CWE-269 · Improper Privilege Management (page 16)
Page 16 of 32 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-20563 | High | 7.8 | 2023-11-14 | Insufficient protections in System Management Mode (SMM) code may allow an attacker to potentially enable escalation of privilege via local access. |
CVE-2022-41700 | Medium | 6.7 | 2023-11-14 | Insecure inherited permissions in some Intel(R) NUC Pro Software Suite installation software before version 2.0.0.9 may allow an authenticated user to potentia… |
CVE-2023-47629 | High | 7.1 | 2023-11-14 | DataHub is an open-source metadata platform. In affected versions sign-up through an invite link does not properly restrict users from signing up as privileged… |
CVE-2023-6099 | High | 7.3 | 2023-11-13 | A vulnerability classified as critical has been found in Shenzhen Youkate Industrial Facial Love Cloud Payment System up to 1.0.55.0.0.1. This affects an unkno… |
CVE-2023-47611 | High | 7.8 | 2023-11-10 | A CWE-269: Improper Privilege Management vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS6… |
CVE-2023-36024 | High | 7.1 | 2023-11-10 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2023-5549 | Low | 3.3 | 2023-11-09 | Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capa… |
CVE-2023-41138 | High | 7.5 | 2023-11-09 | The AppsAnywhere macOS client-privileged helper can be tricked into executing arbitrary commands with elevated permissions by a local user process. |
CVE-2023-46758 | High | 7.5 | 2023-11-08 | Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerability may cause service exceptions of the d… |
CVE-2023-46756 | Medium | 5.3 | 2023-11-08 | Permission control vulnerability in the window management module. Successful exploitation of this vulnerability may cause malicious pop-up windows. |
CVE-2023-5978 | High | 7.5 | 2023-11-08 | In versions of FreeBSD 13-RELEASE before 13-RELEASE-p5, under certain circumstances the cap_net libcasper(3) service incorrectly validates that updated constra… |
CVE-2023-46771 | High | 7.5 | 2023-11-08 | Security vulnerability in the face unlock module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-35140 | Medium | 5.5 | 2023-11-07 | The improper privilege management vulnerability in the Zyxel GS1900-24EP switch firmware version V2.70(ABTO.5) could allow an authenticated local user with rea… |
CVE-2023-41036 | High | 7.8 | 2023-11-07 | Macvim is a text editor for MacOS. Prior to version 178, Macvim makes use of an insecure interprocess communication (IPC) mechanism which could lead to a privi… |
CVE-2023-43018 | Medium | 5.9 | 2023-11-03 | IBM CICS TX Standard 11.1 and Advanced 10.1, 11.1 performs an operation at a privilege level that is higher than the minimum level required, which creates new… |
CVE-2023-5408 | High | 7.2 | 2023-11-02 | A privilege escalation flaw was found in the node restriction admission plugin of the kubernetes api server of OpenShift. A remote attacker who modifies the no… |
CVE-2023-20048 | Critical | 9.9 | 2023-11-01 | A vulnerability in the web services interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute cert… |
CVE-2023-5847 | Medium | 6.7 | 2023-11-01 | Under certain conditions, a low privileged attacker could load a specially crafted file during installation or upgrade to escalate privileges on Windows and L… |
CVE-2023-5739 | High | 7.8 | 2023-10-31 | Certain versions of HP PC Hardware Diagnostics Windows are potentially vulnerable to elevation of privilege. |
CVE-2023-47101 | High | 7.8 | 2023-10-30 | The installer (aka openvpn-client-installer) in Securepoint SSL VPN Client before 2.0.40 allows local privilege escalation during installation or repair. |
CVE-2023-21397 | High | 7.8 | 2023-10-30 | In Setup Wizard, there is a possible way to save a WiFi network due to an insecure default value. This could lead to local escalation of privilege with no addi… |
CVE-2023-21396 | High | 7.8 | 2023-10-30 | In Activity Manager, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with Use… |
CVE-2023-21376 | Medium | 5.5 | 2023-10-30 | In Telephony, there is a possible way to retrieve the ICCID due to a logic error in the code. This could lead to local information disclosure with no additiona… |
