CWE-250 (page 4)
Page 4 of 4 — CVEs classified under CWE-250, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-0071 | High | 8.8 | 2022-04-19 | Incomplete fix for CVE-2021-3101. Hotdog, prior to v1.0.2, did not mimic the resource limits, device restrictions, or syscall filters of the target JVM process… |
CVE-2022-0070 | High | 8.8 | 2022-04-19 | Incomplete fix for CVE-2021-3100. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic the Linux capa… |
CVE-2021-3101 | High | 8.8 | 2022-04-19 | Hotdog, prior to v1.0.1, did not mimic the capabilities or the SELinux label of the target JVM process. This would allow a container to gain full privileges on… |
CVE-2021-3100 | High | 8.8 | 2022-04-19 | The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM being patched, allowing it to escalate pr… |
CVE-2022-20676 | Medium | 5.1 | 2022-04-15 | A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS XE Software could allow an authenticated, local attacker to escalate from privilege… |
CVE-2022-27578 | High | 7.8 | 2022-04-11 | An attacker can perform a privilege escalation through the SICK OEE if the application is installed in a directory where non authenticated or low privilege use… |
CVE-2022-24113 | High | 7.8 | 2022-02-04 | Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Cyber Protect 15 (Windows) be… |
CVE-2021-36339 | High | 7.8 | 2022-01-21 | The Dell EMC Virtual Appliances before 9.2.2.2 contain undocumented user accounts. A local malicious user may potentially exploit this vulnerability to get pri… |
CVE-2022-21699 | High | 8.2 | 2022-01-19 | IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming la… |
CVE-2021-34998 | High | 7.8 | 2022-01-13 | This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Free Antivirus 20.2.0.0. An attacker must first ob… |
CVE-2021-1118 | High | 7.8 | 2021-10-29 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where there is the potential to execute privileged operations by the gu… |
CVE-2021-3576 | High | 7.8 | 2021-10-28 | Execution with Unnecessary Privileges vulnerability in Bitdefender Endpoint Security Tools, Total Security allows a local attacker to elevate to 'NT AUTHORITY\… |
CVE-2021-41035 | Critical | 9.8 | 2021-10-25 | In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods. |
CVE-2021-37174 | High | 8.8 | 2021-09-14 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All… |
CVE-2021-1579 | High | 8.1 | 2021-08-25 | A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (C… |
CVE-2021-25653 | High | 8.0 | 2021-06-24 | A privilege escalation vulnerability was discovered in Avaya Aura Appliance Virtualization Platform Utilities (AVPU) that may potentially allow a local user to… |
CVE-2021-25651 | High | 8.0 | 2021-06-24 | A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to escalate privileges. Affects all… |
CVE-2021-25650 | High | 7.7 | 2021-06-24 | A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to execute specially crafted scripts… |
CVE-2021-1528 | High | 7.8 | 2021-06-04 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges on an affected system. This vulner… |
CVE-2020-27826 | Medium | 4.2 | 2021-05-28 | A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an at… |
CVE-2021-0256 | Medium | 5.5 | 2021-04-22 | A sensitive information disclosure vulnerability in the mosquitto message broker of Juniper Networks Junos OS may allow a locally authenticated user with shell… |
CVE-2021-0255 | Medium | 5.5 | 2021-04-22 | A local privilege escalation vulnerability in ethtraceroute of Juniper Networks Junos OS may allow a locally authenticated user with shell access to escalate p… |
CVE-2021-27454 | High | 7.8 | 2021-03-25 | The software performs an operation at a privilege level higher than the minimum level required, which creates new weaknesses or amplifies the consequences of o… |
CVE-2021-27448 | High | 7.8 | 2021-03-25 | A miscommunication in the file system allows adversaries with access to the MU320E to escalate privileges on the MU320E (all firmware versions prior to v04A00… |
CVE-2020-26278 | Medium | 5.8 | 2021-01-20 | Weave Net is open source software which creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery… |
