CWE-266 · Incorrect Privilege Assignment (page 11)
Page 11 of 12 — CVEs classified under CWE-266, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-50506 | High | 8.8 | 2024-10-30 | Incorrect Privilege Assignment vulnerability in azexo Marketing Automation by AZEXO marketing-automation-by-azexo allows Privilege Escalation.This issue affect… |
CVE-2024-50504 | High | 8.8 | 2024-10-30 | Incorrect Privilege Assignment vulnerability in webxmedia Bulk Change Role bulk-role-change allows Privilege Escalation.This issue affects Bulk Change Role: fr… |
CVE-2024-50550 | High | 8.1 | 2024-10-29 | Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed… |
CVE-2024-50485 | Critical | 9.8 | 2024-10-29 | Incorrect Privilege Assignment vulnerability in Udit Rawat Exam Matrix exam-matrix allows Privilege Escalation.This issue affects Exam Matrix: from n/a through… |
CVE-2024-50481 | High | 8.8 | 2024-10-29 | Incorrect Privilege Assignment vulnerability in stackthemes Bstone Demo Importer bstone-demo-importer allows Privilege Escalation.This issue affects Bstone Dem… |
CVE-2024-47904 | High | 7.8 | 2024-10-23 | A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 on… |
CVE-2024-49608 | High | 8.8 | 2024-10-20 | Incorrect Privilege Assignment vulnerability in gerryworks GERRYWORKS Post by Mail gerryworks-post-by-mail allows Privilege Escalation.This issue affects GERRY… |
CVE-2024-49322 | Critical | 9.8 | 2024-10-17 | Incorrect Privilege Assignment vulnerability in CodePassenger Job Board Manager for WordPress jemployee allows Privilege Escalation.This issue affects Job Boar… |
CVE-2024-49219 | High | 8.8 | 2024-10-17 | Incorrect Privilege Assignment vulnerability in themexpo RS-Members rs-members allows Privilege Escalation.This issue affects RS-Members: from n/a through <= 1… |
CVE-2024-49217 | Critical | 9.8 | 2024-10-17 | Incorrect Privilege Assignment vulnerability in madiriaashish Adding drop down roles in registration user-drop-down-roles-in-registration allows Privilege Esca… |
CVE-2024-9863 | Critical | 9.8 | 2024-10-17 | The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.6.0 due to the ins… |
CVE-2024-9180 | High | 7.2 | 2024-10-10 | A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s r… |
CVE-2024-9519 | High | 7.2 | 2024-10-10 | The UserPlus plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'save_metabox_form' function in… |
CVE-2024-48941 | Medium | 5.4 | 2024-10-10 | The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to bypass 2FA by interacting with the /rest e… |
CVE-2024-47653 | Medium | 6.5 | 2024-10-04 | This vulnerability exists in Shilpi Client Dashboard due to lack of authorization for modification and cancellation requests through certain API endpoints. An… |
CVE-2024-25660 | Critical | 9.0 | 2024-10-01 | The WebDAV service in Infinera TNMS (Transcend Network Management System) 19.10.3 allows a low-privileged remote attacker to conduct unauthorized file operatio… |
CVE-2024-25632 | High | 8.6 | 2024-10-01 | eLabFTW is an open source electronic lab notebook for research labs. In the context of eLabFTW, an administrator is a user account with certain privileges to m… |
CVE-2024-46511 | High | 7.5 | 2024-09-30 | LoadZilla LLC LoadLogic v1.4.3 was discovered to contain insecure permissions vulnerability which allows a remote attacker to execute arbitrary code via the Lo… |
CVE-2024-46540 | Medium | 6.3 | 2024-09-30 | A remote code execution (RCE) vulnerability in the component /admin/store.php of Emlog Pro before v2.3.15 allows attackers to use remote file downloads and sel… |
CVE-2024-9082 | Medium | 6.3 | 2024-09-22 | A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the… |
CVE-2024-22303 | High | 8.8 | 2024-09-17 | Incorrect Privilege Assignment vulnerability in favethemes Houzez allows Privilege Escalation.This issue affects Houzez: from n/a through 3.2.4. |
CVE-2024-21743 | High | 8.8 | 2024-09-17 | Privilege Escalation vulnerability in favethemes Houzez Login Register houzez-login-register.This issue affects Houzez Login Register: from n/a through 3.2.5. |
CVE-2024-8253 | High | 8.8 | 2024-09-11 | The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in all versions 2.2.87 to 2.2.90. This is due to the plugin not p… |
