CWE-269 · Improper Privilege Management (page 17)
Page 17 of 32 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-36100 | Critical | 9.8 | 2023-09-01 | An issue was discovered in IceCMS version 2.0.1, allows attackers to escalate privileges and gain sensitive information via UserID parameter in api/User/Change… |
CVE-2023-4697 | High | 8.8 | 2023-09-01 | Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2. |
CVE-2023-41743 | High | 7.8 | 2023-08-31 | Local privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber Protect Home Office (Windo… |
CVE-2023-31175 | High | 8.8 | 2023-08-31 | An Execution with Unnecessary Privileges vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to ru… |
CVE-2022-45451 | High | 7.8 | 2023-08-31 | Local privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber Protect Home Office (Windo… |
CVE-2023-3636 | High | 8.8 | 2023-08-31 | The WP Project Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.6.4 due to insufficient restriction on th… |
CVE-2023-20266 | Medium | 6.5 | 2023-08-30 | A vulnerability in Cisco Emergency Responder, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Editio… |
CVE-2023-32457 | High | 7.5 | 2023-08-29 | Dell PowerScale OneFS, versions 8.2.2.x-9.5.0.x, contains an improper privilege management vulnerability. A remote attacker with low privileges could potentia… |
CVE-2019-13690 | Critical | 9.6 | 2023-08-25 | Inappropriate implementation in OS in Google Chrome on ChromeOS prior to 75.0.3770.80 allowed a remote attacker to perform OS-level privilege escalation via a… |
CVE-2023-32559 | High | 7.5 | 2023-08-24 | A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated A… |
CVE-2023-4404 | Critical | 9.8 | 2023-08-23 | The Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.7.0.12 due to insufficient rest… |
CVE-2023-38734 | Medium | 6.6 | 2023-08-22 | IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an… |
CVE-2023-3699 | High | 8.7 | 2023-08-22 | An Improper Privilege Management vulnerability was found in ASUSTOR Data Master (ADM) allows an unprivileged local users to modify the storage devices configur… |
CVE-2021-35309 | High | 7.5 | 2023-08-22 | An issue discovered in Samsung SyncThru Web Service SPL 5.93 06-09-2014 allows attackers to gain escalated privileges via MITM attacks. |
CVE-2023-25647 | Medium | 4.7 | 2023-08-17 | There is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile phone could monitor… |
CVE-2023-32490 | Medium | 6.7 | 2023-08-16 | Dell PowerScale OneFS 8.2x -9.5x contains an improper privilege management vulnerability. A high privilege local attacker could potentially exploit this vulne… |
CVE-2023-32487 | High | 7.8 | 2023-08-16 | Dell PowerScale OneFS, 8.2.x - 9.5.0.x, contains an elevation of privilege vulnerability. A low privileged local attacker could potentially exploit this vulne… |
CVE-2023-21272 | High | 7.8 | 2023-08-14 | In readFrom of Uri.java, there is a possible bad URI permission grant due to improper input validation. This could lead to local escalation of privilege with n… |
CVE-2023-21269 | High | 7.8 | 2023-08-14 | In startActivityInner of ActivityStarter.java, there is a possible way to launch an activity into PiP mode from the background due to BAL bypass. This could le… |
CVE-2023-38721 | High | 8.4 | 2023-08-14 | The IBM i 7.2, 7.3, 7.4, and 7.5 product Facsimile Support for i contains a local privilege escalation vulnerability. A malicious actor could gain access to… |
CVE-2023-0872 | High | 8.2 | 2023-08-14 | The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of p… |
CVE-2023-3160 | High | 7.8 | 2023-08-14 | The vulnerability potentially allows an attacker to misuse ESET’s file operations during the module update to delete or move files without having proper permi… |
CVE-2023-4293 | High | 8.8 | 2023-08-12 | The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.4 due to… |
CVE-2021-28411 | Critical | 9.8 | 2023-08-11 | An issue was discovered in getRememberedSerializedIdentity function in CookieRememberMeManager class in lerry903 RuoYi version 3.4.0, allows remote attackers t… |
