CWE-269 · Improper Privilege Management (page 12)
Page 12 of 32 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6482 | High | 8.8 | 2024-09-14 | The Login with phone number plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.49. This is due to a lack of v… |
CVE-2024-8246 | High | 8.8 | 2024-09-14 | The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to pr… |
CVE-2024-29779 | High | 7.8 | 2024-09-13 | there is a possible escalation of privilege due to an unusual root cause. This could lead to local escalation of privilege with no additional execution privile… |
CVE-2024-7960 | Critical | 9.1 | 2024-09-12 | The Rockwell Automation affected product contains a vulnerability that allows a threat actor to view sensitive information and change settings. The vulnerabili… |
CVE-2024-8533 | High | 8.8 | 2024-09-12 | A privilege escalation vulnerability exists in the Rockwell Automation affected products. The vulnerability occurs due to improper default file permissions all… |
CVE-2024-7890 | High | 7.3 | 2024-09-11 | Local privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows |
CVE-2024-5760 | High | 7.8 | 2024-09-11 | The Samsung Universal Print Driver for Windows is potentially vulnerable to escalation of privilege allowing the creation of a reverse shell in the tool. This… |
CVE-2024-8306 | High | 7.8 | 2024-09-11 | CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized access, loss of confidentiality, integrity and availability of the wo… |
CVE-2024-40662 | High | 7.8 | 2024-09-11 | In scheme of Uri.java, there is a possible way to craft a malformed Uri object due to improper input validation. This could lead to local escalation of privile… |
CVE-2024-40658 | High | 7.8 | 2024-09-11 | In getConfig of SoftVideoDecoderOMXComponent.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of… |
CVE-2024-40657 | High | 7.8 | 2024-09-11 | In addPreferencesForType of AccountTypePreferenceLoader.java, there is a possible way to disable apps for other users due to a confused deputy. This could lead… |
CVE-2024-44893 | Critical | 9.8 | 2024-09-10 | An issue in the component /jeecg-boot/jmreport/dict/list of JimuReport v1.7.8 allows attacker to escalate privileges via a crafted GET request. |
CVE-2024-38014 | High | 7.8 | 2024-09-10 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2024-37980 | High | 8.8 | 2024-09-10 | Microsoft SQL Server Elevation of Privilege Vulnerability |
CVE-2024-39574 | Medium | 6.7 | 2024-09-10 | Dell PowerScale InsightIQ, version 5.1, contain an Improper Privilege Management vulnerability. A high privileged attacker with local access could potentially… |
CVE-2024-45041 | High | 8.3 | 2024-09-09 | External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-ext… |
CVE-2024-7493 | Critical | 9.8 | 2024-09-06 | The WPCOM Member plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.5.2.1. This is due to the plugin allowing a… |
CVE-2024-8247 | High | 8.8 | 2024-09-06 | The Newsletters plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.9.9.2. This is due to the plugin not restric… |
CVE-2024-45173 | High | 8.8 | 2024-09-05 | An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper privilege management concerning sudo privileges, C-MOR is vulnerable to… |
CVE-2024-45058 | High | 8.1 | 2024-08-28 | i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. Prior to the 2.9 b… |
CVE-2024-4555 | High | 7.7 | 2024-08-28 | Improper Privilege Management vulnerability in OpenText NetIQ Access Manager allows user account impersonation in specific scenario. This issue affects NetIQ A… |
CVE-2024-42774 | High | 7.5 | 2024-08-22 | An Incorrect Access Control vulnerability was found in /admin/delete_room.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attack… |
CVE-2024-36439 | Critical | 9.4 | 2024-08-22 | Swissphone DiCal-RED 4009 devices allow a remote attacker to gain access to the administrative web interface via the device password's hash value, without know… |
CVE-2024-33656 | High | 7.8 | 2024-08-21 | The DXE module SmmComputrace contains a vulnerability that allows local attackers to leak stack or global memory. This could lead to privilege escalation, arbi… |
CVE-2020-11846 | High | 8.7 | 2024-08-21 | A vulnerability found in OpenText Privileged Access Manager that issues a token. on successful issuance of the token, a cookie gets set that allows unrestricte… |