CVE-2024-40681 | High | 7.5 | 2024-09-07 | IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically defined role, to bypass security restrictions… |
CVE-2024-39579 | Medium | 6.7 | 2024-08-31 | Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contains an incorrect privilege assignment vulnerability. A local high privileged attacker could potenti… |
CVE-2024-4555 | High | 7.7 | 2024-08-28 | Improper Privilege Management vulnerability in OpenText NetIQ Access Manager allows user account impersonation in specific scenario. This issue affects NetIQ A… |
CVE-2024-45187 | High | 7.1 | 2024-08-23 | Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access… |
CVE-2024-39576 | High | 8.8 | 2024-08-22 | Dell Power Manager (DPM), versions 3.15.0 and prior, contains an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access coul… |
CVE-2024-20466 | Medium | 6.5 | 2024-08-21 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive… |
CVE-2024-28000 | Critical | 9.8 | 2024-08-21 | Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <=… |
CVE-2024-6322 | Medium | 5.4 | 2024-08-20 | Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associat… |
CVE-2024-34738 | High | 7.8 | 2024-08-15 | In multiple functions of AppOpsService.java, there is a possible way for unprivileged apps to read their own restrictRead app-op states due to a logic error in… |
CVE-2024-25633 | Medium | 5.4 | 2024-08-15 | eLabFTW is an open source electronic lab notebook for research labs. In an eLabFTW system, one can configure who is allowed to create new user accounts. A vuln… |
CVE-2024-42441 | Medium | 6.2 | 2024-08-14 | Incorrect privilege assignment in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1… |
CVE-2024-43153 | Critical | 9.8 | 2024-08-13 | Incorrect Privilege Assignment vulnerability in WofficeIO Woffice woffice.This issue affects Woffice: from n/a through <= 5.4.10. |
CVE-2024-6758 | Medium | 6.5 | 2024-08-12 | Improper Privilege Management in Sprecher Automation SPRECON-E below version 8.71j allows a remote attacker with low privileges to save unauthorized protection… |
CVE-2024-7480 | Medium | 4.2 | 2024-08-08 | An Improper access control vulnerability was found in Avaya Aura System Manager which could allow a command-line interface (CLI) user with administrative privi… |
CVE-2024-41139 | High | 7.8 | 2024-07-29 | Incorrect privilege assignment vulnerability exists in SKYSEA Client View Ver.6.010.06 to Ver.19.210.04e. If a user who can log in to the PC where the product'… |
CVE-2024-40433 | High | 8.8 | 2024-07-26 | Insecure Permissions vulnerability in Tencent wechat v.8.0.37 allows an attacker to escalate privileges via the web-view component. |
CVE-2024-36534 | High | 8.4 | 2024-07-24 | Insecure permissions in hwameistor v0.14.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. |
CVE-2024-23794 | Medium | 5.2 | 2024-07-15 | An incorrect privilege assignment vulnerability in the inline editing functionality of OTRS can lead to privilege escalation. This flaw allows an agent with re… |
CVE-2024-37927 | Critical | 9.8 | 2024-07-12 | Incorrect Privilege Assignment vulnerability in NooTheme Jobmonster noo-jobmonster allows Privilege Escalation.This issue affects Jobmonster: from n/a through… |
CVE-2024-31315 | High | 7.8 | 2024-07-09 | In multiple functions of ManagedServices.java, there is a possible way to hide an app with notification access in the Device & app notifications settings due t… |
CVE-2024-38278 | Medium | 6.6 | 2024-07-09 | A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.9.0), RUGGEDCOM RMC8388NC V5.X (All versions < V5.9.0), RUGGEDCOM RS416NCv2 V5… |
CVE-2024-37134 | Medium | 6.7 | 2024-07-02 | Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local high privileged attacker could potential… |
CVE-2024-37132 | Medium | 6.7 | 2024-07-02 | Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an incorrect privilege assignment vulnerability. A high privileged attacker with local access co… |
CVE-2024-31912 | High | 7.5 | 2024-06-28 | IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certain configurations due to incorrect privilege assignment. I… |
CVE-2023-7270 | Medium | 5.3 | 2024-06-27 | An issue was discovered in SoftMaker Office 2024 / NX before revision 1214 and SoftMaker FreeOffice 2014 before revision 1215. FreeOffice 2021 is also affected… |