CVE-2023-30680 | High | 8.4 | 2023-08-10 | Improper privilege management vulnerability in MMIGroup prior to SMR Aug-2023 Release 1 allows code execution with privilege. |
CVE-2023-37859 | High | 7.2 | 2023-08-09 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 the SNMP daemon is running with root privileges allowing a remote attacker with knowl… |
CVE-2023-4239 | High | 8.8 | 2023-08-09 | The Real Estate Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.2 due to insufficient restriction on the… |
CVE-2023-39211 | High | 8.8 | 2023-08-08 | Improper privilege management in Zoom Desktop Client for Windows and Zoom Rooms for Windows before 5.15.5 may allow an authenticated user to enable an informat… |
CVE-2023-4009 | High | 7.2 | 2023-08-08 | In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access t… |
CVE-2023-39520 | Medium | 5.5 | 2023-08-07 | Cryptomator encrypts data being stored on cloud infrastructure. The MSI installer provided on the homepage for Cryptomator version 1.9.2 allows local privilege… |
CVE-2023-4140 | Medium | 6.6 | 2023-08-04 | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.9.8 due to insufficient restriction… |
CVE-2023-20216 | Medium | 4.4 | 2023-08-03 | A vulnerability in the privilege management functionality of all Cisco BroadWorks server types could allow an authenticated, local attacker to elevate privileg… |
CVE-2023-31432 | High | 7.8 | 2023-08-02 | Through manipulation of passwords or other variables, using commands such as portcfgupload, configupload, license, myid, a non-privileged user could obtain roo… |
CVE-2023-38496 | Medium | 6.1 | 2023-07-25 | Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, therefore… |
CVE-2023-37907 | High | 7.0 | 2023-07-25 | Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows… |
CVE-2023-38058 | Medium | 4.1 | 2023-07-24 | An improper privilege check in the OTRS ticket move action in the agent interface allows any as agent authenticated attacker to to perform a move of an tick… |
CVE-2023-37917 | Critical | 9.1 | 2023-07-21 | KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing the `isadmin` value… |
CVE-2023-38187 | Medium | 6.5 | 2023-07-21 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2023-3467 | High | 8.0 | 2023-07-19 | Privilege Escalation to root administrator (nsroot) |
CVE-2023-30799 | Critical | 9.1 | 2023-07-19 | MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. A remote and authenticated attacker can esc… |
CVE-2023-22023 | High | 7.8 | 2023-07-18 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Device Driver Interface). The supported version that is affected is 11. Easily expl… |
CVE-2023-30989 | High | 8.4 | 2023-07-16 | IBM Performance Tools for i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability. A malicious actor with command line access to the host… |
CVE-2023-30988 | High | 8.4 | 2023-07-16 | The IBM i 7.2, 7.3, 7.4, and 7.5 product Facsimile Support for i contains a local privilege escalation vulnerability. A malicious actor with command line acce… |
CVE-2023-3514 | High | 7.8 | 2023-07-14 | Improper Privilege Control in RazerCentralSerivce Named Pipe in Razer RazerCentral <=7.11.0.558 on Windows allows a malicious actor with local access to gain S… |
CVE-2023-3513 | High | 7.8 | 2023-07-14 | Improper Privilege Control in RazerCentralSerivce Named Pipe in Razer RazerCentral <=7.11.0.558 on Windows allows a malicious actor with local access to gain S… |
CVE-2023-24491 | High | 7.8 | 2023-07-11 | A vulnerability has been discovered in the Citrix Secure Access client for Windows which, if exploited, could allow an attacker with access to an endpoint… |
CVE-2023-30765 | High | 8.8 | 2023-07-10 | Delta Electronics InfraSuite Device Master versions prior to 1.0.7 contain improper access controls that could allow an attacker to alter privilege management… |
CVE-2023-29256 | Medium | 5.3 | 2023-07-10 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to an information disclosure due to improper privilege man… |
CVE-2023-27558 | High | 8.4 | 2023-07-10 | IBM Db2 on Windows 10.5, 11.1, and 11.5 may be vulnerable to a privilege escalation caused by at least one installed service using an unquoted service path… |
