CWE-266 · Incorrect Privilege Assignment (page 10)
Page 10 of 11 — CVEs classified under CWE-266, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-22303 | High | 8.8 | 2024-09-17 | Incorrect Privilege Assignment vulnerability in favethemes Houzez allows Privilege Escalation.This issue affects Houzez: from n/a through 3.2.4. |
CVE-2024-21743 | High | 8.8 | 2024-09-17 | Privilege Escalation vulnerability in favethemes Houzez Login Register houzez-login-register.This issue affects Houzez Login Register: from n/a through 3.2.5. |
CVE-2024-8253 | High | 8.8 | 2024-09-11 | The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in all versions 2.2.87 to 2.2.90. This is due to the plugin not p… |
CVE-2024-40681 | High | 7.5 | 2024-09-07 | IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically defined role, to bypass security restrictions… |
CVE-2024-39579 | Medium | 6.7 | 2024-08-31 | Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contains an incorrect privilege assignment vulnerability. A local high privileged attacker could potenti… |
CVE-2024-4555 | High | 7.7 | 2024-08-28 | Improper Privilege Management vulnerability in OpenText NetIQ Access Manager allows user account impersonation in specific scenario. This issue affects NetIQ A… |
CVE-2024-45187 | High | 7.1 | 2024-08-23 | Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access… |
CVE-2024-39576 | High | 8.8 | 2024-08-22 | Dell Power Manager (DPM), versions 3.15.0 and prior, contains an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access coul… |
CVE-2024-20466 | Medium | 6.5 | 2024-08-21 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive… |
CVE-2024-28000 | Critical | 9.8 | 2024-08-21 | Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <=… |
CVE-2024-6322 | Medium | 5.4 | 2024-08-20 | Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associat… |
CVE-2024-34738 | High | 7.8 | 2024-08-15 | In multiple functions of AppOpsService.java, there is a possible way for unprivileged apps to read their own restrictRead app-op states due to a logic error in… |
CVE-2024-25633 | Medium | 5.4 | 2024-08-15 | eLabFTW is an open source electronic lab notebook for research labs. In an eLabFTW system, one can configure who is allowed to create new user accounts. A vuln… |
CVE-2024-42441 | Medium | 6.2 | 2024-08-14 | Incorrect privilege assignment in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1… |
CVE-2024-43153 | Critical | 9.8 | 2024-08-13 | Incorrect Privilege Assignment vulnerability in WofficeIO Woffice woffice.This issue affects Woffice: from n/a through <= 5.4.10. |
CVE-2024-6758 | Medium | 6.5 | 2024-08-12 | Improper Privilege Management in Sprecher Automation SPRECON-E below version 8.71j allows a remote attacker with low privileges to save unauthorized protection… |
CVE-2024-7480 | Medium | 4.2 | 2024-08-08 | An Improper access control vulnerability was found in Avaya Aura System Manager which could allow a command-line interface (CLI) user with administrative privi… |
CVE-2024-41139 | High | 7.8 | 2024-07-29 | Incorrect privilege assignment vulnerability exists in SKYSEA Client View Ver.6.010.06 to Ver.19.210.04e. If a user who can log in to the PC where the product'… |
CVE-2024-40433 | High | 8.8 | 2024-07-26 | Insecure Permissions vulnerability in Tencent wechat v.8.0.37 allows an attacker to escalate privileges via the web-view component. |
CVE-2024-36534 | High | 8.4 | 2024-07-24 | Insecure permissions in hwameistor v0.14.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. |
CVE-2024-23794 | Medium | 5.2 | 2024-07-15 | An incorrect privilege assignment vulnerability in the inline editing functionality of OTRS can lead to privilege escalation. This flaw allows an agent with re… |
CVE-2024-37927 | Critical | 9.8 | 2024-07-12 | Incorrect Privilege Assignment vulnerability in NooTheme Jobmonster noo-jobmonster allows Privilege Escalation.This issue affects Jobmonster: from n/a through… |
CVE-2024-31315 | High | 7.8 | 2024-07-09 | In multiple functions of ManagedServices.java, there is a possible way to hide an app with notification access in the Device & app notifications settings due t… |
CVE-2024-38278 | Medium | 6.6 | 2024-07-09 | A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.9.0), RUGGEDCOM RMC8388NC V5.X (All versions < V5.9.0), RUGGEDCOM RS416NCv2 V5… |
