CWE-269 · Improper Privilege Management (page 14)
Page 14 of 32 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-30007 | High | 8.8 | 2024-05-14 | Microsoft Brokering File System Elevation of Privilege Vulnerability |
CVE-2024-4545 | High | 7.7 | 2024-05-14 | All versions of EnterpriseDB Postgres Advanced Server (EPAS) from 15.0 prior to 15.7.0 and from 16.0 prior to 16.3.0 may allow users using edbldr to bypass ro… |
CVE-2024-3828 | High | 8.8 | 2024-05-14 | The Spectra Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.5. This is due to the plugin allowing lowe… |
CVE-2024-31953 | Medium | 6.7 | 2024-05-14 | An issue was discovered in Samsung Magician 8.0.0 on macOS. Because it is possible to tamper with the directory and executable files used during the installati… |
CVE-2024-22774 | High | 7.8 | 2024-05-14 | An issue in Panoramic Corporation Digital Imaging Software v.9.1.2.7600 allows a local attacker to escalate privileges via the ccsservice.exe component. |
CVE-2024-0097 | High | 7.5 | 2024-05-14 | NVIDIA ChatRTX for Windows contains a vulnerability in ChatRTX UI, where a user can cause an improper privilege management issue by exploiting interprocess com… |
CVE-2024-0096 | High | 7.5 | 2024-05-14 | NVIDIA ChatRTX for Windows contains a vulnerability in Chat RTX UI, where a user can cause an improper privilege management issue by sending user inputs to cha… |
CVE-2024-3507 | High | 7.7 | 2024-05-08 | Improper privilege management vulnerability in Lunar software that affects versions 6.0.2 through 6.6.0. This vulnerability allows an attacker to perform a sec… |
CVE-2024-22264 | High | 7.2 | 2024-05-08 | VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious actor with admin privileges on VMware Avi Load Balancer can create, modify… |
CVE-2024-23713 | High | 7.8 | 2024-05-07 | In migrateNotificationFilter of NotificationManagerService.java, there is a possible failure to persist notifications settings due to improper input validation… |
CVE-2024-23710 | High | 7.8 | 2024-05-07 | In assertPackageWithSharedUserIdIsPrivileged of InstallPackageHelper.java, there is a possible execution of arbitrary app code as a privileged app due to a log… |
CVE-2024-0024 | High | 7.8 | 2024-05-07 | In multiple methods of UserManagerService.java, there is a possible failure to persist or enforce user restrictions due to improper input validation. This coul… |
CVE-2024-29210 | Low | 2.8 | 2024-05-07 | A local privilege escalation (LPE) vulnerability has been identified in Phish Alert Button for Outlook (PAB), specifically within its configuration management… |
CVE-2024-29150 | High | 8.8 | 2024-05-07 | An issue was discovered in Alcatel-Lucent ALE NOE deskphones through 86x8_NOE-R300.1.40.12.4180 and SIP deskphones through 86x8_SIP-R200.1.01.10.728. Because o… |
CVE-2024-20021 | Medium | 6.7 | 2024-05-06 | In atf spm, there is a possible way to remap physical memory to virtual memory due to a logic error. This could lead to local escalation of privilege with Syst… |
CVE-2024-33398 | High | 7.5 | 2024-05-03 | There is a ClusterRole in piraeus-operator v2.5.0 and earlier which has been granted list secrets permission, which allows an attacker to impersonate the servi… |
CVE-2024-34146 | Medium | 6.5 | 2024-05-02 | Jenkins Git server Plugin 114.v068a_c7cc2574 and earlier does not perform a permission check for read access to a Git repository over SSH, allowing attackers w… |
CVE-2024-33393 | Medium | 6.2 | 2024-05-01 | An issue in spidernet-io spiderpool v.0.9.3 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component. |
CVE-2024-23457 | High | 7.8 | 2024-05-01 | The anti-tampering functionality of the Zscaler Client Connector can be disabled under certain conditions when an uninstall password is enforced. This affects… |
CVE-2023-7241 | High | 7.9 | 2024-05-01 | Privilege Escalation in WRSA.EXE in Webroot Antivirus 8.0.1X- 9.0.35.12 on Windows64 bit and 32 bit allows malicious software to abuse WRSA.EXE to delete arb… |
CVE-2024-33775 | Critical | 9.8 | 2024-05-01 | An issue with the Autodiscover component in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted Dashlet. |
CVE-2024-33308 | Critical | 9.1 | 2024-04-30 | An issue in TVS Motor Company Limited TVS Connet Android v.4.5.1 and iOS v.5.0.0 allows a remote attacker to escalate privileges via the Emergency Contact Feat… |
