CWE-269 · Improper Privilege Management (page 15)
Page 15 of 32 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-25842 | High | 7.5 | 2024-03-03 | An issue was discovered in Presta World "Account Manager - Sales Representative & Dealers - CRM" (prestasalesmanager) module for PrestaShop before version 9.0… |
CVE-2024-0819 | High | 7.3 | 2024-02-27 | Improper initialization of default settings in TeamViewer Remote Client prior version 15.51.5 for Windows, Linux and macOS, allow a low privileged user to ele… |
CVE-2024-0197 | High | 7.8 | 2024-02-27 | A flaw in the installer for Thales SafeNet Sentinel HASP LDK prior to 9.16 on Windows allows an attacker to escalate their privilege level via local access. |
CVE-2023-7016 | High | 7.8 | 2024-02-27 | A flaw in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to execute code at a SYSTEM level via local access. |
CVE-2023-5993 | High | 7.8 | 2024-02-27 | A flaw in the Windows Installer in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to escalate their privilege level via l… |
CVE-2024-24402 | Critical | 9.8 | 2024-02-26 | An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd component. |
CVE-2024-0439 | High | 8.8 | 2024-02-26 | As a manager, you should not be able to modify a series of settings. In the UI this is indeed hidden as a convenience for the role since most managers would no… |
CVE-2023-42952 | Medium | 4.4 | 2024-02-21 | The issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Ventura 13.6.3, macOS Sonoma 14.1, macOS Monterey 12.7.1… |
CVE-2024-22235 | Medium | 6.7 | 2024-02-21 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privi… |
CVE-2024-21892 | High | 7.8 | 2024-02-20 | On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privilege… |
CVE-2023-40106 | High | 7.8 | 2024-02-15 | In sanitizeSbn of NotificationManagerService.java, there is a possible way to launch an activity from the background due to BAL Bypass. This could lead to loca… |
CVE-2024-0622 | High | 8.8 | 2024-02-15 | Local privilege escalation vulnerability affects OpenText Operations Agent product versions 12.15 and 12.20-12.25 when installed on Non-Windows platforms. The… |
CVE-2023-45581 | High | 8.8 | 2024-02-15 | An improper privilege management vulnerability [CWE-269] in Fortinet FortiClientEMS version 7.2.0 through 7.2.2 and before 7.0.10 allows an Site administrator… |
CVE-2024-0353 | High | 7.8 | 2024-02-15 | Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET’s file operations to delete files without having proper permission. |
CVE-2023-25535 | High | 7.2 | 2024-02-14 | Dell SupportAssist for Home PCs Installer Executable file version prior to 3.13.2.19 used for initial installation has a high vulnerability that can result in… |
CVE-2023-52431 | High | 8.8 | 2024-02-13 | The Plack::Middleware::XSRFBlock package before 0.0.19 for Perl allows attackers to bypass a CSRF protection mechanism via an empty form value and an empty coo… |
CVE-2024-25106 | Critical | 9.1 | 2024-02-08 | OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability h… |
CVE-2024-24830 | Critical | 9.9 | 2024-02-08 | OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been i… |
CVE-2023-47132 | Critical | 9.8 | 2024-02-08 | An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls. |
CVE-2024-23764 | Medium | 6.7 | 2024-02-08 | Certain WithSecure products allow Local Privilege Escalation. This affects WithSecure Client Security 15 and later, WithSecure Server Security 15 and later, Wi… |
CVE-2024-22795 | High | 7.0 | 2024-02-08 | Insecure Permissions vulnerability in Forescout SecureConnector v.11.3.06.0063 allows a local attacker to escalate privileges via the Recheck Compliance Status… |
CVE-2024-22239 | Medium | 5.3 | 2024-02-06 | Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for Networks may exploit this v… |
CVE-2024-22237 | High | 7.8 | 2024-02-06 | Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for Networks may exploit this v… |
CVE-2023-32451 | High | 7.3 | 2024-02-06 | Dell Display Manager application, version 2.1.1.17, contains a vulnerability that low privilege user can execute malicious code during installation and uninst… |
CVE-2023-28049 | Medium | 4.7 | 2024-02-06 | Dell Command | Monitor, versions prior to 10.9, contain an arbitrary folder deletion vulnerability. A locally authenticated malicious user may exploit this vu… |
CVE-2023-31005 | Medium | 6.2 | 2024-02-03 | IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10… |
CVE-2023-36496 | High | 7.7 | 2024-02-01 | Delegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory Server. |
CVE-2024-24747 | High | 8.8 | 2024-01-31 | MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but… |
CVE-2024-21888 | High | 8.8 | 2024-01-31 | A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privil… |
CVE-2024-0833 | High | 7.8 | 2024-01-31 | In Telerik Test Studio versions prior to v2023.3.1330, a privilege elevation vulnerability has been identified in the applications installer component. In a… |
CVE-2024-0832 | High | 7.8 | 2024-01-31 | In Telerik Reporting versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component. In an environ… |
CVE-2024-0219 | High | 7.8 | 2024-01-31 | In Telerik JustDecompile versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component. In an env… |