CVE-2021-0223 | High | 7.8 | 2021-01-15 | A local privilege escalation vulnerability in telnetd.real of Juniper Networks Junos OS may allow a locally authenticated shell user to escalate privileges and… |
CVE-2021-0204 | High | 7.8 | 2021-01-15 | A sensitive information disclosure vulnerability in delta-export configuration utility (dexp) of Juniper Networks Junos OS may allow a locally authenticated sh… |
CVE-2020-14386 | Medium | 6.7 | 2020-09-16 | A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat… |
CVE-2020-10056 | High | 7.8 | 2020-09-09 | A vulnerability has been identified in License Management Utility (LMU) (All versions < V2.4). The lmgrd service of the affected application is executed with l… |
CVE-2020-10290 | Medium | 6.8 | 2020-08-21 | Universal Robots controller execute URCaps (zip files containing Java-powered applications) without any permission restrictions and a wide API that presents ma… |
CVE-2020-14493 | High | 8.8 | 2020-07-29 | A low-privilege user may use SQL syntax to write arbitrary files to the OpenClinic GA 5.09.02 and 5.89.05b server, which may allow the execution of arbitrary c… |
CVE-2020-2023 | Low | 3.8 | 2020-06-10 | Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on… |
CVE-2019-15790 | Low | 2.8 | 2020-04-28 | Apport reads and writes information on a crashed process to /proc/pid with elevated privileges. Apport then determines which user the crashed process belongs t… |
CVE-2020-7252 | Medium | 4.2 | 2020-02-17 | Unquoted service executable path in DXL Broker in McAfee Data eXchange Layer (DXL) Framework 6.0.0 and earlier allows local users to cause a denial of service… |
CVE-2019-16784 | High | 7.0 | 2020-01-14 | In PyInstaller before version 3.6, only on Windows, a local privilege escalation vulnerability is present in this particular case: If a software using PyInstal… |
CVE-2019-16767 | Medium | 6.6 | 2019-11-29 | The admin sys mode is now conditional and dedicated for the special case. By default, since ezmaster@5.2.11 no instance (container) is launched with advanced c… |
CVE-2019-16765 | High | 7.4 | 2019-11-25 | If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active, arbitrary code… |
CVE-2019-10168 | High | 7.8 | 2019-08-02 | The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argum… |
CVE-2019-10167 | High | 7.8 | 2019-08-02 | The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the progra… |
CVE-2019-10147 | High | 7.7 | 2019-06-03 | rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` are not limited by cgroups du… |
CVE-2019-10145 | High | 7.7 | 2019-06-03 | rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` do not have seccomp filtering… |
CVE-2019-10144 | High | 7.7 | 2019-06-03 | rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` are given all capabilities du… |
CVE-2019-10143 | High | 7.0 | 2019-05-24 | It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of th… |
CVE-2018-16888 | Medium | 4.7 | 2019-01-14 | It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged u… |
CVE-2018-5413 | High | 8.8 | 2019-01-10 | Imperva SecureSphere running v13.0, v12.0, or v11.5 allows low privileged users to add SSH login keys to the admin user, resulting in privilege escalation. |
CVE-2018-10853 | High | 7.0 | 2018-09-11 | A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilege(… |
CVE-2017-7518 | Medium | 5.5 | 2018-07-30 | A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in EFLAGS during emulation of the syscall in… |
CVE-2018-10872 | Medium | 6.5 | 2018-07-10 | A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack sw… |
CVE-2018-10892 | Medium | 5.3 | 2018-07-06 | The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to m… |
CVE-2018-10856 | Medium | 5.3 | 2018-07-03 | It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary p… |
CVE-2018-1087 | High | 8.0 | 2018-05-15 | kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kern… |
CVE-2018-8853 | High | 8.8 | 2018-05-04 | Philips Brilliance CT devices operate user functions from within a contained kiosk in a Microsoft Windows operating system. Windows boots by default with eleva… |