CVE-2023-22576 | High | 7.0 | 2024-08-21 | Dell Repository Manager version 3.4.2 and earlier, contain a Local Privilege Escalation Vulnerability in Installation module. A local low privileged attacker m… |
CVE-2024-43403 | High | 8.8 | 2024-08-20 | Kanister is a data protection workflow management tool. The kanister has a deployment called default-kanister-operator, which is bound with a ClusterRole calle… |
CVE-2024-33872 | Critical | 9.8 | 2024-08-20 | Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in code execution and escalation of privileges. |
CVE-2024-43311 | Critical | 9.8 | 2024-08-19 | Improper Privilege Management vulnerability in Geek Code Lab Login As Users allows Privilege Escalation.This issue affects Login As Users: from n/a through 1.4… |
CVE-2024-43245 | Critical | 9.8 | 2024-08-19 | Improper Privilege Management vulnerability in eyecix JobSearch allows Privilege Escalation.This issue affects JobSearch: from n/a through 2.3.4. |
CVE-2024-43401 | Critical | 9.0 | 2024-08-19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user without script/programming right can trick a us… |
CVE-2024-44076 | Critical | 9.8 | 2024-08-19 | In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access. |
CVE-2024-42995 | High | 8.3 | 2024-08-16 | VTiger CRM <= 8.1.0 does not correctly check user privileges. A low-privileged user can interact directly with the "Migration" administrative module to disable… |
CVE-2024-34743 | High | 7.8 | 2024-08-15 | In setTransactionState of SurfaceFlinger.cpp, there is a possible way to perform tapjacking due to a logic error in the code. This could lead to local escalati… |
CVE-2024-34741 | High | 7.8 | 2024-08-15 | In setForceHideNonSystemOverlayWindowIfNeeded of WindowState.java, there is a possible way for message content to be visible on the screensaver while lock scre… |
CVE-2024-42440 | Medium | 6.2 | 2024-08-14 | Improper privilege management in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1… |
CVE-2024-21807 | High | 8.8 | 2024-08-14 | Improper initialization in the Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters before version 28.3 may allow an authentica… |
CVE-2024-43121 | Critical | 9.1 | 2024-08-13 | Improper Privilege Management vulnerability in realmag777 HUSKY allows Privilege Escalation.This issue affects HUSKY: from n/a through 1.3.6.1. |
CVE-2024-41903 | Medium | 6.6 | 2024-08-13 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application mounts the container's root… |
CVE-2023-48171 | High | 8.8 | 2024-08-12 | An issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate privileges via the user permissions component. |
CVE-2024-27442 | High | 7.8 | 2024-08-12 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user… |
CVE-2024-42366 | Critical | 9.0 | 2024-08-08 | VRCX is an assistant/companion application for VRChat. In versions prior to 2024.03.23, a CefSharp browser with over-permission and cross-site scripting via ov… |
CVE-2024-22069 | High | 7.1 | 2024-08-08 | There is a permission and access control vulnerability of ZTE's ZXV10 XT802/ET301 product.Attackers with common permissions can log in the terminal web and cha… |
CVE-2024-43199 | High | 7.8 | 2024-08-07 | Nagios NDOUtils before 2.1.4 allows privilege escalation from nagios to root because certain executable files are owned by the nagios user. |
CVE-2024-6359 | Medium | 6.4 | 2024-08-06 | Privilege escalation vulnerability identified in OpenText ArcSight Intelligence. |
CVE-2024-7291 | High | 7.2 | 2024-08-03 | The JetFormBuilder plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.4.1. This is due to improper restrictio… |
CVE-2024-33894 | High | 8.8 | 2024-08-02 | Insecure Permission vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are executing several processes with e… |
CVE-2024-27181 | High | 8.8 | 2024-08-02 | In Apache Linkis <= 1.5.0, Privilege Escalation in Basic management services where the attacking user is a trusted account allows access to Linkis's Token… |
CVE-2024-22278 | Medium | 6.4 | 2024-08-02 | Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations. |
CVE-2024-41949 | Low | 3.0 | 2024-08-01 | biscuit-rust is the Rust implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party blocks can be genera… |
