CWE-266 · Incorrect Privilege Assignment (page 11)
Page 11 of 11 — CVEs classified under CWE-266, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-3436 | Medium | 6.3 | 2022-10-09 | A vulnerability classified as critical was found in SourceCodester Web-Based Student Clearance System 1.0. Affected by this vulnerability is an unknown functio… |
CVE-2022-2637 | Medium | 5.4 | 2022-10-06 | Incorrect Privilege Assignment vulnerability in Hitachi Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalat… |
CVE-2022-20855 | High | 7.9 | 2022-09-30 | A vulnerability in the self-healing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points could allow an authentic… |
CVE-2020-10728 | High | 7.8 | 2022-08-16 | A flaw was found in automationbroker/apb container in versions up to and including 2.0.4-1. This container grants all users sudoer permissions allowing an unau… |
CVE-2022-2626 | High | 7.2 | 2022-08-05 | Incorrect Privilege Assignment in GitHub repository hestiacp/hestiacp prior to 1.6.6. |
CVE-2022-1746 | High | 7.6 | 2022-06-24 | The authentication mechanism used by poll workers to administer voting using the tested version of Dominion Voting Systems ImageCast X can expose cryptographic… |
CVE-2022-20819 | Medium | 6.5 | 2022-06-15 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive… |
CVE-2022-20759 | High | 8.8 | 2022-05-03 | A vulnerability in the web services interface for remote access VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Def… |
CVE-2022-20681 | High | 7.8 | 2022-04-15 | A vulnerability in the CLI of Cisco IOS XE Software for Cisco Catalyst 9000 Family Switches and Cisco Catalyst 9000 Family Wireless Controllers could allow an… |
CVE-2022-20782 | Medium | 6.5 | 2022-04-06 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive… |
CVE-2022-1225 | Medium | 6.5 | 2022-04-04 | Incorrect Privilege Assignment in GitHub repository phpipam/phpipam prior to 1.4.6. |
CVE-2021-40124 | Medium | 6.7 | 2021-11-04 | A vulnerability in the Network Access Manager (NAM) module of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker… |
CVE-2021-40123 | Medium | 4.3 | 2021-10-21 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative… |
CVE-2021-36097 | Low | 3.5 | 2021-10-18 | Agents are able to lock the ticket without the "Owner" permission. Once the ticket is locked, it could be moved to the queue where the agent has "rw" permissio… |
CVE-2021-1594 | High | 7.5 | 2021-10-06 | A vulnerability in the REST API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to perform a command injection attack a… |
CVE-2021-20264 | High | 7.8 | 2021-10-06 | An insecure modification flaw in the /etc/passwd file was found in the openjdk-1.8 and openjdk-11 containers. This flaw allows an attacker with access to the c… |
CVE-2021-1572 | High | 7.8 | 2021-08-04 | A vulnerability in ConfD could allow an authenticated, local attacker to execute arbitrary commands at the level of the account under which ConfD is running, w… |
CVE-2020-1742 | High | 7.0 | 2021-06-07 | An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler. An attacker with access to the container could us… |
CVE-2020-35514 | High | 7.0 | 2021-06-02 | An insecure modification flaw in the /etc/kubernetes/kubeconfig file was found in OpenShift. This flaw allows an attacker with access to a running container wh… |
CVE-2020-10695 | High | 7.8 | 2021-05-26 | An insecure modification flaw in the /etc/passwd file was found in the redhat-sso-7 container. An attacker with access to the container can use this flaw to mo… |
CVE-2021-20208 | Medium | 6.1 | 2021-04-19 | A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of th… |
CVE-2019-19354 | High | 7.8 | 2021-03-24 | An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/hadoop as shipped in Red Hat Openshift 4. An attacker with a… |
CVE-2019-19353 | High | 7.0 | 2021-03-24 | An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/hive as shipped in Red Hat Openshift 4. An attacker with acc… |
CVE-2019-19352 | High | 7.0 | 2021-03-24 | An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/presto as shipped in Red Hat Openshift 4. An attacker with a… |
CVE-2019-19350 | High | 7.8 | 2021-03-24 | An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ansible-service-broker as shipped in Red Hat Openshift 4 and 3.11. An… |
CVE-2019-19349 | High | 7.8 | 2021-03-24 | An insecure modification vulnerability in the /etc/passwd file was found in the container operator-framework/operator-metering as shipped in Red Hat Openshift… |
CVE-2021-1416 | Medium | 6.5 | 2021-02-17 | Multiple vulnerabilities in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive informat… |
CVE-2021-1412 | Medium | 6.5 | 2021-02-17 | Multiple vulnerabilities in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive informat… |
CVE-2020-16120 | Medium | 5.1 | 2021-02-10 | Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for examp… |
CVE-2021-1303 | High | 8.8 | 2021-01-20 | A vulnerability in the user management roles of Cisco DNA Center could allow an authenticated, remote attacker to execute unauthorized commands on an affected… |