CVE-2021-42082 | High | 7.8 | 2023-07-10 | Local users are able to execute scripts under root privileges. POC On the local host run the following command: curl 'localhost:8154/qstor/qs_upgrade.py?tas… |
CVE-2022-48515 | High | 7.5 | 2023-07-06 | Vulnerability of inappropriate permission control in Nearby. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2021-46894 | Critical | 9.8 | 2023-07-06 | Use After Free (UAF) vulnerability in the uinput module.Successful exploitation of this vulnerability may lead to kernel privilege escalation. |
CVE-2023-30642 | Medium | 6.2 | 2023-07-06 | Improper privilege management vulnerability in Galaxy Themes Service prior to SMR Jul-2023 Release 1 allows local attackers to call privilege function. |
CVE-2023-25521 | High | 7.5 | 2023-07-04 | NVIDIA DGX A100/A800 contains a vulnerability in SBIOS where an attacker may cause execution with unnecessary privileges by leveraging a weakness whereby… |
CVE-2023-21513 | Medium | 6.1 | 2023-06-28 | Improper privilege management vulnerability in CC Mode prior to SMR Jun-2023 Release 1 allows physical attackers to manipulate device to operate in way that re… |
CVE-2023-21512 | Low | 2.4 | 2023-06-28 | Improper Knox ID validation logic in notification framework prior to SMR Jun-2023 Release 1 allows local attackers to read work profile notifications without p… |
CVE-2021-31937 | High | 8.2 | 2023-06-28 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2023-20136 | Medium | 4.3 | 2023-06-28 | A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote attacker with the privileges of a read-only user to execute operat… |
CVE-2023-34148 | High | 7.8 | 2023-06-26 | An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privi… |
CVE-2023-34147 | High | 7.8 | 2023-06-26 | An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privi… |
CVE-2023-34146 | High | 7.8 | 2023-06-26 | An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privi… |
CVE-2023-34465 | Critical | 9.9 | 2023-06-23 | XWiki Platform is a generic wiki platform. Starting in version 11.8-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.2, `Mail.MailConfig` can be edited by an… |
CVE-2023-31469 | High | 8.8 | 2023-06-23 | A REST interface in Apache StreamPipes (versions 0.69.0 to 0.91.0) was not properly restricted to admin-only access. This allowed a non-admin user with valid… |
CVE-2023-25188 | Medium | 5.1 | 2023-06-16 | An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. If/when CSP (as a BTS administrator) removes security hardenings from the Nokia… |
CVE-2023-25185 | Low | 3.8 | 2023-06-16 | An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. A mobile network solution internal fault was found in Nokia Single RAN software… |
CVE-2023-2847 | High | 7.8 | 2023-06-15 | During internal security analysis, a local privilege escalation vulnerability has been identified. On a machine with the affected ESET product installed, it w… |
CVE-2023-26062 | High | 7.0 | 2023-06-14 | A mobile network solution internal fault is found in Nokia Web Element Manager before 22 R1, in which an authenticated, unprivileged user can execute administr… |
CVE-2019-25151 | Medium | 5.4 | 2023-06-07 | The Funnel Builder plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the activate_plugin function in versions up… |
CVE-2023-2833 | High | 8.8 | 2023-06-06 | The ReviewX plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.13 due to insufficient restriction on the 'rx_set_… |
CVE-2023-3027 | High | 7.8 | 2023-06-05 | The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain some dynamically obtained values (instead… |
CVE-2023-32713 | High | 7.8 | 2023-06-01 | In Splunk App for Stream versions below 8.1.1, a low-privileged user could use a vulnerability in the streamfwd process within the Splunk App for Stream to esc… |
CVE-2023-33966 | High | 8.6 | 2023-05-31 | Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in `node:http` or `node:h… |
CVE-2023-29734 | Critical | 9.8 | 2023-05-30 | An issue found in edjing Mix v.7.09.01 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the database. |
CVE-2023-32696 | High | 8.8 | 2023-05-30 | CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.1, the `ckan` user (equivalent to www-d… |
