CWE-269 · Improper Privilege Management (page 11)
Page 11 of 32 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-36046 | Critical | 9.8 | 2025-02-27 | Infoblox NIOS through 8.6.4 executes with more privileges than required. |
CVE-2025-1295 | High | 8.8 | 2025-02-27 | The Templines Elementor Helper Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.7. This is due to allowi… |
CVE-2024-2297 | High | 7.1 | 2025-02-27 | The Bricks theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.6.1. This is due to insufficient validation chec… |
CVE-2024-30150 | Medium | 5.3 | 2025-02-25 | HCL MyCloud is affected by Improper Access Control - an unauthenticated privilege escalation vulnerability which may lead to information disclosure and potenti… |
CVE-2024-12284 | High | 8.8 | 2025-02-20 | Authenticated privilege escalation in NetScaler Console and NetScaler Agent allows. |
CVE-2025-0893 | High | 7.8 | 2025-02-19 | Symantec Diagnostic Tool (SymDiag), prior to 3.0.79, may be susceptible to a Privilege Escalation vulnerability. |
CVE-2024-57778 | High | 8.8 | 2025-02-14 | An issue in Orbe ONetView Roeador Onet-1200 Orbe 1680210096 allows a remote attacker to escalate privileges via the servers response from status code 500 to st… |
CVE-2025-0327 | High | 7.8 | 2025-02-13 | CWE-269: Improper Privilege Management vulnerability exists for two services (of which one managing audit trail data and the other acting as server managing cl… |
CVE-2024-57602 | Critical | 9.8 | 2025-02-12 | An issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate privileges via the index.php file. |
CVE-2024-51324 | Low | 3.8 | 2025-02-11 | An issue in the BdApiUtil driver of Baidu Antivirus v5.2.3.116083 allows attackers to terminate arbitrary process via executing a BYOVD (Bring Your Own Vulnera… |
CVE-2024-21966 | High | 7.3 | 2025-02-11 | A DLL hijacking vulnerability in the AMD Ryzen™ Master Utility could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary cod… |
CVE-2025-25202 | Medium | 6.5 | 2025-02-11 | Ash Authentication is an authentication framework for Elixir applications. Applications which have been bootstrapped by the igniter installer present since Ash… |
CVE-2025-0180 | Critical | 9.8 | 2025-02-11 | The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.7. This is due to the plugin not properly… |
CVE-2025-23093 | High | 8.8 | 2025-02-06 | The Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager through V10 R1.54.1 and V11 through R0.22.1 could allow an authenticated attacker to… |
CVE-2025-24805 | Medium | 5.5 | 2025-02-05 | Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment fr… |
CVE-2024-11467 | High | 7.8 | 2025-02-04 | Omnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a logic flaw. Successful exploitation of this issue may allow… |
CVE-2024-47770 | Medium | 4.6 | 2025-02-03 | Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtual… |
CVE-2024-13343 | High | 8.8 | 2025-02-01 | The WooCommerce Customers Manager plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajax_assign_new_roles() f… |
CVE-2025-22220 | Medium | 4.3 | 2025-01-30 | VMware Aria Operations for Logs contains a privilege escalation vulnerability. A malicious actor with non-administrative privileges and network access to Aria… |
CVE-2025-23007 | Medium | 5.5 | 2025-01-30 | A vulnerability in the NetExtender Windows client log export function allows unauthorized access to sensitive Windows system files, potentially leading to priv… |
CVE-2025-0834 | High | 7.8 | 2025-01-30 | Privilege escalation vulnerability has been found in Wondershare Dr.Fone version 13.5.21. This vulnerability could allow an attacker to escalate privileges by… |
CVE-2021-3978 | High | 7.5 | 2025-01-29 | When copying files with rsync, octorpki uses the "-a" flag 0, which forces rsync to copy binaries with the suid bit set as root. Since the provided service def… |
CVE-2024-43446 | Low | 3.5 | 2025-01-27 | An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only has ro permissions. … |
CVE-2025-24353 | Medium | 5.0 | 2025-01-23 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.2.0, when sharing an item, a typical user can specify an a… |
CVE-2025-0651 | High | 7.1 | 2025-01-22 | Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation. User with a low system privileges can create a set of sym… |
