CWE-269 · Improper Privilege Management (page 18)
Page 18 of 32 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-22645 | High | 8.0 | 2023-04-19 | An Improper Privilege Management vulnerability in SUSE kubewarden allows attackers to read arbitrary secrets if they get access to the ServiceAccount kubewarde… |
CVE-2023-21990 | High | 8.2 | 2023-04-18 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.44 and Pr… |
CVE-2023-21987 | High | 7.8 | 2023-04-18 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.44 and Pr… |
CVE-2023-21896 | High | 7.0 | 2023-04-18 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: NSSwitch). Supported versions that are affected are 10 and 11. Difficult to exploit… |
CVE-2023-1548 | Medium | 5.5 | 2023-04-18 | A CWE-269: Improper Privilege Management vulnerability exists that could cause a local user to perform a denial of service through the console server service… |
CVE-2023-22946 | Medium | 6.4 | 2023-04-17 | In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute… |
CVE-2023-27654 | Critical | 9.8 | 2023-04-14 | An issue found in WHOv.1.0.28, v.1.0.30, v.1.0.32 allows an attacker to cause a escalation of privileges via the TTMultiProvider component. |
CVE-2023-29018 | High | 8.0 | 2023-04-14 | The OpenFeature Operator allows users to expose feature flags to applications. Assuming the pre-existence of a vulnerability that allows for arbitrary code exe… |
CVE-2023-27651 | High | 7.8 | 2023-04-14 | An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges via the update_info field of the _default_.xml file. |
CVE-2023-1326 | High | 7.7 | 2023-04-13 | A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unpri… |
CVE-2023-24509 | Critical | 9.3 | 2023-04-13 | On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO… |
CVE-2023-27830 | Critical | 9.0 | 2023-04-12 | TightVNC before v2.8.75 allows attackers to escalate privileges on the host operating system via replacing legitimate files with crafted files when executing a… |
CVE-2022-27487 | High | 8.8 | 2023-04-11 | A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptor version 4.1.0, 4.0… |
CVE-2023-27645 | Critical | 9.8 | 2023-04-11 | An issue found in POWERAMP audioplayer build 925 bundle play and build 954 allows a remote attacker to gain privileges via the reverb and EQ preset parameters. |
CVE-2023-20680 | Medium | 6.7 | 2023-04-06 | In adsp, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privi… |
CVE-2023-20655 | High | 7.8 | 2023-04-06 | In mmsdk, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local code execution with no additional execution pri… |
CVE-2023-0959 | Medium | 6.5 | 2023-04-05 | Bhima version 1.27.0 allows a remote attacker to update the privileges of any account registered in the application via a malicious link sent to an administrat… |
CVE-2023-28855 | Medium | 6.5 | 2023-04-05 | Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows an… |
CVE-2023-28632 | High | 8.1 | 2023-04-05 | GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, an authenticated user can modify ema… |
CVE-2022-48227 | High | 7.8 | 2023-04-04 | An issue was discovered in Acuant AsureID Sentinel before 5.2.149. It allows elevation of privileges because it opens Notepad after the installation of AssureI… |
CVE-2022-48226 | High | 7.8 | 2023-04-04 | An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. During installation, an EXE gets executed out of C:\Windows\Temp. A standard user can create… |
CVE-2023-0192 | Medium | 4.7 | 2023-04-01 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer handler, where improper privilege management can lead to escalation of… |
CVE-2023-1762 | High | 8.8 | 2023-03-31 | Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2017-6894 | High | 7.8 | 2023-03-29 | A vulnerability exists in FlexNet Manager Suite releases 2015 R2 SP3 and earlier (including FlexNet Manager Platform 9.2 and earlier) that affects the inventor… |
CVE-2023-0664 | High | 7.8 | 2023-03-29 | A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via… |
CVE-2022-48353 | Critical | 9.8 | 2023-03-27 | Some smartphones have configuration issues. Successful exploitation of this vulnerability may cause kernel privilege escalation, which results in system servic… |