CVE-2022-45853 | Medium | 6.7 | 2023-05-30 | The privilege escalation vulnerability in the Zyxel GS1900-8 firmware version V2.70(AAHH.3) and the GS1900-8HP firmware version V2.70(AAHI.3) could allow an… |
CVE-2023-30601 | High | 7.8 | 2023-05-30 | Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue affects… |
CVE-2023-31062 | Critical | 9.8 | 2023-05-22 | Improper Privilege Management Vulnerabilities in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. When the… |
CVE-2023-1694 | High | 7.5 | 2023-05-20 | The Settings module has the file privilege escalation vulnerability.Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2023-1693 | High | 7.5 | 2023-05-20 | The Settings module has the file privilege escalation vulnerability.Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2022-45452 | High | 7.8 | 2023-05-18 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Agent (Windows) before build 30430, Acronis Cyber P… |
CVE-2023-2679 | Medium | 4.1 | 2023-05-17 | Data leakage in Adobe connector in Snow Software SPE 9.27.0 on Windows allows privileged user to observe other users data. |
CVE-2023-29819 | Medium | 5.5 | 2023-05-12 | An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to bypass protections via a crafted payload. |
CVE-2023-25834 | Medium | 5.4 | 2023-05-09 | Changes to user permissions in Portal for ArcGIS 10.9.1 and below are incompletely applied in specific use cases. This issue may allow users to access content… |
CVE-2020-23362 | High | 7.1 | 2023-05-09 | Insecure Permissons vulnerability found in Shop_CMS YerShop all versions allows a remote attacker to escalate privileges via the cover_id parameter. |
CVE-2023-29350 | High | 7.5 | 2023-05-05 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2023-22651 | Critical | 9.9 | 2023-05-04 | Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. A failure in the update logic of Rancher's admission Webhook may lead… |
CVE-2022-3405 | High | 8.8 | 2023-05-03 | Code execution and sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber P… |
CVE-2023-29056 | Medium | 5.3 | 2023-04-28 | A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to u… |
CVE-2023-1966 | High | 7.4 | 2023-04-28 | Instruments with Illumina Universal Copy Service v1.x and v2.x contain an unnecessary privileges vulnerability. An unauthenticated malicious actor could upload… |
CVE-2023-30024 | Medium | 6.6 | 2023-04-28 | The MagicJack device, a VoIP solution for internet phone calls, contains a hidden NAND flash memory partition allowing unauthorized read/write access. Attacker… |
CVE-2023-28261 | Medium | 5.7 | 2023-04-27 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2023-26246 | High | 7.8 | 2023-04-27 | An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUpgrade binary file, which is used during… |
CVE-2023-26245 | High | 7.8 | 2023-04-27 | An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUpgrade binary file, which is used during… |
CVE-2023-26244 | High | 7.8 | 2023-04-27 | An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppDMClient binary file, which is used durin… |
CVE-2023-26243 | High | 7.8 | 2023-04-27 | An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The decryption binary used to decrypt firmware f… |
CVE-2023-30622 | Medium | 6.7 | 2023-04-24 | Clusternet is a general-purpose system for controlling Kubernetes clusters across different environments. An issue in clusternet prior to version 0.15.2 can be… |
CVE-2023-25133 | Critical | 9.1 | 2023-04-24 | Improper privilege management vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Managem… |
CVE-2023-2240 | High | 8.8 | 2023-04-22 | Improper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4. |
CVE-2022-47505 | High | 7.8 | 2023-04-21 | The SolarWinds Platform was susceptible to the Local Privilege Escalation Vulnerability. This vulnerability allows a local adversary with a valid system user a… |
CVE-2023-28122 | High | 7.8 | 2023-04-19 | A local privilege escalation (LPE) vulnerability in UI Desktop for Windows (Version 0.59.1.71 and earlier) allows a malicious actor with local access to a Wind… |