CVE-2024-33522 | Medium | 6.7 | 2024-04-29 | In vulnerable versions of Calico (v3.27.2 and below), Calico Enterprise (v3.19.0-1, v3.18.1, v3.17.3 and below), and Calico Cloud (v19.2.0 and below), an attac… |
CVE-2024-27518 | High | 7.8 | 2024-04-29 | An issue in SUPERAntiSyware Professional X 10.0.1262 and 10.0.1264 allows unprivileged attackers to escalate privileges via a restore of a crafted DLL file int… |
CVE-2024-31502 | High | 8.1 | 2024-04-26 | An issue in Insurance Management System v.1.0.0 and before allows a remote attacker to escalate privileges via a crafted POST request to /admin/core/new_staff. |
CVE-2024-25343 | Critical | 9.1 | 2024-04-26 | Tenda N300 F3 router vulnerability allows users to bypass intended security policy and create weak passwords. |
CVE-2024-28241 | High | 7.3 | 2024-04-25 | The GLPI Agent is a generic management agent. Prior to version 1.7.2, a local user can modify GLPI-Agent code or used DLLs to modify agent logic and even gain… |
CVE-2023-51425 | Critical | 9.8 | 2024-04-24 | Improper Privilege Management vulnerability in Jacques Malgrange Rencontre – Dating Site allows Privilege Escalation.This issue affects Rencontre – Dating Site… |
CVE-2023-38292 | High | 8.7 | 2024-04-22 | Certain software builds for the TCL 20XE Android device contain a vulnerable, pre-installed app with a package name of com.tct.gcs.hiddenmenuproxy (versionCode… |
CVE-2024-32418 | Critical | 9.8 | 2024-04-22 | An issue in flusity CMS v2.33 allows a remote attacker to execute arbitrary code via the add_addon.php component. |
CVE-2024-4018 | High | 8.8 | 2024-04-19 | Improper Privilege Management vulnerability in BeyondTrust U-Series Appliance on Windows, 64 bit (local appliance api modules) allows Privilege Escalation.This… |
CVE-2024-4017 | High | 8.8 | 2024-04-19 | Improper Privilege Management vulnerability in BeyondTrust U-Series Appliance on Windows, 64 bit (filesystem modules) allows DLL Side-Loading.This issue affect… |
CVE-2024-3470 | Medium | 5.9 | 2024-04-19 | An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed an attacker to use a deploy key pertaining to an organiz… |
CVE-2024-21989 | High | 8.1 | 2024-04-17 | ONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x are susceptible to a vulnerability which when successfully exploited coul… |
CVE-2024-21121 | Medium | 6.5 | 2024-04-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily… |
CVE-2024-21118 | Medium | 5.3 | 2024-04-16 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). Supported versions that are affected are 8… |
CVE-2024-21111 | High | 7.8 | 2024-04-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily… |
CVE-2024-21101 | Low | 2.2 | 2024-04-16 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.5.33 and prior, 7.6.29 an… |
CVE-2024-21059 | High | 7.8 | 2024-04-16 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11. Difficult to exploit vulner… |
CVE-2024-21034 | Medium | 6.1 | 2024-04-16 | Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versions that are affecte… |
CVE-2024-32003 | High | 8.8 | 2024-04-12 | wn-dusk-plugin (Dusk plugin) is a plugin which integrates Laravel Dusk browser testing into Winter CMS. The Dusk plugin provides some special routes as part of… |
CVE-2024-3388 | Medium | 4.1 | 2024-04-10 | A vulnerability in the GlobalProtect Gateway in Palo Alto Networks PAN-OS software enables an authenticated attacker to impersonate another user and send netwo… |
CVE-2024-29052 | High | 7.8 | 2024-04-09 | Windows Storage Elevation of Privilege Vulnerability |
CVE-2024-28905 | High | 7.8 | 2024-04-09 | Microsoft Brokering File System Elevation of Privilege Vulnerability |
CVE-2024-28904 | High | 7.8 | 2024-04-09 | Microsoft Brokering File System Elevation of Privilege Vulnerability |
CVE-2024-21324 | High | 7.2 | 2024-04-09 | Microsoft Defender for IoT Elevation of Privilege Vulnerability |
CVE-2024-0082 | High | 8.2 | 2024-04-08 | NVIDIA ChatRTX for Windows contains a vulnerability in the UI, where an attacker can cause improper privilege management by sending open file requests to the a… |
CVE-2023-52543 | Medium | 6.2 | 2024-04-08 | Permission verification vulnerability in the system module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52716 | High | 7.5 | 2024-04-07 | Vulnerability of starting activities in the background in the ActivityManagerService (AMS) module. Impact: Successful exploitation of this vulnerability will a… |