CVE-2024-37134 | Medium | 6.7 | 2024-07-02 | Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local high privileged attacker could potential… |
CVE-2024-37132 | Medium | 6.7 | 2024-07-02 | Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an incorrect privilege assignment vulnerability. A high privileged attacker with local access co… |
CVE-2024-31912 | High | 7.5 | 2024-06-28 | IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certain configurations due to incorrect privilege assignment. I… |
CVE-2023-7270 | Medium | 5.3 | 2024-06-27 | An issue was discovered in SoftMaker Office 2024 / NX before revision 1214 and SoftMaker FreeOffice 2014 before revision 1215. FreeOffice 2021 is also affected… |
CVE-2024-27275 | High | 7.4 | 2024-06-15 | IBM i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability caused by an insufficient authority requirement. A local user without administ… |
CVE-2024-0085 | Medium | 6.3 | 2024-06-13 | NVIDIA vGPU software for Windows and Linux contains a vulnerability where unprivileged users could execute privileged operations on the host. A successful expl… |
CVE-2024-36587 | High | 7.8 | 2024-06-13 | Insecure permissions in DNSCrypt-proxy v2.0.0alpha9 to v2.1.5 allows non-privileged attackers to escalate privileges to root via overwriting the binary dnscryp… |
CVE-2024-37293 | High | 7.5 | 2024-06-11 | The AWS Deployment Framework (ADF) is a framework to manage and deploy resources across multiple AWS accounts and regions within an AWS Organization. ADF allow… |
CVE-2024-35700 | Critical | 9.8 | 2024-06-04 | Incorrect Privilege Assignment vulnerability in DeluxeThemes Userpro userpro.This issue affects Userpro: from n/a through <= 5.1.8. |
CVE-2024-4870 | High | 7.2 | 2024-06-04 | The Frontend Registration – Contact Form 7 plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1 due to insufficient… |
CVE-2021-47241 | High | 7.5 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved: ethtool: strset: fix message length calculation Outer nest for ETHTOOL_A_STRSET_STRINGSET… |
CVE-2024-32959 | High | 8.8 | 2024-05-17 | Incorrect Privilege Assignment vulnerability in Sirv CDN and Image Hosting Sirv sirv.This issue affects Sirv: from n/a through <= 7.2.2. |
CVE-2024-32507 | High | 8.8 | 2024-05-17 | Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n… |
CVE-2024-24882 | Critical | 9.8 | 2024-05-17 | Incorrect Privilege Assignment vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1… |
CVE-2024-22145 | High | 8.8 | 2024-05-17 | Incorrect Privilege Assignment vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.8. |
CVE-2024-20389 | High | 7.8 | 2024-05-16 | A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, local attacker to rea… |
CVE-2024-31771 | High | 7.8 | 2024-05-14 | Insecure Permission vulnerability in TotalAV v.6.0.740 allows a local attacker to escalate privileges via a crafted file |
CVE-2024-27460 | Medium | 6.7 | 2024-05-14 | A privilege escalation exists in the updater for Plantronics Hub 3.25.1 and below. |
CVE-2024-27273 | High | 8.1 | 2024-05-07 | IBM AIX's Unix domain (AIX 7.2, 7.3, VIOS 3.1, and VIOS 4.1) datagram socket implementation could potentially expose applications using Unix domain datagram so… |
CVE-2024-27453 | High | 8.6 | 2024-05-03 | In Extreme XOS through 22.6.1.4, a read-only user can escalate privileges to root via a crafted HTTP POST request to the python method of the Machine-to-Machin… |
CVE-2023-38298 | High | 8.8 | 2024-04-22 | Various software builds for the following TCL devices (30Z, A3X, 20XE, 10L) leak the device IMEI to a system property that can be accessed by any local app on… |
CVE-2023-38296 | High | 8.0 | 2024-04-22 | Various software builds for the following TCL 30Z and TCL A3X devices leak the ICCID to a system property that can be accessed by any local app on the device w… |
CVE-2024-31760 | Medium | 4.7 | 2024-04-16 | An issue in sanluan flipped-aurora gin-vue-admin 2.4.x allows an attacker to escalate privileges via the Session Expiration component. |
CVE-2024-2409 | Critical | 9.8 | 2024-03-29 | The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validat… |
CVE-2024-3013 | Medium | 6.3 | 2024-03-28 | A flaw has been found in Teledyne FLIR AX8 up to 1.46.16. The impacted element is an unknown function of the file /tools/test_login.php?action=register of the… |