CVE-2020-14318 | Medium | 4.3 | 2020-12-03 | A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and director… |
CVE-2020-27122 | Medium | 6.7 | 2020-11-06 | A vulnerability in the Microsoft Active Directory integration of Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to elevate p… |
CVE-2020-26182 | Medium | 6.8 | 2020-10-16 | Dell EMC NetWorker versions prior to 19.3.0.2 contain an incorrect privilege assignment vulnerability. A non-LDAP remote user with low privileges may exploit t… |
CVE-2020-7334 | High | 7.7 | 2020-10-15 | Improper privilege assignment vulnerability in the installer McAfee Application and Change Control (MACC) prior to 8.3.2 allows local administrators to change… |
CVE-2020-7018 | High | 8.8 | 2020-08-18 | Elastic Enterprise Search before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is given the �developer� role, they will b… |
CVE-2020-7014 | High | 8.8 | 2020-06-03 | The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an a… |
CVE-2020-6652 | High | 7.8 | 2020-05-07 | Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager (IPM) v1.67 & prior allow non-admin users to upload the system configuration… |
CVE-2020-1989 | High | 7.0 | 2020-04-08 | An incorrect privilege assignment vulnerability when writing application-specific files in the Palo Alto Networks Global Protect Agent for Linux on ARM platfor… |
CVE-2019-19348 | High | 7.0 | 2020-04-02 | An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/apb-base, affecting versions before the following 4.3.5, 4… |
CVE-2019-19346 | High | 7.0 | 2020-04-02 | An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/mariadb-apb, affecting versions before the following 4.3.5… |
CVE-2020-7009 | High | 8.8 | 2020-03-31 | Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacke… |
CVE-2019-19345 | High | 7.0 | 2020-03-20 | A vulnerability was found in all openshift/mediawiki-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file wa… |
CVE-2020-1705 | High | 7.0 | 2020-03-19 | A vulnerability was found in openshift/template-service-broker-operator in all 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in t… |
CVE-2019-19355 | High | 7.0 | 2020-03-18 | An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ocp-release-operator-sdk. An attacker with access to the container co… |
CVE-2019-19351 | High | 7.0 | 2020-03-18 | An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/jenkins. An attacker with access to the container could use… |
CVE-2020-1704 | High | 7.0 | 2020-02-17 | An insecure modification vulnerability in the /etc/passwd file was found in all versions of OpenShift ServiceMesh (maistra) before 1.0.8 in the openshift/istio… |
CVE-2020-1708 | High | 7.0 | 2020-02-07 | It has been found in openshift-enterprise version 3.11 and all openshift-enterprise versions from 4.1 to, including 4.3, that multiple containers modify the pe… |
CVE-2019-10940 | Critical | 9.9 | 2020-01-16 | A vulnerability has been identified in SINEMA Server (All versions < V14.0 SP2 Update 1). Incorrect session validation could allow an attacker with a valid ses… |
CVE-2019-14819 | High | 8.8 | 2020-01-07 | A flaw was found during the upgrade of an existing OpenShift Container Platform 3.x cluster. Using CRI-O, the dockergc service account is assigned to the curre… |
CVE-2019-11893 | High | 8.0 | 2019-05-29 | A potential incorrect privilege assignment vulnerability exists in the app permission update API of the Bosch Smart Home Controller (SHC) before 9.8.905 that m… |
CVE-2019-11891 | High | 8.0 | 2019-05-29 | A potential incorrect privilege assignment vulnerability exists in the app pairing mechanism of the Bosch Smart Home Controller (SHC) before 9.8.905 that may r… |
CVE-2019-10143 | High | 7.0 | 2019-05-24 | It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of th… |
CVE-2019-3843 | High | 7.8 | 2019-04-26 | It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID… |
CVE-2016-7066 | High | 7.8 | 2018-09-11 | It was found that the improper default permissions on /tmp/auth directory in JBoss Enterprise Application Platform before 7.1.0 can allow any local user to con… |
CVE-2016-7070 | High | 8.0 | 2018-09-11 | A privilege escalation flaw was found in the Ansible Tower. When Tower before 3.0.3 deploys a PostgreSQL database, it incorrectly configures the trust level of… |
CVE-2018-1101 | High | 7.2 | 2018-05-02 | Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administ… |
CVE-2018-1088 | High | 8.1 | 2018-04-18 | A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster st… |
CVE-2017-12711 | High | 7.8 | 2017-08-30 | An Incorrect Privilege Assignment issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A built-in user account has been granted a sensi… |
CVE-2014-2532 | Medium | 4.2 | 2014-03-18 | sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment… |
CVE-2012-4549 | Medium | 6.5 | 2013-01-05 | A flaw was found in JBoss Enterprise Application Platform. The `processInvocation` function within the `org.jboss.as.ejb3.security.AuthorizationInterceptor` co… |