CVE-2024-29741 | High | 7.8 | 2024-04-05 | In pblS2mpuResume of s2mpu.c, there is a possible mitigation bypass due to a logic error in the code. This could lead to local escalation of privilege with no… |
CVE-2024-31498 | High | 8.8 | 2024-04-04 | Yubico ykman-gui (aka YubiKey Manager GUI) before 1.2.6 on Windows, when Edge is not used, allows privilege escalation because browser windows can open as Admi… |
CVE-2024-20282 | Medium | 6.0 | 2024-04-03 | A vulnerability in Cisco Nexus Dashboard could allow an authenticated, local attacker with valid rescue-user credentials to elevate privileges to root on an af… |
CVE-2024-0172 | High | 7.9 | 2024-04-03 | Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper privilege management security vulnerability. An unauthenticated local attacker coul… |
CVE-2024-3137 | High | 7.1 | 2024-04-02 | Improper Privilege Management in uvdesk/community-skeleton |
CVE-2024-29667 | Critical | 9.8 | 2024-03-29 | SQL Injection vulnerability in Tongtianxing Technology Co., Ltd CMSV6 v.7.31.0.2 through v.7.31.0.3 allows a remote attacker to escalate privileges and obtain… |
CVE-2023-49232 | Critical | 9.8 | 2024-03-29 | An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to brute-force the password reset PINs of a… |
CVE-2024-23537 | High | 8.4 | 2024-03-29 | Improper Privilege Management vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5. Users are recommended to upgrade to version 1.9.0… |
CVE-2024-25961 | Medium | 6.0 | 2024-03-28 | Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains an improper privilege management vulnerability. A local high privileged attacker could potentia… |
CVE-2024-28247 | High | 7.6 | 2024-03-27 | The Pi-hole is a DNS sinkhole that protects your devices from unwanted content without installing any client-side software. A vulnerability has been discovered… |
CVE-2023-40289 | High | 7.2 | 2024-03-27 | A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker can exploit this to elevate privileges from a… |
CVE-2024-1973 | High | 8.5 | 2024-03-25 | By leveraging the vulnerability, lower-privileged users of Content Manager can manipulate Content Manager clients to elevate privileges and perform unauthorize… |
CVE-2024-24892 | High | 8.1 | 2024-03-25 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Privilege Management vulnerability in openEuler migration-… |
CVE-2024-26247 | Medium | 4.7 | 2024-03-22 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2024-2228 | High | 7.1 | 2024-03-22 | This vulnerability allows an authenticated user to perform a Lifecycle Manager flow or other QuickLink for a target user outside of the defined QuickLink Popul… |
CVE-2023-41099 | High | 7.8 | 2024-03-22 | In the Windows installer in Atos Eviden CardOS API before 5.5.5.2811, Local Privilege Escalation can occur.(from a regular user to SYSTEM). |
CVE-2023-47715 | Medium | 4.3 | 2024-03-21 | IBM Storage Protect Plus Server 10.1.0 through 10.1.16 could allow an authenticated user with read-only permissions to add or delete entries from an existing H… |
CVE-2023-48902 | Critical | 9.8 | 2024-03-21 | An issue was discovered in tramyardg autoexpress version 1.3.0, allows unauthenticated remote attackers to escalate privileges, update car data, delete vehicle… |
CVE-2024-1908 | Medium | 6.3 | 2024-03-21 | An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed an attacker to use the Enterprise Actions GitHub Connect… |
CVE-2024-2390 | High | 7.8 | 2024-03-18 | As a part of Tenable’s vulnerability disclosure program, a vulnerability in a Nessus plugin was identified and reported. This vulnerability could allow a mali… |
CVE-2024-28851 | Medium | 4.0 | 2024-03-15 | The Snowflake Hive metastore connector provides an easy way to query Hive-managed data via Snowflake. Snowflake Hive MetaStore Connector has addressed a potent… |
CVE-2023-50677 | High | 8.8 | 2024-03-14 | An issue in NETGEAR-DGND4000 v.1.1.00.15_1.00.15 allows a remote attacker to escalate privileges via the next_file parameter to the /setup.cgi component. |
CVE-2024-27301 | High | 7.3 | 2024-03-14 | Support App is an opensource application specialized in managing Apple devices. It's possible to abuse a vulnerability inside the postinstall installer script… |
CVE-2024-28391 | Critical | 9.8 | 2024-03-14 | SQL injection vulnerability in FME Modules quickproducttable module for PrestaShop v.1.2.1 and before, allows a remote attacker to escalate privileges and obta… |