CVE-2024-11218 | High | 8.6 | 2025-01-22 | A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a mal… |
CVE-2024-49742 | High | 7.8 | 2025-01-21 | In onCreate of NotificationAccessConfirmationActivity.java , there is a possible way to hide an app with notification access in Settings due to a missing permi… |
CVE-2025-23208 | High | 7.3 | 2025-01-17 | zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database (meta.db) is an append-list so group revoca… |
CVE-2018-9375 | High | 7.8 | 2025-01-17 | In multiple functions of UserDictionaryProvider.java, there is a possible way to add and delete words in the user dictionary due to a confused deputy. This cou… |
CVE-2024-55954 | High | 8.7 | 2025-01-16 | OpenObserve is a cloud-native observability platform. A vulnerability in the user management endpoint `/api/{org_id}/users/{email_id}` allows an "Admin" role u… |
CVE-2024-9636 | Critical | 9.8 | 2025-01-15 | The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in versions 2.2.85 to 2.3.3. This is due to the plugin not proper… |
CVE-2025-21360 | High | 7.8 | 2025-01-14 | Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability |
CVE-2025-21343 | High | 7.5 | 2025-01-14 | Windows Web Threat Defense User Service Information Disclosure Vulnerability |
CVE-2025-21287 | High | 7.8 | 2025-01-14 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2024-12398 | High | 8.8 | 2025-01-14 | An improper privilege management vulnerability in the web management interface of the Zyxel WBE530 firmware versions through 7.00(ACLE.3) and WBE660S firmware… |
CVE-2024-11128 | High | 7.8 | 2025-01-13 | A vulnerability in the BitdefenderVirusScanner binary as used in Bitdefender Virus Scanner for MacOS may allow .dynamic library injection (DYLD injection) with… |
CVE-2024-53706 | High | 7.8 | 2025-01-09 | A vulnerability in the Gen7 SonicOS Cloud platform NSv, allows a remote authenticated local low-privileged attacker to elevate privileges to `root` and potenti… |
CVE-2024-56447 | High | 7.8 | 2025-01-08 | Vulnerability of improper permission control in the window management module Impact: Successful exploitation of this vulnerability may affect service confident… |
CVE-2025-22621 | Medium | 6.4 | 2025-01-07 | In versions 1.0.67 and lower of the Splunk App for SOAR, the Splunk documentation for that app recommended adding the `admin_all_objects` capability to the `sp… |
CVE-2024-55632 | High | 7.8 | 2024-12-31 | A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please… |
CVE-2024-55631 | High | 7.8 | 2024-12-31 | An engine link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: a… |
CVE-2024-13058 | | 2024-12-30 | An issue exists in SoftIron HyperCloud where authenticated, but non-admin users can create data pools, which could potentially impact the performance and avai… | |
CVE-2020-9222 | High | 7.0 | 2024-12-27 | There is a privilege escalation vulnerability in Huawei FusionCompute product. Due to insufficient verification on specific files that need to be deserialized… |
CVE-2020-9080 | High | 7.8 | 2024-12-27 | There is an improper privilege management vulnerability in Huawei smart phone product. A local, authenticated attacker could craft a specific input to exploit… |
CVE-2024-56335 | High | 7.6 | 2024-12-20 | vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. In affected versions an attacker is capable of updati… |
CVE-2024-12786 | High | 7.8 | 2024-12-19 | A vulnerability, which was classified as critical, was found in X1a0He Adobe Downloader up to 1.3.1 on macOS. Affected is the function shouldAcceptNewConnectio… |
CVE-2020-15934 | High | 8.8 | 2024-12-19 | An execution with unnecessary privileges vulnerability in the VCM engine of FortiClient for Linux versions 6.2.7 and below, version 6.4.0. may allow local user… |
CVE-2024-38499 | High | 8.8 | 2024-12-17 | CA Client Automation (ITCM) allows non-admin/non-root users to encrypt a string using CAF CLI and SD_ACMD CLI. This would allow the non admin user to access th… |
CVE-2024-55949 | | 2024-12-16 | MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, a… | |
CVE-2024-11721 | High | 8.1 | 2024-12-14 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.24.5. This is due to insuff… |
CVE-2024-49035 | High | 8.7 | 2024-11-26 | An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network. |
