged attacker could po… |
CVE-2024-21003 | Low | 3.1 | 2024-04-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are… |
CVE-2024-20999 | High | 8.2 | 2024-04-16 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Zones). The supported version that is affected is 11. Easily exploitable vulnerabil… |
CVE-2024-24245 | High | 7.8 | 2024-04-09 | An issue in Canimaan Software LTD ClamXAV v3.1.2 through v3.6.1 and fixed in v.3.6.2 allows a local attacker to escalate privileges via the ClamXAV helper tool… |
CVE-2024-28005 | Medium | 4.7 | 2024-03-28 | Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS, WG1200HP, WF300HP2, W300P, WF800HP, WR8165… |
CVE-2024-0073 | High | 7.8 | 2024-03-27 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer when the driver is performing an operation at a privilege level that is… |
CVE-2024-25421 | Critical | 9.8 | 2024-03-26 | An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component. |
CVE-2023-42954 | Medium | 4.9 | 2024-03-21 | A privilege escalation issue existed in FileMaker Server, potentially exposing sensitive information to front-end websites when signed in to the Admin Console… |
CVE-2024-22017 | High | 7.3 | 2024-03-19 | setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operati… |
CVE-2024-1222 | High | 8.6 | 2024-03-14 | This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small su… |
CVE-2023-50015 | High | 8.8 | 2024-03-09 | An issue was discovered in Grandstream GXP14XX 1.0.8.9 and GXP16XX 1.0.7.13, allows remote attackers to escalate privileges via incorrect access control using… |
CVE-2023-45592 | Medium | 6.8 | 2024-03-05 | A CWE-250 “Execution with Unnecessary Privileges” vulnerability in the embedded Chromium browser (due to the binary being executed with the “--no-sandbox” opti… |
CVE-2023-46360 | High | 8.8 | 2024-02-06 | Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier is vulnerable to Execution with Unnecessary Privileges. |
CVE-2024-23743 | Low | 3.3 | 2024-01-28 | Notion through 3.1.0 on macOS might allow code execution because of RunAsNode and enableNodeClilnspectArguments. NOTE: the vendor states "the attacker must lau… |
CVE-2023-52030 | Critical | 9.8 | 2024-01-11 | TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the setOpModeCfg function. |
CVE-2023-30617 | Medium | 6.5 | 2024-01-03 | Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1, and 1.5.2, an att… |
CVE-2023-33873 | High | 7.8 | 2023-11-15 | This privilege escalation vulnerability, if exploited, cloud allow a local OS-authenticated user with standard privileges to escalate to System privilege on t… |
CVE-2023-6006 | High | 7.8 | 2023-11-14 | This vulnerability potentially allows local attackers to escalate privileges on affected installations of PaperCut NG. An attacker must have local write access… |
CVE-2023-43018 | Medium | 5.9 | 2023-11-03 | IBM CICS TX Standard 11.1 and Advanced 10.1, 11.1 performs an operation at a privilege level that is higher than the minimum level required, which creates new… |
CVE-2023-27313 | High | 8.3 | 2023-10-12 | SnapCenter versions 3.x and 4.x prior to 4.9 are susceptible to a vulnerability which may allow an authenticated unprivileged user to gain access as an admin… |
CVE-2023-27312 | Medium | 5.4 | 2023-10-12 | SnapCenter Plugin for VMware vSphere versions 4.6 prior to 4.9 are susceptible to a vulnerability which may allow authenticated unprivileged users to modify… |
CVE-2023-1943 | High | 8.0 | 2023-10-12 | Privilege Escalation in kOps using GCE/GCP Provider in Gossip Mode. |
CVE-2023-5207 | High | 8.2 | 2023-09-30 | A vulnerability was discovered in GitLab CE and EE affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. An aut… |
CVE-2023-4003 | High | 7.6 | 2023-09-27 | One Identity Password Manager version 5.9.7.1 - An unauthenticated attacker with physical access to a workstation may upgrade privileges to SYSTEM through an… |
CVE-2023-4662 | Critical | 9.8 | 2023-09-15 | Execution with Unnecessary Privileges vulnerability in Saphira Saphira Connect allows Remote Code Inclusion. This issue affects Saphira Connect: before 9. |
CVE-2023-4814 | High | 7.1 | 2023-09-14 | A Privilege escalation vulnerability exists in Trellix Windows DLP endpoint for windows which can be abused to delete any file/folder for which the user does… |
CVE-2023-31175 | High | 8.8 | 2023-08-31 | An Execution with Unnecessary Privileges vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to ru… |
CVE-2023-20217 | Medium | 5.5 | 2023-08-16 | A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an authenticated, local attacker to elevate… |
CVE-2023-32486 | Medium | 6.7 | 2023-08-16 | Dell PowerScale OneFS 9.5.x version contain a privilege escalation vulnerability. A low privilege local attacker could potentially exploit this vulnerability… |