CVE-2023-50726 | Medium | 6.4 | 2024-03-13 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. "Local sync" is an Argo CD feature that allows developers to temporarily override an… |
CVE-2024-2433 | Medium | 4.3 | 2024-03-13 | An improper authorization vulnerability in Palo Alto Networks Panorama software enables an authenticated read-only administrator to upload files using the web… |
CVE-2024-2432 | Medium | 4.5 | 2024-03-13 | A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated… |
CVE-2024-2431 | Medium | 5.5 | 2024-03-13 | An issue in the Palo Alto Networks GlobalProtect app enables a non-privileged user to disable the GlobalProtect app in configurations that allow a user to disa… |
CVE-2024-20262 | Medium | 6.5 | 2024-03-13 | A vulnerability in the Secure Copy Protocol (SCP) and SFTP feature of Cisco IOS XR Software could allow an authenticated, local attacker to create or overwrite… |
CVE-2024-1505 | High | 8.8 | 2024-03-13 | The Academy LMS – eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and incl… |
CVE-2024-1138 | High | 8.8 | 2024-03-12 | The FTL Server component of TIBCO Software Inc.'s TIBCO FTL - Enterprise Edition contains a vulnerability that allows a low privileged attacker with network ac… |
CVE-2024-26169 | High | 7.8 | 2024-03-12 | Windows Error Reporting Service Elevation of Privilege Vulnerability |
CVE-2024-28197 | High | 7.5 | 2024-03-11 | Zitadel is an open source identity management system. Zitadel uses a cookie to identify the user agent (browser) and its user sessions. Although the cookie wa… |
CVE-2024-27233 | High | 7.8 | 2024-03-11 | In ppcfw_init_secpolicy of ppcfw.c, there is a possible permission bypass due to uninitialized data. This could lead to local escalation of privilege with no a… |
CVE-2024-27224 | High | 7.8 | 2024-03-11 | In strncpy of strncpy.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additi… |
CVE-2024-27222 | High | 7.8 | 2024-03-11 | In onSkipButtonClick of FaceEnrollFoldPage.java, there is a possible way to access the file the app cannot access due to Intent Redirect GRANT_URI_PERMISSIONS… |
CVE-2024-27210 | High | 7.8 | 2024-03-11 | In policy_check of fvp.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no addit… |
CVE-2024-27207 | Critical | 9.1 | 2024-03-11 | Exported broadcast receivers allowing malicious apps to bypass broadcast protection. |
CVE-2024-25990 | Medium | 6.4 | 2024-03-11 | In pktproc_perftest_gen_rx_packet_sktbuf_mode of link_rx_pktproc.c, there is a possible out of bounds write due to a race condition. This could lead to local e… |
CVE-2024-25987 | Medium | 6.7 | 2024-03-11 | In pt_sysctl_command of pt.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with S… |
CVE-2024-22008 | High | 7.8 | 2024-03-11 | In config_gov_time_windows of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege wi… |
CVE-2024-0049 | High | 7.8 | 2024-03-11 | In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no addition… |
CVE-2024-0046 | High | 7.8 | 2024-03-11 | In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the code. This could lead… |
CVE-2024-23276 | High | 7.8 | 2024-03-08 | A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to… |
CVE-2024-23253 | Low | 3.3 | 2024-03-08 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.4. An app may be able to access a user's Photos Library. |
CVE-2024-22752 | High | 8.1 | 2024-03-07 | Insecure permissions issue in EaseUS MobiMover 6.0.5 Build 21620 allows attackers to gain escalated privileges via use of crafted executable launched from the… |
CVE-2024-1442 | Medium | 6.0 | 2024-03-07 | A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to re… |
CVE-2024-2005 | Critical | 9.0 | 2024-03-06 | In Blue Planet® products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation. Only products using SAML authenticatio… |
CVE-2023-38944 | Critical | 9.8 | 2024-03-06 | An issue in Multilaser RE160V firmware v12.03.01.09_pt and Multilaser RE163V firmware v12.03.01.10_pt allows attackers to bypass the access control and gain co… |
CVE-2024-1764 | High | 7.6 | 2024-03-05 | Improper privilege management in Just-in-time (JIT) elevation module in Devolutions Server 2023.3.14.0 and earlier allows a user to continue using the elevated… |
CVE-2024-25847 | Critical | 9.8 | 2024-03-03 | SQL Injection vulnerability in MyPrestaModules "Product Catalog (CSV, Excel) Import" (simpleimportproduct) modules for PrestaShop versions 6.5.0 and before, al… |