CWE-267 · Privilege Defined With Unsafe Actions

67 CVEs classified under CWE-267 (Privilege Defined With Unsafe Actions). Browse by severity and year.

Top CVEs for CWE-267
CVESeverityScorePublishedSummary
CVE-2023-22647Critical9.92023-06-01An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate Kubernetes secrets i…
CVE-2026-29646Critical9.82026-04-20In OpenXiangShan NEMU prior to 55295c4, when running with RVH (Hypervisor extension) enabled, a VS-mode guest write to the supervisor interrupt-enable CSR (sie…
CVE-2021-44547Critical9.12023-04-25A sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed arbitrary code, leading to privilege escalat…
CVE-2026-10090Critical9.02026-08-05A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM)…
CVE-2026-27314High8.82026-04-07Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their o…
CVE-2025-14349High8.82026-02-13Privilege Defined With Unsafe Actions, Missing Authentication for Critical Function vulnerability in Universal Software Inc. FlexCity/Kiosk allows Accessing Fu…
CVE-2026-0945High8.82026-02-04Privilege Defined With Unsafe Actions vulnerability in Drupal Role Delegation allows Privilege Escalation.This issue affects Role Delegation: from 1.3.0 before…
CVE-2026-23526High8.82026-01-21CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.0.0 through 2.54.0, users that have the staff status may…
CVE-2025-26467High8.82025-08-25Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser w…
CVE-2025-23015High8.82025-02-04Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser w…
CVE-2024-55968High8.82025-01-28An issue was discovered in DTEX DEC-M (DTEX Forwarder) 6.1.1. The com.dtexsystems.helper service, responsible for handling privileged operations within the mac…
CVE-2024-39866High8.82024-07-09A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application allows users to upload encrypted backup…
CVE-2023-44218High8.82023-10-03 A flaw within the SonicWall NetExtender Pre-Logon feature enables an unauthorized user to gain access to the host Windows operating system with 'SYSTEM' level…
CVE-2023-2983High8.82023-05-30Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23.
CVE-2021-32739High8.82021-07-15Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From…
CVE-2020-29396High8.82020-12-22A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticate…
CVE-2026-42406High8.72026-05-13A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify con…
CVE-2023-43746High8.72023-10-10 When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP exte…
CVE-2021-23186High8.72023-04-25A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to access and modify database co…
CVE-2021-23166High8.72023-04-25A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and write local files on…
All CVEs classified under CWE-267 — newest first (page 1 of 1)
CVESeverityScorePublishedSummary
CVE-2026-81161Low3.32026-09-02Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderati…
CVE-2025-36255High7.52026-08-19IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to create a user with pri…
CVE-2026-10090Critical9.02026-08-05A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM)…
CVE-2026-6816Low3.82026-05-28An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users…
CVE-2026-9560High7.82026-05-26Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privil…
CVE-2026-42406High8.72026-05-13A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify con…
CVE-2026-29646Critical9.82026-04-20In OpenXiangShan NEMU prior to 55295c4, when running with RVH (Hypervisor extension) enabled, a VS-mode guest write to the supervisor interrupt-enable CSR (sie…
CVE-2026-27314High8.82026-04-07Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their o…
CVE-2026-2460High8.12026-02-24A vulnerability exists in REB500 for an authenticated user with low-level privileges to access and alter the content of directories by using the DAC protocol t…
CVE-2026-2459High8.12026-02-24A vulnerability exists in REB500 for an authenticated user with Installer role to access and alter the contents of directories that the role is not authorized…
CVE-2025-14349High8.82026-02-13Privilege Defined With Unsafe Actions, Missing Authentication for Critical Function vulnerability in Universal Software Inc. FlexCity/Kiosk allows Accessing Fu…
CVE-2026-0945High8.82026-02-04Privilege Defined With Unsafe Actions vulnerability in Drupal Role Delegation allows Privilege Escalation.This issue affects Role Delegation: from 1.3.0 before…
CVE-2025-13979Medium5.42026-01-28Privilege Defined With Unsafe Actions vulnerability in Drupal Mini site allows Stored XSS.This issue affects Mini site: from 0.0.0 before 3.0.2.