CVE-2023-28640 | Medium | 6.4 | 2023-03-27 | Apiman is a flexible and open source API Management platform. Due to a missing permissions check, an attacker with an authenticated Apiman Manager account may… |
CVE-2023-21068 | High | 7.8 | 2023-03-24 | In (TBD) of (TBD), there is a possible way to boot with a hidden debug policy due to a missing warning to the user. This could lead to local escalation of priv… |
CVE-2023-20995 | High | 7.8 | 2023-03-24 | In captureImage of CustomizedSensor.cpp, there is a possible way to bypass the fingerprint unlock due to a logic error in the code. This could lead to local es… |
CVE-2023-28436 | Medium | 5.7 | 2023-03-23 | Tailscale is software for using Wireguard and multi-factor authentication (MFA). A vulnerability identified in the implementation of Tailscale SSH starting in… |
CVE-2023-27094 | High | 8.8 | 2023-03-23 | An issue found in OpenGoofy Hippo4j v.1.4.3 allows attackers to escalate privileges via the ThreadPoolController of the tenant Management module. |
CVE-2023-28758 | High | 7.1 | 2023-03-23 | An issue was discovered in Veritas NetBackup before 8.3.0.2. BPCD allows an unprivileged user to specify a log file path when executing a NetBackup command. Th… |
CVE-2022-43863 | Medium | 6.7 | 2023-03-22 | IBM QRadar SIEM 7.4 and 7.5 is vulnerable to privilege escalation, allowing a user with some admin capabilities to gain additional admin capabilities. IBM X-F… |
CVE-2023-28434 | High | 8.8 | 2023-03-22 | Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name che… |
CVE-2023-25590 | High | 7.8 | 2023-03-22 | A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges to those of a higher role… |
CVE-2023-21458 | Medium | 6.2 | 2023-03-16 | Improper privilege management vulnerability in PhoneStatusBarPolicy in System UI prior to SMR Mar-2023 Release 1 allows attacker to turn off Do not disturb via… |
CVE-2023-24760 | High | 8.8 | 2023-03-16 | An issue found in Ofcms v.1.1.4 allows a remote attacker to to escalate privileges via the respwd method in SysUserController. |
CVE-2023-28339 | High | 8.8 | 2023-03-14 | OpenDoas through 6.8.2, when TIOCSTI is available, allows privilege escalation because of sharing a terminal with the original session. NOTE: TIOCSTI is unavai… |
CVE-2023-27589 | Medium | 6.5 | 2023-03-14 | Minio is a Multi-Cloud Object Storage framework. Starting with RELEASE.2020-12-23T02-24-12Z and prior to RELEASE.2023-03-13T19-46-17Z, a user with `consoleAdmi… |
CVE-2023-23412 | High | 7.8 | 2023-03-14 | Windows Accounts Picture Elevation of Privilege Vulnerability |
CVE-2022-48365 | High | 7.2 | 2023-03-12 | An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges. |
CVE-2023-25144 | High | 7.8 | 2023-03-10 | An improper access control vulnerability in the Trend Micro Apex One agent could allow a local attacker to gain elevated privileges and create arbitrary direct… |
CVE-2022-39953 | High | 7.8 | 2023-03-07 | A improper privilege management in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.6, FortiNAC version 9.1.0 through 9.1.8, F… |
CVE-2023-26600 | Medium | 6.5 | 2023-03-06 | ManageEngine ServiceDesk Plus through 14104, ServiceDesk Plus MSP through 14000, Support Center Plus through 14000, and Asset Explorer through 6987 allow privi… |
CVE-2023-26604 | High | 7.8 | 2023-03-03 | systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl sta… |
CVE-2022-45988 | High | 7.8 | 2023-03-03 | starsoftcomm CooCare 5.304 allows local attackers to escalate privileges and execute arbitrary commands via a crafted file upload. |
CVE-2023-26475 | Critical | 9.9 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context… |
CVE-2022-45608 | High | 8.8 | 2023-03-01 | An issue was discovered in ThingsBoard 3.4.1, allows low privileged attackers (CUSTOMER_USER) to gain escalated privileges (vertically) and become an Administr… |
CVE-2022-27677 | High | 7.8 | 2023-03-01 | Failure to validate privileges during installation of AMD Ryzen™ Master may allow an attacker with low privileges to modify files potentially leading to privi… |
CVE-2023-23497 | High | 7.8 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.3, macOS Ventura 13.2, macOS Monterey 12.6.3. An app may… |