CVE-2024-39634 | High | 8.8 | 2024-08-01 | Improper Privilege Management vulnerability in IdeaBox PowerPack Pro for Elementor allows Privilege Escalation.This issue affects PowerPack Pro for Elementor… |
CVE-2024-39633 | High | 8.8 | 2024-08-01 | Improper Privilege Management vulnerability in IdeaBox PowerPack for Beaver Builder allows Privilege Escalation.This issue affects PowerPack for Beaver Builder… |
CVE-2024-38775 | High | 7.2 | 2024-08-01 | Improper Privilege Management vulnerability in WebAppick CTX Feed allows Privilege Escalation.This issue affects CTX Feed: from n/a through 6.5.6. |
CVE-2024-38770 | Critical | 9.8 | 2024-08-01 | Improper Privilege Management vulnerability in Revmakx Backup and Staging by WP Time Capsule allows Privilege Escalation, Authentication Bypass.This issue affe… |
CVE-2023-52209 | High | 8.0 | 2024-08-01 | Improper Privilege Management vulnerability in WPForms, LLC. WPForms User Registration allows Privilege Escalation.This issue affects WPForms User Registration… |
CVE-2024-40802 | High | 7.8 | 2024-07-29 | The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. A local attacker may be ab… |
CVE-2024-40781 | High | 7.8 | 2024-07-29 | The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. A local attacker may be ab… |
CVE-2024-27826 | High | 7.8 | 2024-07-29 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.6, macOS Sonoma 14.5, macOS Ventura… |
CVE-2024-37858 | Critical | 9.8 | 2024-07-29 | SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the id parameter to php-lfis/admin/cat… |
CVE-2024-42050 | High | 7.0 | 2024-07-28 | The MSI installer for Splashtop Streamer for Windows before 3.7.0.0 uses a temporary folder with weak permissions during installation. A local user can exploit… |
CVE-2024-27357 | Medium | 5.8 | 2024-07-26 | An issue was discovered in WithSecure Elements Agent through 23.x for macOS, WithSecure Elements Client Security through 23.x for macOS, and WithSecure MDR thr… |
CVE-2023-50700 | High | 7.8 | 2024-07-26 | Insecure Permissions vulnerability in Deepin dde-file-manager 6.0.54 and earlier allows privileged operations to be called by unprivileged users via the D-Bus… |
CVE-2024-41666 | Medium | 4.7 | 2024-07-24 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD has a Web-based terminal that allows users to get a shell inside a running po… |
CVE-2020-11640 | High | 8.8 | 2024-07-23 | AdvaBuild uses a command queue to launch certain operations. An attacker who gains access to the command queue can use it to launch an attack by running any ex… |
CVE-2024-1575 | Medium | 6.5 | 2024-07-23 | The improper privilege management vulnerability in the Zyxel WBE660S firmware version 6.70(ACGG.3) and earlier versions could allow an authenticated user to es… |
CVE-2024-24970 | Medium | 6.5 | 2024-07-19 | Potential vulnerabilities have been identified in the HP Display Control software component within the HP Application Enabling Software Driver which might allo… |
CVE-2024-6908 | | 2024-07-19 | Improper privilege management in Yugabyte Platform allows authenticated admin users to escalate privileges to SuperAdmin via a crafted PUT HTTP request, potent… | |
CVE-2024-30473 | Medium | 4.9 | 2024-07-18 | Dell ECS, versions prior to 3.8.1, contain a privilege elevation vulnerability in user management. A remote high privileged attacker could potentially exploit… |
CVE-2023-4976 | | 2024-07-17 | A flaw exists in FlashBlade whereby a local account is permitted to authenticate to the management interface using an unintended method that allows an attacker… | |
CVE-2024-21141 | High | 8.2 | 2024-07-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.20. Easily… |
CVE-2024-5566 | Medium | 5.8 | 2024-07-16 | An improper privilege management vulnerability allowed users to migrate private repositories without having appropriate scopes defined on the related Personal… |
CVE-2024-6326 | Medium | 5.5 | 2024-07-16 | An exposure of sensitive information vulnerability exists in the Rockwell Automation FactoryTalk® System Service. A malicious user could exploit this vulnerabi… |
CVE-2024-6325 | Medium | 6.5 | 2024-07-16 | The v6.40 release of Rockwell Automation FactoryTalk® Policy Manager CVE-2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/a… |