CVE-2024-27275 | High | 7.4 | 2024-06-15 | IBM i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability caused by an insufficient authority requirement. A local user without administ… |
CVE-2024-0085 | Medium | 6.3 | 2024-06-13 | NVIDIA vGPU software for Windows and Linux contains a vulnerability where unprivileged users could execute privileged operations on the host. A successful expl… |
CVE-2024-36587 | High | 7.8 | 2024-06-13 | Insecure permissions in DNSCrypt-proxy v2.0.0alpha9 to v2.1.5 allows non-privileged attackers to escalate privileges to root via overwriting the binary dnscryp… |
CVE-2024-37293 | High | 7.5 | 2024-06-11 | The AWS Deployment Framework (ADF) is a framework to manage and deploy resources across multiple AWS accounts and regions within an AWS Organization. ADF allow… |
CVE-2024-35700 | Critical | 9.8 | 2024-06-04 | Incorrect Privilege Assignment vulnerability in DeluxeThemes Userpro userpro.This issue affects Userpro: from n/a through <= 5.1.8. |
CVE-2024-4870 | High | 7.2 | 2024-06-04 | The Frontend Registration – Contact Form 7 plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1 due to insufficient… |
CVE-2021-47241 | High | 7.5 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved: ethtool: strset: fix message length calculation Outer nest for ETHTOOL_A_STRSET_STRINGSET… |
CVE-2024-32959 | High | 8.8 | 2024-05-17 | Incorrect Privilege Assignment vulnerability in Sirv CDN and Image Hosting Sirv sirv.This issue affects Sirv: from n/a through <= 7.2.2. |
CVE-2024-32507 | High | 8.8 | 2024-05-17 | Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n… |
CVE-2024-24882 | Critical | 9.8 | 2024-05-17 | Incorrect Privilege Assignment vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1… |
CVE-2024-22145 | High | 8.8 | 2024-05-17 | Incorrect Privilege Assignment vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.8. |
CVE-2024-20389 | High | 7.8 | 2024-05-16 | A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, local attacker to rea… |
CVE-2024-31771 | High | 7.8 | 2024-05-14 | Insecure Permission vulnerability in TotalAV v.6.0.740 allows a local attacker to escalate privileges via a crafted file |
CVE-2024-27460 | Medium | 6.7 | 2024-05-14 | A privilege escalation exists in the updater for Plantronics Hub 3.25.1 and below. |
CVE-2024-27273 | High | 8.1 | 2024-05-07 | IBM AIX's Unix domain (AIX 7.2, 7.3, VIOS 3.1, and VIOS 4.1) datagram socket implementation could potentially expose applications using Unix domain datagram so… |
CVE-2024-27453 | High | 8.6 | 2024-05-03 | In Extreme XOS through 22.6.1.4, a read-only user can escalate privileges to root via a crafted HTTP POST request to the python method of the Machine-to-Machin… |
CVE-2023-38298 | High | 8.8 | 2024-04-22 | Various software builds for the following TCL devices (30Z, A3X, 20XE, 10L) leak the device IMEI to a system property that can be accessed by any local app on… |
CVE-2023-38296 | High | 8.0 | 2024-04-22 | Various software builds for the following TCL 30Z and TCL A3X devices leak the ICCID to a system property that can be accessed by any local app on the device w… |
CVE-2024-31760 | Medium | 4.7 | 2024-04-16 | An issue in sanluan flipped-aurora gin-vue-admin 2.4.x allows an attacker to escalate privileges via the Session Expiration component. |
CVE-2024-2409 | Critical | 9.8 | 2024-03-29 | The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validat… |
CVE-2024-3013 | Medium | 6.3 | 2024-03-28 | A flaw has been found in Teledyne FLIR AX8 up to 1.46.16. The impacted element is an unknown function of the file /tools/test_login.php?action=register of the… |
CVE-2024-20320 | High | 7.8 | 2024-03-13 | A vulnerability in the SSH client feature of Cisco IOS XR Software for Cisco 8000 Series Routers and Cisco Network Convergence System (NCS) 540 Series and 5700… |
CVE-2024-23288 | High | 7.8 | 2024-03-08 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, watchOS 10.4. An app m… |
CVE-2023-50437 | High | 8.6 | 2024-02-29 | An issue was discovered in Couchbase Server before 7.2.x before 7.2.4. otpCookie is shown with full admin on pools/default/serverGroups and engageCluster2. |
CVE-2023-6477 | Medium | 6.7 | 2024-02-22 | An issue has been discovered in GitLab EE affecting all versions starting from 16.5 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions… |