CVE-2024-52336 | High | 7.8 | 2024-11-26 | A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus function can be called by locally logged-in users without a… |
CVE-2024-38830 | High | 7.8 | 2024-11-26 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges may trigger this vulnerabili… |
CVE-2024-9941 | High | 8.8 | 2024-11-23 | The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the MJ_gmgt_add_sta… |
CVE-2024-31141 | Medium | 6.5 | 2024-11-19 | Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clients accept configur… |
CVE-2020-26063 | Medium | 5.4 | 2024-11-18 | A vulnerability in the API endpoints of Cisco Integrated Management Controller could allow an authenticated, remote attacker to bypass authorization and t… |
CVE-2024-52926 | Medium | 6.5 | 2024-11-18 | Delinea Privilege Manager before 12.0.2 mishandles the security of the Windows agent. |
CVE-2024-9192 | High | 8.8 | 2024-11-16 | The WordPress Video Robot - The Ultimate Video Importer plugin for WordPress is vulnerable to privilege escalation due to insufficient validation on user meta… |
CVE-2024-52516 | Low | 3.0 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own groups, after a user… |
CVE-2024-8068 | High | 8.0 | 2024-11-12 | Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Director… |
CVE-2024-49558 | High | 7.8 | 2024-11-12 | Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Improper Privilege Management vulnerability. A low privileged… |
CVE-2024-24409 | High | 8.8 | 2024-11-08 | Zohocorp ManageEngine ADManager Plus versions 7203 and prior are vulnerable to Privilege Escalation in the Modify Computers option. |
CVE-2024-8424 | High | 7.8 | 2024-11-08 | Improper Privilege Management vulnerability in WatchGuard EPDR, Panda AD360 and Panda Dome on Windows (PSANHost.exe module) allows arbitrary file delete with S… |
CVE-2024-8810 | Medium | 6.5 | 2024-11-07 | A GitHub App installed in organizations could upgrade some permissions from read to write access without approval from an organization administrator. An attack… |
CVE-2024-10203 | High | 7.0 | 2024-11-07 | Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed… |
CVE-2024-51521 | Medium | 5.7 | 2024-11-05 | Input parameter verification vulnerability in the background service module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-20374 | Medium | 6.5 | 2024-10-23 | A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower Management Center Software… |
CVE-2024-48903 | High | 7.8 | 2024-10-22 | An improper access control vulnerability in Trend Micro Deep Security Agent 20 could allow a local attacker to escalate privileges on affected installations. … |
CVE-2023-32196 | Medium | 6.6 | 2024-10-16 | A vulnerability has been identified whereby privilege escalation checks are not properly enforced for RoleTemplateobjects when external=true, which in specific… |
CVE-2023-32194 | High | 7.2 | 2024-10-16 | A vulnerability has been identified when granting a create or * global role for a resource type of "namespaces"; no matter the API group, the subject will rece… |
CVE-2024-9002 | High | 7.8 | 2024-10-11 | CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized access, loss of confidentiality, integrity, and availability of the w… |
CVE-2024-22068 | Medium | 6.0 | 2024-10-10 | Improper Privilege Management vulnerability in ZTE ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 160 series on 64 bit allows Functionality Bypass.This… |
CVE-2024-9518 | Critical | 9.8 | 2024-10-10 | The UserPlus plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0 due to insufficient restriction on the 'form_acti… |
CVE-2024-38818 | Medium | 6.7 | 2024-10-09 | VMware NSX contains a local privilege escalation vulnerability. An authenticated malicious actor may exploit this vulnerability to obtain permissions from a… |
CVE-2024-9471 | Medium | 4.7 | 2024-10-09 | A privilege escalation (PE) vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated PAN-OS administrator with restricted pr… |
CVE-2024-3057 | Critical | 9.8 | 2024-10-08 | A flaw exists whereby a user can make a specific call to a FlashArray endpoint allowing privilege escalation. |
CVE-2024-45919 | Medium | 6.5 | 2024-10-07 | A security flaw has been discovered in Solvait version 24.4.2 that allows an attacker to elevate their privileges. By manipulating the Request ID and Action Ty… |