CVE-2023-38641 | High | 7.8 | 2023-08-08 | A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.10). The affected application's database service is executed as `NT AUTHORITY\SYSTE… |
CVE-2023-39508 | High | 8.8 | 2023-08-05 | Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow… |
CVE-2023-39261 | Medium | 5.2 | 2023-07-26 | In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissions |
CVE-2023-20210 | Medium | 6.0 | 2023-07-12 | A vulnerability in Cisco BroadWorks could allow an authenticated, local attacker to elevate privileges to the root user on an affected device. The vulnerabi… |
CVE-2023-34118 | High | 7.3 | 2023-07-11 | Improper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable an escalation of privilege via local ac… |
CVE-2023-25521 | High | 7.5 | 2023-07-04 | NVIDIA DGX A100/A800 contains a vulnerability in SBIOS where an attacker may cause execution with unnecessary privileges by leveraging a weakness whereby… |
CVE-2023-2002 | Medium | 6.8 | 2023-05-26 | A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows… |
CVE-2023-32080 | Critical | 9.0 | 2023-05-10 | Wings is the server control plane for Pterodactyl Panel. A vulnerability affecting versions prior to 1.7.5 and versions 1.11.0 prior to 1.11.6 impacts anyone r… |
CVE-2023-1966 | High | 7.4 | 2023-04-28 | Instruments with Illumina Universal Copy Service v1.x and v2.x contain an unnecessary privileges vulnerability. An unauthenticated malicious actor could upload… |
CVE-2023-0664 | High | 7.8 | 2023-03-29 | A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via… |
CVE-2023-27247 | Medium | 4.4 | 2023-03-28 | Cynet Client Agent v4.6.0.8010 allows attackers with Administrator rights to disable the EDR functions by disabling process privilege tokens. |
CVE-2023-27010 | High | 7.8 | 2023-03-13 | Wondershare Dr.Fone v12.9.6 was discovered to contain weak permissions for the service WsDrvInst. This vulnerability allows attackers to escalate privileges vi… |
CVE-2022-34384 | High | 7.8 | 2023-02-11 | Dell SupportAssist Client Consumer (version 3.11.1 and prior), SupportAssist Client Commercial (version 3.2 and prior), Dell Command | Update, Dell Update, an… |
CVE-2018-25078 | High | 7.8 | 2023-01-26 | man-db before 2.8.5 on Gentoo allows local users (with access to the man user account) to gain root privileges because /usr/bin/mandb is executed by root but n… |
CVE-2022-41290 | High | 8.4 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the rm_rlcache_file command to obtain root privileges… |
CVE-2022-43553 | High | 8.8 | 2022-12-05 | A remote code execution vulnerability in EdgeRouters (Version 2.0.9-hotfix.4 and earlier) allows a malicious actor with an operator account to run arbitrary ad… |
CVE-2022-3088 | High | 7.8 | 2022-11-28 | UC-8100A-ME-T System Image: Versions v1.0 to v1.6, UC-2100 System Image: Versions v1.0 to v1.12, UC-2100-W System Image: Versions v1.0 to v 1.12, UC-3100… |
CVE-2022-41950 | Medium | 6.4 | 2022-11-22 | super-xray is the GUI alternative for vulnerability scanning tool xray. In 0.2-beta, a privilege escalation vulnerability was discovered. This caused inaccurat… |
CVE-2022-44544 | Critical | 9.8 | 2022-11-06 | Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0 potentially allow a PDF export to trigger a remote shell if t… |
CVE-2022-39286 | High | 8.8 | 2022-10-26 | Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vuln… |
CVE-2022-22239 | High | 8.2 | 2022-10-18 | An Execution with Unnecessary Privileges vulnerability in Management Daemon (mgd) of Juniper Networks Junos OS Evolved allows a locally authenticated attacker… |
CVE-2022-40182 | High | 8.8 | 2022-10-11 | A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All… |
CVE-2022-2634 | Critical | 10.0 | 2022-08-10 | An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application. This c… |
CVE-2022-1744 | Medium | 6.8 | 2022-06-24 | Applications on the tested version of Dominion Voting Systems ImageCast X can execute code with elevated privileges by exploiting a system level service. An at… |
CVE-2022-1517 | Critical | 10.0 | 2022-06-24 | LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an att… |
CVE-2022-32535 | Medium | 4.8 | 2022-06-23 | The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 runs its web server with root privilege. In combination with CVE-2022-23534 this could give… |
CVE-2022-1808 | High | 8.8 | 2022-05-31 | Execution with Unnecessary Privileges in GitHub repository polonel/trudesk prior to 1.2.3. |
CVE-2022-30695 | High | 7.8 | 2022-05-16 | Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Snap Deploy (Windows) before… |
CVE-2021-34591 | High | 7.8 | 2022-04-27 | In Bender/ebee Charge Controllers in multiple versions are prone to Local privilege Escalation. An authenticated attacker could get root access via the suid ap… |