CVE-2023-21374 | High | 7.8 | 2023-10-30 | In System UI, there is a possible factory reset protection bypass due to a logic error in the code. This could lead to local escalation of privilege with no ad… |
CVE-2023-21343 | High | 7.8 | 2023-10-30 | In ActivityStarter, there is a possible background activity launch due to an unsafe PendingIntent. This could lead to local escalation of privilege with no add… |
CVE-2023-40685 | High | 7.4 | 2023-10-29 | Management Central as part of IBM i 7.2, 7.3, 7.4, and 7.5 Navigator contains a local privilege escalation vulnerability. A malicious actor with command line… |
CVE-2023-40686 | Medium | 4.9 | 2023-10-29 | Management Central as part of IBM i 7.2, 7.3, 7.4, and 7.5 Navigator contains a local privilege escalation vulnerability. A malicious actor with command line… |
CVE-2022-3701 | High | 7.8 | 2023-10-27 | A privilege elevation vulnerability was reported in the Lenovo Vantage SystemUpdate plugin version 2.0.0.212 and earlier that could allow a local attacker to… |
CVE-2023-44219 | High | 7.8 | 2023-10-27 | A local privilege escalation vulnerability in SonicWall Directory Services Connector Windows MSI client 4.1.21 and earlier versions allows a local low-privileg… |
CVE-2023-34057 | High | 7.8 | 2023-10-27 | VMware Tools contains a local privilege escalation vulnerability. A malicious actor with local user access to a guest virtual machine may elevate privileges wi… |
CVE-2023-5622 | High | 7.1 | 2023-10-26 | Under certain conditions, Nessus Network Monitor could allow a low privileged user to escalate privileges to NT AUTHORITY\SYSTEM on Windows hosts by replacing… |
CVE-2023-41966 | Medium | 6.5 | 2023-10-26 | The application suffers from a privilege escalation vulnerability. A user with read permissions can elevate privileges by sending a HTTP POST to set a par… |
CVE-2023-5671 | High | 7.8 | 2023-10-25 | HP Print and Scan Doctor for Windows may potentially be vulnerable to escalation of privilege. HP is releasing software updates to mitigate the potential vulne… |
CVE-2023-4607 | High | 7.5 | 2023-10-25 | An authenticated XCC user can change permissions for any user through a crafted API command. |
CVE-2023-43506 | High | 7.8 | 2023-10-25 | A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges to those of a higher role… |
CVE-2023-39740 | High | 8.2 | 2023-10-25 | The leakage of the client secret in Onigiriya-musubee Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39734 | High | 8.2 | 2023-10-25 | The leakage of the client secret in VISION MEAT WORKS TrackDiner10/10_mc Line v13.6.1 allows attackers to obtain the channel access token and send crafted broa… |
CVE-2023-39733 | High | 8.2 | 2023-10-25 | The leakage of the client secret in TonTon-Tei Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39732 | High | 8.2 | 2023-10-25 | The leakage of the client secret in Tokueimaru_waiting Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2021-26734 | Medium | 4.4 | 2023-10-23 | Zscaler Client Connector Installer on Windows before version 3.4.0.124 improperly handled directory junctions during uninstallation. A local adversary may be a… |
CVE-2023-34045 | Medium | 6.6 | 2023-10-20 | VMware Fusion(13.x prior to 13.5) contains a local privilege escalation vulnerability that occurs during installation for the first time (the user needs to dr… |
CVE-2023-46277 | High | 7.8 | 2023-10-20 | please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this ca… |
CVE-2023-27795 | High | 7.8 | 2023-10-19 | An issue found in IXP Data Easy Install v.6.6.14884.0 allows a local attacker to gain privileges via a static XOR key. |
CVE-2023-27793 | High | 7.8 | 2023-10-19 | An issue discovered in IXP Data Easy Install v.6.6.14884.0 allows local attackers to gain escalated privileges via weak encoding of sensitive information. |
CVE-2023-45883 | High | 7.8 | 2023-10-19 | A privilege escalation vulnerability exists within the Qumu Multicast Extension v2 before 2.0.63 for Windows. When a standard user triggers a repair of the sof… |
CVE-2023-41715 | High | 8.8 | 2023-10-17 | SonicOS post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunnel allows users to elevate their privileges inside the tunne… |
CVE-2023-22099 | High | 8.2 | 2023-10-17 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.12. Easily… |