CVE-2022-32949 | High | 7.8 | 2023-02-27 | This issue was addressed with improved checks. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, tvOS 16. An app may be able to execute arbitrary code with… |
CVE-2022-32900 | High | 7.8 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6, macOS Big Sur 11.7. An app may be able to gain elevated… |
CVE-2022-48284 | Critical | 9.8 | 2023-02-27 | A piece of Huawei whole-home intelligence software has an Incorrect Privilege Assignment vulnerability. Successful exploitation of this vulnerability could all… |
CVE-2022-48283 | Critical | 9.8 | 2023-02-27 | A piece of Huawei whole-home intelligence software has an Incorrect Privilege Assignment vulnerability. Successful exploitation of this vulnerability could all… |
CVE-2022-48341 | High | 8.8 | 2023-02-23 | ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain System Administrator… |
CVE-2022-43927 | Medium | 5.9 | 2023-02-17 | IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to information Disclosure due to improper privilege management when a specially crafted… |
CVE-2022-38378 | Medium | 4.2 | 2023-02-16 | An improper privilege management vulnerability [CWE-269] in Fortinet FortiOS version 7.2.0 and before 7.0.7 and FortiProxy version 7.2.0 through 7.2.1 and befo… |
CVE-2023-24483 | High | 7.8 | 2023-02-16 | A vulnerability has been identified that, if exploited, could result in a local user elevating their privilege level to NT AUTHORITY\SYSTEM on a Citrix Virtual… |
CVE-2022-42455 | High | 7.8 | 2023-02-15 | ASUS EC Tool driver (aka d.sys) 1beb15c90dcf7a5234ed077833a0a3e900969b60be1d04fcebce0a9f8994bdbb, as signed by ASUS and shipped with multiple ASUS software pro… |
CVE-2022-42735 | High | 8.8 | 2023-02-15 | Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu. ShenYu Admin allows low-privilege low-level administrators create us… |
CVE-2023-25011 | High | 7.8 | 2023-02-15 | PC settings tool Ver10.1.26.0 and earlier, PC settings tool Ver11.0.22.0 and earlier allows a attacker to write to the registry as administrator privileges wit… |
CVE-2023-21777 | High | 8.7 | 2023-02-14 | Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability |
CVE-2023-25149 | High | 8.8 | 2023-02-14 | TimescaleDB, an open-source time-series SQL database, has a privilege escalation vulnerability in versions 2.8.0 through 2.9.2. During installation, TimescaleD… |
CVE-2022-34384 | High | 7.8 | 2023-02-11 | Dell SupportAssist Client Consumer (version 3.11.1 and prior), SupportAssist Client Commercial (version 3.2 and prior), Dell Command | Update, Dell Update, an… |
CVE-2023-21421 | Medium | 5.9 | 2023-02-09 | Improper Handling of Insufficient Permissions or Privileges vulnerability in KnoxCustomManagerService prior to SMR Jan-2023 Release 1 allows attacker to access… |
CVE-2022-48286 | High | 7.5 | 2023-02-09 | The multi-screen collaboration module has a privilege escalation vulnerability. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-38777 | High | 7.8 | 2023-02-08 | An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate their privileges to t… |
CVE-2022-43759 | High | 7.2 | 2023-02-07 | A Improper Privilege Management vulnerability in SUSE Rancher, allows users with access to the escalate verb on PRTBs to escalate permissions for any -promoted… |
CVE-2022-48019 | High | 7.8 | 2023-02-06 | The components wfshbr64.sys and wfshbr32.sys in Another Eden before v3.0.20 and before v2.14.200 allows attackers to perform privilege escalation via a crafted… |
CVE-2023-20854 | High | 8.4 | 2023-02-03 | VMware Workstation contains an arbitrary file deletion vulnerability. A malicious actor with local user privileges on the victim's machine may exploit this vul… |
CVE-2020-24307 | High | 7.8 | 2023-02-02 | An issue in mRemoteNG v1.76.20 allows attackers to escalate privileges via a crafted executable file. NOTE: third parties were unable to reproduce any scenario… |
CVE-2022-3990 | High | 7.8 | 2023-02-01 | HPSFViewer might allow Escalation of Privilege. This potential vulnerability was remediated on July 29th, 2022. Customers who opted for automatic updates shoul… |