CVE-2024-0674 | Medium | 6.3 | 2024-01-30 | Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, which could allow a local user to acquire root permissions by mod… |
CVE-2024-21985 | High | 7.6 | 2024-01-26 | ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 and 9.13.1P4 are susceptible to a vulnerability which could allow an authenticated user w… |
CVE-2024-23620 | High | 8.8 | 2024-01-26 | An improper privilege management vulnerability exists in IBM Merge Healthcare eFilm Workstation. A local, authenticated attacker can exploit this vulnerability… |
CVE-2024-22922 | Critical | 9.8 | 2024-01-25 | An issue in Projectworlds Vistor Management Systemin PHP v.1.0 allows a remtoe attacker to escalate privileges via a crafted script to the login page in the PO… |
CVE-2023-43317 | High | 8.8 | 2024-01-24 | An issue in Coign CRM Portal v.06.06 allows a remote attacker to escalate privileges via the userPermissionsList parameter in Session Storage component. |
CVE-2023-52337 | High | 7.8 | 2024-01-23 | An improper access control vulnerability in Trend Micro Deep Security 20.0 and Trend Micro Cloud One - Endpoint and Workload Security Agent could allow a local… |
CVE-2023-52093 | High | 7.8 | 2024-01-23 | An exposed dangerous function vulnerability in the Trend Micro Apex One agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2023-47201 | High | 7.8 | 2024-01-23 | A plug-in manager origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected in… |
CVE-2024-0751 | High | 8.8 | 2024-01-23 | A malicious devtools extension could have been used to escalate privileges. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 11… |
CVE-2023-52105 | High | 7.5 | 2024-01-16 | The nearby module has a privilege escalation vulnerability. Successful exploitation of this vulnerability may affect availability. |
CVE-2023-52116 | High | 7.5 | 2024-01-16 | Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerability may cause service exceptions of the d… |
CVE-2023-52114 | High | 7.5 | 2024-01-16 | Data confidentiality vulnerability in the ScreenReader module. Successful exploitation of this vulnerability may affect service integrity. |
CVE-2023-52107 | High | 7.5 | 2024-01-16 | Vulnerability of permissions being not strictly verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-6740 | High | 8.8 | 2024-01-12 | Privilege escalation in jar_signature agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges |
CVE-2023-6735 | High | 8.8 | 2024-01-12 | Privilege escalation in mk_tsm agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges |
CVE-2024-21638 | Critical | 9.1 | 2024-01-10 | Azure IPAM (IP Address Management) is a lightweight solution developed on top of the Azure platform designed to help Azure customers manage their IP Address sp… |
CVE-2022-32931 | Medium | 5.5 | 2024-01-10 | This issue was addressed with improved data protection. This issue is fixed in macOS Ventura 13. An app with root privileges may be able to access private info… |
CVE-2023-44250 | High | 8.8 | 2024-01-10 | An improper privilege management vulnerability [CWE-269] in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a FortiProxy HA cluster… |
CVE-2023-47145 | High | 8.4 | 2024-01-07 | IBM Db2 for Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow a local user to escalate their privileges to the SYSTEM user using the MSI r… |
CVE-2023-41784 | Medium | 6.6 | 2024-01-04 | Permissions and Access Control Vulnerability in ZTE Red Magic 8 Pro |
CVE-2024-21622 | Medium | 5.4 | 2024-01-03 | Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to… |
CVE-2023-30617 | Medium | 6.5 | 2024-01-03 | Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1, and 1.5.2, an att… |
CVE-2023-50921 | Critical | 9.8 | 2024-01-03 | An issue was discovered on GL.iNet devices through 4.5.0. Attackers can invoke the add_user interface in the system module to gain root privileges. This affect… |
CVE-2023-41776 | Medium | 6.7 | 2024-01-03 | There is a local privilege escalation vulnerability of ZTE's ZXCLOUD iRAI.Attackers with regular user privileges can create a fake process, and to escalate loc… |
CVE-2023-48418 | Critical | 10.0 | 2024-01-02 | In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecure default value… |
CVE-2023-48419 | Critical | 10.0 | 2024-01-02 | An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in Elevation of Privilege |
CVE-2023-7080 | High | 8.5 | 2023-12-29 | The V8 inspector intentionally allows arbitrary code execution within the Workers sandbox for debugging. wrangler dev would previously start an inspector serve… |
CVE-2023-51435 | High | 7.1 | 2023-12-29 | Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak. |
CVE-2023-51433 | Low | 2.9 | 2023-12-29 | Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak. |
CVE-2023-51430 | Medium | 4.4 | 2023-12-29 | Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak. |
CVE-2023-51429 | Medium | 6.0 | 2023-12-29 | Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak. |
CVE-2023-23438 | Medium | 4.0 | 2023-12-29 | Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions |
CVE-2023-23430 | Low | 3.3 | 2023-12-29 | Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions. |
CVE-2023-23429 | Medium | 4.0 | 2023-12-29 | Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions. |
CVE-2023-23428 | Low | 3.3 | 2023-12-29 | Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions. |