CVE-2024-25083 | Medium | 6.3 | 2024-02-16 | An issue was discovered in BeyondTrust Privilege Management for Windows before 24.1. When an low-privileged user initiates a repair, there is an attack vector… |
CVE-2023-40109 | High | 7.8 | 2024-02-15 | In createFromParcel of UsbConfiguration.java, there is a possible background activity launch (BAL) due to a permissions bypass. This could lead to local escala… |
CVE-2024-23976 | Medium | 6.0 | 2024-02-14 | When running in Appliance mode, an authenticated attacker assigned the Administrator role may be able to bypass Appliance mode restrictions utilizing iAppsLX t… |
CVE-2023-6815 | Medium | 6.5 | 2024-02-13 | Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R S… |
CVE-2023-5080 | Medium | 6.8 | 2024-01-19 | A privilege escalation vulnerability was reported in some Lenovo tablet products that could allow local applications access to device identifiers and system co… |
CVE-2023-49647 | High | 8.8 | 2024-01-12 | Improper access control in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows before version 5.16.10 may allow an authenti… |
CVE-2023-47140 | Medium | 4.0 | 2024-01-08 | IBM CICS Transaction Gateway 9.3 could allow a user to transfer or view files due to improper access controls. |
CVE-2023-29066 | Low | 3.2 | 2023-11-28 | The FACSChorus software does not properly assign data access privileges for operating system user accounts. A non-administrative OS account can modify informat… |
CVE-2023-6009 | High | 8.8 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.4 due to insufficient restriction on the 'userpro_… |
CVE-2023-5913 | High | 8.2 | 2023-11-08 | Incorrect Privilege Assignment vulnerability in opentext Fortify ScanCentral DAST. The vulnerability could be exploited to gain elevated privileges.This issue… |
CVE-2023-5077 | High | 7.6 | 2023-09-29 | The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets… |
CVE-2023-3775 | Medium | 4.2 | 2023-09-29 | A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one namespace can be applied to requests outside in… |
CVE-2023-4153 | High | 8.8 | 2023-09-13 | The BAN Users plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.5.3 due to a missing capability check on the 'w3de… |
CVE-2023-21269 | High | 7.8 | 2023-08-14 | In startActivityInner of ActivityStarter.java, there is a possible way to launch an activity into PiP mode from the background due to BAL bypass. This could le… |
CVE-2023-30691 | High | 8.4 | 2023-08-10 | Parcel mismatch in AuthenticationConfig prior to SMR Aug-2023 Release 1 allows local attacker to privilege escalation. |
CVE-2023-30680 | High | 8.4 | 2023-08-10 | Improper privilege management vulnerability in MMIGroup prior to SMR Aug-2023 Release 1 allows code execution with privilege. |
CVE-2023-3518 | High | 7.4 | 2023-08-09 | HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in… |
CVE-2023-39173 | Medium | 5.4 | 2023-07-25 | In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account access |
CVE-2023-3300 | Medium | 5.3 | 2023-07-20 | HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users w… |
CVE-2023-3072 | Medium | 4.1 | 2023-07-20 | HashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5… |
CVE-2023-3114 | Medium | 5.0 | 2023-06-22 | Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agen… |
CVE-2023-28956 | High | 8.4 | 2023-06-22 | IBM Spectrum Protect Backup-Archive Client 8.1.0.0 through 8.1.17.2 may allow a local user to escalate their privileges due to improper access controls. |
CVE-2023-2485 | Medium | 4.4 | 2023-06-07 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all ver… |
CVE-2023-2816 | High | 8.7 | 2023-06-02 | Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy inst… |
CVE-2023-1174 | Critical | 9.8 | 2023-05-24 | This vulnerability exposes a network port in minikube running on macOS with Docker driver that could enable unexpected remote access to the minikube container. |
CVE-2023-1874 | High | 7.5 | 2023-04-12 | The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. This is due to a lack of authorization c… |
CVE-2023-20957 | High | 7.8 | 2023-03-24 | In onAttach of SettingsPreferenceFragment.java, there is a possible bypass of Factory Reset Protections due to a confused deputy. This could lead to local esca… |