CVE-2022-23455 | High | 7.8 | 2023-02-01 | Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, a… |
CVE-2021-3809 | High | 7.8 | 2023-02-01 | Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary code execution. HP… |
CVE-2021-3808 | High | 7.8 | 2023-02-01 | Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary code execution. HP… |
CVE-2021-3439 | High | 7.8 | 2023-02-01 | HP has identified a potential vulnerability in BIOS firmware of some Workstation products. Firmware updates are being released to mitigate these potential vuln… |
CVE-2022-45101 | High | 7.3 | 2023-02-01 | Dell PowerScale OneFS 9.0.0.x - 9.4.0.x, contains an Improper Handling of Insufficient Privileges vulnerability in NFS. A remote unauthenticated attacker coul… |
CVE-2023-0524 | High | 8.8 | 2023-02-01 | As part of our Security Development Lifecycle, a potential privilege escalation issue was identified internally. This could allow a malicious actor with suffic… |
CVE-2022-4441 | High | 7.6 | 2023-01-31 | Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation. Thi… |
CVE-2022-4041 | Medium | 5.9 | 2023-01-31 | Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation. Thi… |
CVE-2022-46359 | High | 8.8 | 2023-01-30 | Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclo… |
CVE-2022-46358 | High | 8.8 | 2023-01-30 | Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclo… |
CVE-2022-46357 | High | 8.8 | 2023-01-30 | Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclo… |
CVE-2022-46356 | High | 8.8 | 2023-01-30 | Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclo… |
CVE-2023-23629 | Medium | 6.3 | 2023-01-28 | Metabase is an open source data analytics platform. Affected versions are subject to Improper Privilege Management. As intended, recipients of dashboards subsc… |
CVE-2023-23610 | Medium | 6.5 | 2023-01-26 | GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having a… |
CVE-2022-43997 | High | 7.8 | 2023-01-26 | Incorrect access control in Aternity agent in Riverbed Aternity before 12.1.4.27 allows for local privilege escalation. There is an insufficiently protected ha… |
CVE-2022-38775 | High | 7.8 | 2023-01-26 | An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate their privileges to t… |
CVE-2022-38774 | High | 7.8 | 2023-01-26 | An issue was discovered in the quarantine feature of Elastic Endpoint Security and Elastic Endgame for Windows, which could allow unprivileged users to elevate… |
CVE-2023-0101 | High | 8.8 | 2023-01-20 | A privilege escalation vulnerability was identified in Nessus versions 8.10.1 through 8.15.8 and 10.0.0 through 10.4.1. An authenticated attacker could potenti… |
CVE-2022-25631 | High | 7.8 | 2023-01-20 | Symantec Endpoint Protection, prior to 14.3 RU6 (14.3.9210.6000), may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue whereb… |
CVE-2023-22331 | High | 7.5 | 2023-01-20 | Use of default credentials vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenticated attacker to alter user credentials… |
CVE-2023-0242 | High | 8.8 | 2023-01-18 | Rapid7 Velociraptor allows users to be created with different privileges on the server. Administrators are generally allowed to run any command on the server i… |
CVE-2023-22809 | High | 7.8 | 2023-01-18 | In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and E… |
CVE-2021-4314 | Medium | 5.3 | 2023-01-18 | It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only… |
CVE-2023-21848 | High | 8.8 | 2023-01-18 | Vulnerability in the Oracle Communications Convergence product of Oracle Communications Applications (component: Admin Configuration). The supported version… |
CVE-2023-0221 | Medium | 4.4 | 2023-01-13 | Product security bypass vulnerability in ACC prior to version 8.3.4 allows a locally logged-in attacker with administrator privileges to bypass the execution c… |
CVE-2022-39182 | Medium | 4.9 | 2023-01-12 | H C Mingham-Smith Ltd - Tardis 2000 Privilege escalation.Version 1.6 is vulnerable to privilege escalation which may allow a malicious actor to gain system pri… |
CVE-2023-21774 | High | 7.8 | 2023-01-10 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-21773 | High | 7.8 | 2023-01-10 | Windows Kernel Elevation of Privilege Vulnerability |