CVE-2026-23526High8.82026-01-21CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.0.0 through 2.54.0, users that have the staff status may…
CVE-2025-53900Medium6.52025-11-29Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, an unfavourable definition of roles and permissions in Kiteworks MFT on…
CVE-2025-62641High8.22025-10-21Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Easi…
CVE-2025-62591Medium6.02025-10-21Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Easi…
CVE-2025-62590High8.22025-10-21Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Easi…
CVE-2025-62589High8.22025-10-21Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Easi…
CVE-2025-62588High8.22025-10-21Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Easi…
CVE-2025-62587High8.22025-10-21Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Easi…
CVE-2025-62480Low2.72025-10-21Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Naming Subsystem). The supported version that is affected is 8.8…
CVE-2025-62479Low2.72025-10-21Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Block Storage). The supported version that is affected is 8.8. Ea…
CVE-2025-62289Medium4.92025-10-21Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Filesystems). The supported version that is affected is 8.8. Easi…
CVE-2025-62288Medium4.92025-10-21Vulnerability in the Oracle Health Sciences Data Management Workbench product of Oracle Health Sciences Applications (component: Logger). Supported versions t…
CVE-2025-61754Medium6.52025-10-21Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected are 7.6.0.0.0 and 8.2…
CVE-2025-53070Medium5.52025-10-21Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The supported version that is affected is 11. Easily exploitable vulne…
CVE-2025-41244High7.82025-09-29VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having a…
CVE-2025-7691Medium6.52025-09-26A privilege escalation issue has been discovered in GitLab EE affecting all versions from 16.6 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1…
CVE-2025-26467High8.82025-08-25Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser w…
CVE-2025-47811Medium4.12025-07-10In Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port 5466) runs as root or SYSTEM by default. The web application i…
CVE-2025-7030Medium6.52025-07-08Privilege Defined With Unsafe Actions vulnerability in Drupal Two-factor Authentication (TFA) allows Exploiting Incorrectly Configured Access Control Security…
CVE-2025-29032025-04-17An attacker with knowledge of creating user accounts during VM deployment on Google Cloud Platform (GCP) using the OS Login feature, can login via SSH gaining…
CVE-2025-23015High8.82025-02-04Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser w…
CVE-2024-55968High8.82025-01-28An issue was discovered in DTEX DEC-M (DTEX Forwarder) 6.1.1. The com.dtexsystems.helper service, responsible for handling privileged operations within the mac…
CVE-2024-9842High7.32024-11-12Incorrect permissions in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to create arbitrary folders.
CVE-2024-8539High7.12024-11-12Improper authorization in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker to modify sensitive configuration files.
CVE-2024-7571High7.82024-11-12Incorrect permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges.
CVE-2024-47906High7.82024-11-12Excessive binary privileges in Ivanti Connect Secure before version 22.7R2.3 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.2 (Not Ap…
CVE-2024-8631Medium5.52024-09-12A privilege escalation issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17…
CVE-2024-5623High7.82024-08-29An untrusted search path vulnerability in B&R APROL <= R 4.4-00P3 may be used by an authenticated local attacker to get other users to execute arbitrary code u…
CVE-2024-5622High7.82024-08-29An untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL <= R 4.2.-07P3 and <= R 4.4-00P3 may allow an authenticated local attacker…
CVE-2024-20411Medium6.72024-08-28A vulnerability in Cisco NX-OS Software could allow an authenticated, local attacker with privileges to access the Bash shell to&nbsp;execute arbitrary code as…
CVE-2024-42365High7.42024-08-08Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk v…
CVE-2024-39866High8.82024-07-09A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application allows users to upload encrypted backup…
CVE-2024-32901High7.82024-06-13In v4l2_smfc_qbuf of smfc-v4l2-ioctls.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privileg…
CVE-2023-28049Medium4.72024-02-06 Dell Command | Monitor, versions prior to 10.9, contain an arbitrary folder deletion vulnerability. A locally authenticated malicious user may exploit this vu…
CVE-2023-41966Medium6.52023-10-26 The application suffers from a privilege escalation vulnerability. A user with read permissions can elevate privileges by sending a HTTP POST to set a par…
CVE-2023-43746High8.72023-10-10 When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP exte…
CVE-2023-44218High8.82023-10-03 A flaw within the SonicWall NetExtender Pre-Logon feature enables an unauthorized user to gain access to the host Windows operating system with 'SYSTEM' level…
CVE-2023-32457High7.52023-08-29 Dell PowerScale OneFS, versions 8.2.2.x-9.5.0.x, contains an improper privilege management vulnerability. A remote attacker with low privileges could potentia…
CVE-2023-22647Critical9.92023-06-01An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate Kubernetes secrets i…
CVE-2023-2983High8.82023-05-30Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23.
CVE-2021-44547Critical9.12023-04-25A sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed arbitrary code, leading to privilege escalat…
CVE-2021-44476Medium6.82023-04-25A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read local files on the serve…
CVE-2021-23186High8.72023-04-25A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to access and modify database co…
CVE-2021-23166High8.72023-04-25A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and write local files on…
CVE-2023-27895Medium6.12023-03-14SAP Authenticator for Android - version 1.3.0, allows the screen to be captured, if an authorized attacker installs a malicious app on the mobile device. The a…
CVE-2022-38124Medium5.72022-12-13Debug tool in Secomea SiteManager allows logged-in administrator to modify system state in an unintended manner.
CVE-2021-40354High7.12021-09-14A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions…
CVE-2021-32739High8.82021-07-15Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From…
CVE-2020-29396High8.82020-12-22A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticate…
CVE-2020-7824Medium6.52020-08-25A vulnerability in the web-based management interface of iPECS could allow an authenticated, remote attacker to get administrator permission. The vulnerability…
CVE-2019-10170Medium6.62020-05-08A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker wi…
CVE-2019-10169Medium6.62020-05-08A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy. This flaw allows an authenticated att…
CVE-2019-14865Medium5.92019-11-29A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure (for example by setting RLIMIT), c…
CVE-2017-2616Medium5.52018-07-27A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this f…