CVE-2023-23427 | Medium | 4.0 | 2023-12-29 | Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions. |
CVE-2023-50267 | Medium | 4.3 | 2023-12-28 | MeterSphere is a one-stop open source continuous testing platform. Prior to 2.10.10-lts, the authenticated attackers can update resources which don't belong to… |
CVE-2023-7090 | Medium | 6.6 | 2023-12-23 | A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privil… |
CVE-2023-51386 | High | 7.8 | 2023-12-22 | Sandbox Accounts for Events provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated… |
CVE-2023-6804 | Medium | 6.5 | 2023-12-21 | Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped PAT. To exploit this, a workflow must have already… |
CVE-2023-46647 | High | 8.0 | 2023-12-21 | Improper privilege management in all versions of GitHub Enterprise Server allows users with authorized access to the management console with an editor role to… |
CVE-2023-47267 | Critical | 9.8 | 2023-12-19 | An issue discovered in TheGreenBow Windows Enterprise Certified VPN Client 6.52, Windows Standard VPN Client 6.87, and Windows Enterprise VPN Client 6.87 allow… |
CVE-2023-6793 | Low | 2.7 | 2023-12-13 | An improper privilege management vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to revoke active XML API… |
CVE-2020-12615 | High | 7.8 | 2023-12-12 | An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. When adding the Add Admin token to a process, and specifying that it runs… |
CVE-2023-41119 | High | 8.8 | 2023-12-12 | An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15… |
CVE-2023-6507 | Medium | 6.1 | 2023-12-08 | An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. … |
CVE-2023-48406 | Medium | 6.7 | 2023-12-08 | there is a possible permanent DoS or way for the modem to boot unverified firmware due to a logic error in the code. This could lead to local escalation of pri… |
CVE-2023-45083 | Medium | 4.2 | 2023-12-05 | An Improper Privilege Management vulnerability exists in HyperCloud that will impact the ability for a user to authenticate against the management plane. An a… |
CVE-2023-45253 | High | 7.8 | 2023-12-01 | An issue was discovered in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, allows attackers to manipulate files and escalate privi… |
CVE-2023-6218 | High | 7.2 | 2023-11-29 | In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path associated with gr… |
CVE-2023-29066 | Low | 3.2 | 2023-11-28 | The FACSChorus software does not properly assign data access privileges for operating system user accounts. A non-administrative OS account can modify informat… |
CVE-2023-5960 | Medium | 5.5 | 2023-11-28 | An improper privilege management vulnerability in the hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.37 and VPN series firmware… |
CVE-2023-5797 | Medium | 5.5 | 2023-11-28 | An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware v… |
CVE-2023-5650 | Medium | 5.5 | 2023-11-28 | An improper privilege management vulnerability in the ZySH of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50… |
CVE-2023-37925 | Medium | 5.5 | 2023-11-28 | An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware v… |
CVE-2023-41808 | High | 8.5 | 2023-11-23 | Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability allows an unauthorised user to escalate and r… |
CVE-2023-41807 | Critical | 9.1 | 2023-11-23 | Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability allows a user to escalate permissions on the… |
CVE-2023-41806 | High | 8.2 | 2023-11-23 | Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability causes that a bad privilege assignment could… |
CVE-2021-37942 | High | 7.0 | 2023-11-22 | A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running the… |
CVE-2021-37937 | Medium | 5.9 | 2023-11-22 | An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that… |
CVE-2023-20274 | Medium | 6.3 | 2023-11-21 | A vulnerability in the installer script of Cisco AppDynamics PHP Agent could allow an authenticated, local attacker to elevate privileges on an affected device… |
CVE-2023-6119 | Medium | 6.5 | 2023-11-16 | An Improper Privilege Management vulnerability in Trellix GetSusp prior to version 5.0.0.27 allows a local, low privilege attacker to gain access to files tha… |
CVE-2023-44292 | Medium | 6.7 | 2023-11-16 | Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module. A local low-privileged attacker could… |
CVE-2023-44282 | Medium | 6.7 | 2023-11-16 | Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module. A local low-privileged attacker could… |
CVE-2023-39335 | Critical | 9.8 | 2023-11-15 | A security vulnerability has been identified in EPMM Versions 11.10, 11.9 and 11.8 and older allowing an unauthenticated threat actor to impersonate any existi… |
CVE-2023-31273 | Critical | 10.0 | 2023-11-14 | Protection mechanism failure in some Intel DCM software before version 5.2 may allow an unauthenticated user to potentially enable escalation of privilege via… |
CVE-2023-28737 | High | 8.8 | 2023-11-14 | Improper initialization in some Intel(R) Aptio* V UEFI Firmware Integrator Tools may allow an authenticated user to potentially enable escalation of privilege… |
CVE-2023-20565 | High | 7.8 | 2023-11-14 | Insufficient protections in System Management Mode (SMM) code may allow an attacker to potentially enable escalation of privilege via local access. |