CVE-2024-45297 | Medium | 5.3 | 2024-10-07 | Discourse is an open source platform for community discussion. Users can see topics with a hidden tag if they know the label/name of that tag. This issue has b… |
CVE-2024-44439 | Medium | 5.9 | 2024-10-04 | An issue in Shanghai Zhouma Network Technology CO., Ltd IMS Intelligent Manufacturing Collaborative Internet of Things System v.1.9.1 allows a remote attacker… |
CVE-2024-44097 | Critical | 9.8 | 2024-10-02 | According to the researcher: "The TLS connections are encrypted against tampering or eavesdropping. However, the application does not validate the server certi… |
CVE-2024-9265 | Critical | 9.8 | 2024-10-01 | The Echo RSS Feed Post Generator plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.4.6. This is due to the plu… |
CVE-2024-28813 | High | 8.4 | 2024-09-30 | An issue was discovered in Infinera hiT 7300 5.60.50. Undocumented privileged functions in the @CT management application allow an attacker to activate remote… |
CVE-2024-46549 | High | 7.6 | 2024-09-30 | An issue in the TP-Link MQTT Broker and API gateway of TP-Link Kasa KP125M v1.0.3 allows attackers to establish connections by impersonating devices owned by o… |
CVE-2024-22893 | High | 7.5 | 2024-09-25 | OpenSlides 4.0.15 verifies passwords by comparing password hashes using a function with content-dependent runtime. This can allow attackers to obtain informati… |
CVE-2024-45373 | High | 8.8 | 2024-09-25 | Once logged in to ProGauge MAGLINK LX4 CONSOLE, a valid user can change their privileges to administrator. |
CVE-2024-8263 | Low | 2.7 | 2024-09-23 | An improper privilege management vulnerability allowed arbitrary workflows to be committed using an improperly scoped PAT through the use of nested tags. This… |
CVE-2024-44540 | Medium | 6.6 | 2024-09-23 | Ubiquiti AirMax firmware version firmware version 8 allows attackers with physical access to gain a privileged command shell via the UART Debugging Port. |
CVE-2024-39342 | Medium | 6.6 | 2024-09-23 | Entrust Instant Financial Issuance (formerly known as Cardwizard) 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier uses a DLL library (i.e. DCG.Security.dll)… |
CVE-2024-0003 | Critical | 9.1 | 2024-09-23 | A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the array allowing privilege… |
CVE-2024-41228 | High | 7.6 | 2024-09-23 | A symlink following vulnerability in the pouch cp function of AliyunContainerService pouch v1.3.1 allows attackers to escalate privileges and write arbitrary f… |
CVE-2024-34331 | Critical | 9.8 | 2024-09-23 | A lack of code signature verification in Parallels Desktop for Mac v19.3.0 and below allows attackers to escalate privileges via a crafted macOS installer, bec… |
CVE-2024-8853 | Critical | 9.8 | 2024-09-20 | The Webo-facto plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.40 due to insufficient restriction on the 'doSsoA… |
CVE-2024-47000 | High | 8.1 | 2024-09-20 | Zitadel is an open source identity management platform. ZITADEL's user account deactivation mechanism did not work correctly with service accounts. Deactivated… |
CVE-2024-46999 | High | 7.3 | 2024-09-20 | Zitadel is an open source identity management platform. ZITADEL's user grants deactivation mechanism did not work correctly. Deactivated user grants were still… |
CVE-2024-45752 | High | 8.5 | 2024-09-19 | logiops through 0.3.4, in its default configuration, allows any unprivileged user to configure its logid daemon via an unrestricted D-Bus service, including se… |
CVE-2024-46989 | Low | 3.7 | 2024-09-18 | spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Multiple caveats over… |
CVE-2024-45496 | Critical | 9.9 | 2024-09-17 | A flaw was found in OpenShift. This issue occurs due to the misuse of elevated privileges in the OpenShift Container Platform's build process. During the build… |
CVE-2024-44147 | Medium | 5.5 | 2024-09-17 | This issue was addressed through improved state management. This issue is fixed in iOS 18 and iPadOS 18. An app may gain unauthorized access to Local Network. |
CVE-2024-40861 | High | 7.8 | 2024-09-17 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15. An app may be able to gain root privileges. |
CVE-2024-42798 | High | 7.6 | 2024-09-16 | An Incorrect Access Control vulnerability was found in /music/index.php?page=user_list and /music/index.php?page=edit_user in Kashipara Music Management System… |