CVE-2024-20320 | High | 7.8 | 2024-03-13 | A vulnerability in the SSH client feature of Cisco IOS XR Software for Cisco 8000 Series Routers and Cisco Network Convergence System (NCS) 540 Series and 5700… |
CVE-2024-23288 | High | 7.8 | 2024-03-08 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, watchOS 10.4. An app m… |
CVE-2023-50437 | High | 8.6 | 2024-02-29 | An issue was discovered in Couchbase Server before 7.2.x before 7.2.4. otpCookie is shown with full admin on pools/default/serverGroups and engageCluster2. |
CVE-2023-6477 | Medium | 6.7 | 2024-02-22 | An issue has been discovered in GitLab EE affecting all versions starting from 16.5 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions… |
CVE-2024-25083 | Medium | 6.3 | 2024-02-16 | An issue was discovered in BeyondTrust Privilege Management for Windows before 24.1. When an low-privileged user initiates a repair, there is an attack vector… |
CVE-2023-40109 | High | 7.8 | 2024-02-15 | In createFromParcel of UsbConfiguration.java, there is a possible background activity launch (BAL) due to a permissions bypass. This could lead to local escala… |
CVE-2024-23976 | Medium | 6.0 | 2024-02-14 | When running in Appliance mode, an authenticated attacker assigned the Administrator role may be able to bypass Appliance mode restrictions utilizing iAppsLX t… |
CVE-2023-6815 | Medium | 6.5 | 2024-02-13 | Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R S… |
CVE-2023-5080 | Medium | 6.8 | 2024-01-19 | A privilege escalation vulnerability was reported in some Lenovo tablet products that could allow local applications access to device identifiers and system co… |
CVE-2023-49647 | High | 8.8 | 2024-01-12 | Improper access control in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows before version 5.16.10 may allow an authenti… |
CVE-2023-47140 | Medium | 4.0 | 2024-01-08 | IBM CICS Transaction Gateway 9.3 could allow a user to transfer or view files due to improper access controls. |
CVE-2023-29066 | Low | 3.2 | 2023-11-28 | The FACSChorus software does not properly assign data access privileges for operating system user accounts. A non-administrative OS account can modify informat… |
CVE-2023-6009 | High | 8.8 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.4 due to insufficient restriction on the 'userpro_… |
CVE-2023-5913 | High | 8.2 | 2023-11-08 | Incorrect Privilege Assignment vulnerability in opentext Fortify ScanCentral DAST. The vulnerability could be exploited to gain elevated privileges.This issue… |
CVE-2023-5077 | High | 7.6 | 2023-09-29 | The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets… |
CVE-2023-3775 | Medium | 4.2 | 2023-09-29 | A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one namespace can be applied to requests outside in… |
CVE-2023-4153 | High | 8.8 | 2023-09-13 | The BAN Users plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.5.3 due to a missing capability check on the 'w3de… |
CVE-2023-21269 | High | 7.8 | 2023-08-14 | In startActivityInner of ActivityStarter.java, there is a possible way to launch an activity into PiP mode from the background due to BAL bypass. This could le… |
CVE-2023-30691 | High | 8.4 | 2023-08-10 | Parcel mismatch in AuthenticationConfig prior to SMR Aug-2023 Release 1 allows local attacker to privilege escalation. |
CVE-2023-30680 | High | 8.4 | 2023-08-10 | Improper privilege management vulnerability in MMIGroup prior to SMR Aug-2023 Release 1 allows code execution with privilege. |
CVE-2023-3518 | High | 7.4 | 2023-08-09 | HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in… |
CVE-2023-39173 | Medium | 5.4 | 2023-07-25 | In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account access |
CVE-2023-3300 | Medium | 5.3 | 2023-07-20 | HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users w… |
CVE-2023-3072 | Medium | 4.1 | 2023-07-20 | HashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5… |
CVE-2023-3114 | Medium | 5.0 | 2023-06-22 | Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agen… |
CVE-2023-28956 | High | 8.4 | 2023-06-22 | IBM Spectrum Protect Backup-Archive Client 8.1.0.0 through 8.1.17.2 may allow a local user to escalate their privileges due to improper access controls. |