CVE-2023-20598 | High | 7.8 | 2023-10-17 | An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOCTL request to gain I/O control over a… |
CVE-2023-43120 | High | 8.8 | 2023-10-16 | An issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, before 22.7 and before 31.7.1 allows attackers to gain escalated privileges via c… |
CVE-2023-4834 | Medium | 4.3 | 2023-10-16 | In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an improperly implemented access validatio… |
CVE-2023-4822 | Medium | 6.7 | 2023-10-16 | Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user… |
CVE-2023-44809 | Critical | 9.8 | 2023-10-16 | D-Link device DIR-820L 1.05B03 is vulnerable to Insecure Permissions. |
CVE-2023-38280 | High | 8.4 | 2023-10-16 | IBM HMC (Hardware Management Console) 10.1.1010.0 and 10.2.1030.0 could allow a local user to escalate their privileges to root access on a restricted shell… |
CVE-2023-40377 | Medium | 4.9 | 2023-10-16 | Backup, Recovery, and Media Services (BRMS) for IBM i 7.2, 7.3, and 7.4 contains a local privilege escalation vulnerability. A malicious actor with command li… |
CVE-2023-40378 | Medium | 4.9 | 2023-10-15 | IBM Directory Server for IBM i contains a local privilege escalation vulnerability. A malicious actor with command line access to the host operating system ca… |
CVE-2023-27316 | High | 8.8 | 2023-10-12 | SnapCenter versions 4.8 through 4.9 are susceptible to a vulnerability which may allow an authenticated SnapCenter Server user to become an admin user on a r… |
CVE-2023-38817 | High | 7.8 | 2023-10-11 | An issue in Inspect Element Ltd Echo.ac v.5.2.1.0 allows a local attacker to gain privileges via a crafted command to the echo_driver.sys component. NOTE: the… |
CVE-2023-43960 | High | 8.8 | 2023-10-11 | An issue in DLINK DPH-400SE FRU 2.2.15.8 allows a remote attacker to escalate privileges via the User Modify function in the Maintenance/Access function compon… |
CVE-2023-4936 | Medium | 5.5 | 2023-10-11 | It is possible to sideload a compromised DLL during the installation at elevated privilege. |
CVE-2023-44105 | Critical | 9.8 | 2023-10-11 | Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this vulnerability may cause features to pe… |
CVE-2023-44106 | Critical | 9.8 | 2023-10-11 | API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2023-36721 | High | 7.0 | 2023-10-10 | Windows Error Reporting Service Elevation of Privilege Vulnerability |
CVE-2023-36569 | High | 8.4 | 2023-10-10 | Microsoft Office Elevation of Privilege Vulnerability |
CVE-2023-5214 | Medium | 6.5 | 2023-10-06 | In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified. |
CVE-2023-26236 | High | 7.8 | 2023-10-05 | An issue was discovered in WatchGuard EPDR 8.0.21.0002. Due to a weak implementation of message handling between WatchGuard EPDR processes, it is possible to p… |
CVE-2023-5402 | Critical | 9.8 | 2023-10-04 | A CWE-269: Improper Privilege Management vulnerability exists that could cause a remote code execution when the transfer command is used over the network. |
CVE-2023-20235 | Medium | 6.5 | 2023-10-04 | A vulnerability in the on-device application development workflow feature for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could a… |
CVE-2023-44217 | High | 7.8 | 2023-10-03 | A local privilege escalation vulnerability in SonicWall Net Extender MSI client for Windows 10.2.336 and earlier versions allows a local low-privileged user t… |
CVE-2023-36628 | High | 8.8 | 2023-10-03 | A flaw exists in VASA which allows users with access to a vSphere/ESXi VMware admin on a FlashArray to gain root access through privilege escalation. |
CVE-2023-43664 | Medium | 4.3 | 2023-09-28 | PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list all modules without any access rights: m… |
CVE-2023-43663 | Medium | 6.3 | 2023-09-28 | PrestaShop is an Open Source e-commerce web application. In affected versions any module can be disabled or uninstalled from back office, even with low user ri… |
CVE-2023-40375 | High | 7.4 | 2023-09-28 | Integrated application server for IBM i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability. A malicious actor with command line access… |
CVE-2023-33972 | High | 7.2 | 2023-09-27 | Scylladb is a NoSQL data store using the seastar framework, compatible with Apache Cassandra. Authenticated users who are authorized to create tables in a keys… |