CVE-2024-37560 | High | 8.0 | 2024-07-12 | Improper Privilege Management vulnerability in IqbalRony WP User Switch allows Privilege Escalation.This issue affects WP User Switch: from n/a through 1.1.0. |
CVE-2024-6677 | High | 7.8 | 2024-07-12 | Privilege escalation in uberAgent |
CVE-2024-6624 | Critical | 9.8 | 2024-07-11 | The JSON API User plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.9.3. This is due to improper controls on c… |
CVE-2024-6286 | High | 7.8 | 2024-07-10 | Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows |
CVE-2024-6151 | High | 7.8 | 2024-07-10 | Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Virtual Delivery Agent for Windows used by Citrix Virtual Apps and Desktop… |
CVE-2024-3325 | High | 7.2 | 2024-07-10 | Vulnerability in Jaspersoft JasperReport Servers.This issue affects JasperReport Servers: from 8.0.4 through 9.0.0. |
CVE-2024-6411 | High | 8.8 | 2024-07-10 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.8.9… |
CVE-2024-34725 | High | 7.0 | 2024-07-09 | In DevmemIntUnexportCtx of devicemem_server.c, there is a possible arbitrary code execution due to a race condition. This could lead to local escalation of pri… |
CVE-2024-31334 | High | 7.8 | 2024-07-09 | In DevmemIntFreeDefBackingPage of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local e… |
CVE-2024-31325 | High | 7.8 | 2024-07-09 | In multiple locations, there is a possible way to reveal images across users data due to a logic error in the code. This could lead to local escalation of priv… |
CVE-2024-31323 | High | 7.8 | 2024-07-09 | In onCreate of multiple files, there is a possible way to trick the user into granting health permissions due to tapjacking. This could lead to local escalatio… |
CVE-2024-31322 | High | 7.8 | 2024-07-09 | In updateServicesLocked of AccessibilityManagerService.java, there is a possible way for an app to be hidden from the Setting while retaining Accessibility Ser… |
CVE-2024-31320 | High | 7.8 | 2024-07-09 | In setSkipPrompt of AssociationRequest.java , there is a possible way to establish a companion device association without any confirmation due to CDM. This cou… |
CVE-2024-31318 | High | 7.8 | 2024-07-09 | In CompanionDeviceManagerService.java, there is a possible way to pair a companion device without user acceptance due to a missing permission check. This could… |
CVE-2024-31313 | High | 7.8 | 2024-07-09 | In availableToWriteBytes of MessageQueueBase.h, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation o… |
CVE-2024-31311 | High | 7.8 | 2024-07-09 | In increment_annotation_count of stats_event.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of p… |
CVE-2024-23711 | High | 7.8 | 2024-07-09 | In DevmemXIntUnreserveRange of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local esca… |
CVE-2023-21114 | High | 7.8 | 2024-07-09 | In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional exec… |
CVE-2023-21113 | High | 7.8 | 2024-07-09 | In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional exec… |
CVE-2024-38089 | Critical | 9.1 | 2024-07-09 | Microsoft Defender for IoT Elevation of Privilege Vulnerability |
CVE-2024-37952 | High | 8.8 | 2024-07-09 | Improper Privilege Management vulnerability in themeenergy BookYourTravel allows Privilege Escalation.This issue affects BookYourTravel: from n/a through 8.18… |
CVE-2024-37484 | High | 8.8 | 2024-07-09 | Improper Privilege Management vulnerability in Dylan James Zephyr Project Manager allows Privilege Escalation.This issue affects Zephyr Project Manager: from n… |
CVE-2024-37455 | High | 8.8 | 2024-07-09 | Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Elementor allows Privilege Escalation.This issue affects Ultimate Addons fo… |
CVE-2024-27711 | High | 8.8 | 2024-07-05 | An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the Sin-up process function in… |
CVE-2024-27710 | Critical | 9.8 | 2024-07-05 | An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the authentication mechanism. |
CVE-2024-37726 | Medium | 6.8 | 2024-07-03 | Insecure Permissions vulnerability in Micro-Star International Co., Ltd MSI Center v.2.0.36.0 allows a local attacker to escalate privileges via the Export Sys… |
CVE-2024-39206 | High | 7.5 | 2024-07-02 | An issue discovered in MSP360 Backup Agent v7.8.5.15 and v7.9.4.84 allows attackers to obtain network share credentials used in a backup due to enginesettings… |