CVE-2023-2485 | Medium | 4.4 | 2023-06-07 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all ver… |
CVE-2023-2816 | High | 8.7 | 2023-06-02 | Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy inst… |
CVE-2023-1174 | Critical | 9.8 | 2023-05-24 | This vulnerability exposes a network port in minikube running on macOS with Docker driver that could enable unexpected remote access to the minikube container. |
CVE-2023-1874 | High | 7.5 | 2023-04-12 | The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. This is due to a lack of authorization c… |
CVE-2023-20957 | High | 7.8 | 2023-03-24 | In onAttach of SettingsPreferenceFragment.java, there is a possible bypass of Factory Reset Protections due to a confused deputy. This could lead to local esca… |
CVE-2023-25591 | High | 7.6 | 2023-03-22 | A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sen… |
CVE-2022-4441 | High | 7.6 | 2023-01-31 | Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation. Thi… |
CVE-2022-4041 | Medium | 5.9 | 2023-01-31 | Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation. Thi… |
CVE-2022-4613 | Medium | 5.0 | 2022-12-19 | A vulnerability was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as critical. This issue affects some unknown… |
CVE-2022-3876 | Medium | 4.3 | 2022-12-19 | A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This issue affe… |
CVE-2022-4281 | Medium | 6.3 | 2022-12-05 | A vulnerability has been found in Facepay 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /face-recognit… |
CVE-2022-4280 | Medium | 4.3 | 2022-12-03 | A vulnerability, which was classified as problematic, has been found in Dot Tech Smart Campus System. Affected by this issue is some unknown functionality of t… |
CVE-2022-4276 | Medium | 6.3 | 2022-12-03 | A vulnerability was found in House Rental System and classified as critical. Affected by this issue is some unknown functionality of the file tenant-engine.php… |
CVE-2022-4273 | High | 7.3 | 2022-12-03 | A vulnerability, which was classified as critical, has been found in SourceCodester Human Resource Management System 1.0. This issue affects some unknown proce… |
CVE-2022-4272 | Medium | 6.3 | 2022-12-03 | A vulnerability, which was classified as critical, has been found in FeMiner wms. Affected by this issue is some unknown functionality of the file /product/sav… |
CVE-2022-4232 | Medium | 4.7 | 2022-11-30 | A vulnerability, which was classified as critical, was found in SourceCodester Event Registration System 1.0. Affected is an unknown function. The manipulation… |
CVE-2022-3944 | Medium | 6.3 | 2022-11-11 | A vulnerability was found in jerryhanjj ERP. It has been declared as critical. Affected by this vulnerability is the function uploadImages of the file applicat… |
CVE-2022-3826 | Medium | 4.3 | 2022-11-02 | A vulnerability was found in Huaxia ERP. It has been classified as problematic. This affects an unknown part of the file /depotHead/list of the component Retai… |
CVE-2022-42825 | Medium | 5.5 | 2022-11-01 | This issue was addressed by removing additional entitlements. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, iOS 16.1 and iPadOS 16, macOS Mo… |
CVE-2022-3771 | Medium | 6.3 | 2022-10-31 | A vulnerability, which was classified as critical, has been found in easyii CMS. This issue affects the function file of the file helpers/Upload.php of the com… |
CVE-2022-3770 | Medium | 6.3 | 2022-10-31 | A vulnerability classified as critical was found in Yunjing CMS. This vulnerability affects unknown code of the file /index/user/upload_img.html. The manipulat… |
CVE-2022-3735 | Medium | 6.3 | 2022-10-28 | A vulnerability was found in seccome Ehoney. It has been rated as critical. This issue affects some unknown processing of the file /api/public/signup. The mani… |
CVE-2022-3549 | Medium | 4.7 | 2022-10-17 | A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been rated as problematic. This issue affects some unknown proces… |
CVE-2022-3496 | Medium | 6.3 | 2022-10-14 | A vulnerability was found in SourceCodester Human Resource Management System 1.0 and classified as critical. This issue affects some unknown processing of the… |
CVE-2022-3458 | Medium | 6.3 | 2022-10-12 | A vulnerability has been found in SourceCodester Human Resource Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown… |