CVE-2023-41326 | High | 8.1 | 2023-09-27 | GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses… |
CVE-2023-41324 | High | 8.1 | 2023-09-27 | GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses… |
CVE-2023-41322 | Medium | 4.9 | 2023-09-27 | GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses… |
CVE-2023-41312 | Medium | 5.3 | 2023-09-27 | Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause several apps to be activated automatically. |
CVE-2023-41309 | High | 7.5 | 2023-09-27 | Permission control vulnerability in the MediaPlaybackController module. Successful exploitation of this vulnerability may affect availability. |
CVE-2023-39375 | High | 7.5 | 2023-09-27 | SiberianCMS - CWE-274: Improper Handling of Insufficient Privileges |
CVE-2023-34043 | Medium | 6.7 | 2023-09-27 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privi… |
CVE-2023-43457 | Critical | 9.8 | 2023-09-25 | An issue in Service Provider Management System v.1.0 allows a remote attacker to gain privileges via the ID parameter in the /php-spms/admin/?page=user/ endpoi… |
CVE-2023-41301 | High | 7.5 | 2023-09-25 | Vulnerability of unauthorized API access in the PMS module. Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2023-43766 | High | 7.8 | 2023-09-22 | Certain WithSecure products allow Local privilege escalation via the lhz archive unpack handler. This affects WithSecure Client Security 15, WithSecure Server… |
CVE-2023-4662 | Critical | 9.8 | 2023-09-15 | Execution with Unnecessary Privileges vulnerability in Saphira Saphira Connect allows Remote Code Inclusion. This issue affects Saphira Connect: before 9. |
CVE-2023-36657 | Critical | 9.8 | 2023-09-15 | An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Built-in features of Windows (desktop shortcuts, narrator) can be abused for privilege escalat… |
CVE-2023-42468 | Medium | 5.3 | 2023-09-13 | The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of improp… |
CVE-2023-36765 | High | 7.8 | 2023-09-12 | Microsoft Office Elevation of Privilege Vulnerability |
CVE-2023-35676 | High | 7.8 | 2023-09-11 | In createQuickShareAction of SaveImageInBackgroundTask.java, there is a possible way to trigger a background activity launch due to an unsafe PendingIntent. Th… |
CVE-2023-35674 | High | 7.8 | 2023-09-11 | In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation… |
CVE-2023-35671 | Medium | 5.5 | 2023-09-11 | In onHostEmulationData of HostEmulationManager.java, there is a possible way for a general purpose NFC reader to read the full card number and expiry details w… |
CVE-2023-35667 | High | 7.8 | 2023-09-11 | In updateList of NotificationAccessSettings.java, there is a possible way to hide approved notification listeners in the settings due to a logic error in the c… |
CVE-2023-20194 | Medium | 4.9 | 2023-09-07 | A vulnerability in the ERS API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affe… |
CVE-2023-20193 | Medium | 6.0 | 2023-09-07 | A vulnerability in the Embedded Service Router (ESR) of Cisco ISE could allow an authenticated, local attacker to read, write, or delete arbitrary files on the… |
CVE-2023-41053 | Low | 3.3 | 2023-09-06 | Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant users executing th… |
CVE-2020-10129 | High | 8.8 | 2023-09-06 | SearchBlox before Version 9.2.1 is vulnerable to Privileged Escalation-Lower user is able to access Admin functionality. |
CVE-2023-30713 | Medium | 6.2 | 2023-09-06 | Improper privilege management vulnerability in FolderLockNotifier in One UI Home prior to SMR Sep-2023 Release 1 allows local attackers to change some settings… |
CVE-2023-32426 | High | 7.8 | 2023-09-06 | A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3. An app may be able to gain root privileges. |
CVE-2023-29166 | High | 8.8 | 2023-09-06 | A logic issue was addressed with improved state management. This issue is fixed in Pro Video Formats 2.2.5. A user may be able to elevate privileges. |
CVE-2020-35593 | High | 7.8 | 2023-09-05 | BMC PATROL Agent through 20.08.00 allows local privilege escalation via vectors involving pconfig +RESTART -host. |
CVE-2023-40918 | High | 8.8 | 2023-09-05 | KnowStreaming 3.3.0 is vulnerable to Escalation of Privileges. Unauthorized users can create a new user with an admin role. |