CWE-269 · Improper Privilege Management (page 19)
Page 19 of 32 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-21772 | High | 7.8 | 2023-01-10 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-21755 | High | 7.8 | 2023-01-10 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-21730 | High | 7.8 | 2023-01-10 | Microsoft Cryptographic Services Elevation of Privilege Vulnerability |
CVE-2023-21561 | High | 7.8 | 2023-01-10 | Microsoft Cryptographic Services Elevation of Privilege Vulnerability |
CVE-2023-21552 | High | 7.8 | 2023-01-10 | Windows GDI Elevation of Privilege Vulnerability |
CVE-2023-21551 | High | 7.8 | 2023-01-10 | Microsoft Cryptographic Services Elevation of Privilege Vulnerability |
CVE-2023-21549 | High | 8.8 | 2023-01-10 | Windows SMB Witness Service Elevation of Privilege Vulnerability |
CVE-2023-21542 | High | 7.0 | 2023-01-10 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2023-21531 | High | 7.0 | 2023-01-10 | Azure Service Fabric Container Elevation of Privilege Vulnerability |
CVE-2022-4294 | High | 7.1 | 2023-01-10 | Norton, Avira, Avast and AVG Antivirus for Windows may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may… |
CVE-2022-0668 | Medium | 5.3 | 2023-01-08 | JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted request is sent by a… |
CVE-2022-43535 | High | 7.8 | 2023-01-05 | A vulnerability in the ClearPass OnGuard Windows agent could allow malicious users on a Windows instance to elevate their user privileges. A successful exploit… |
CVE-2022-43534 | High | 7.8 | 2023-01-05 | A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges. A successful exploit cou… |
CVE-2022-43533 | High | 7.8 | 2023-01-05 | A vulnerability in the ClearPass OnGuard macOS agent could allow malicious users on a macOS instance to elevate their user privileges. A successful exploit co… |
CVE-2022-4808 | High | 8.8 | 2022-12-28 | Improper Privilege Management in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-46172 | Medium | 6.4 | 2022-12-28 | authentik is an open-source Identity provider focused on flexibility and versatility. In versions prior to 2022.10.4, and 2022.11.4, any authenticated user can… |
CVE-2022-45963 | Critical | 9.8 | 2022-12-27 | h3c firewall <= 3.10 ESS6703 has a privilege bypass vulnerability. |
CVE-2022-37706 | High | 7.8 | 2022-12-25 | enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pa… |
CVE-2022-41290 | High | 8.4 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the rm_rlcache_file command to obtain root privileges… |
CVE-2022-38757 | High | 7.2 | 2022-12-23 | A vulnerability has been identified in Micro Focus ZENworks 2020 Update 3a and prior versions. This vulnerability allows administrators with rights to perform… |
CVE-2022-4687 | High | 8.1 | 2022-12-23 | Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-46334 | High | 7.8 | 2022-12-21 | Proofpoint Enterprise Protection (PPS/PoD) contains a vulnerability which allows the pps user to escalate to root privileges due to unnecessary permissions. Th… |
CVE-2022-38065 | High | 8.8 | 2022-12-21 | A privilege escalation vulnerability exists in the oslo.privsep functionality of OpenStack git master 05194e7618 and prior. Overly permissive functionality wit… |
CVE-2022-38060 | High | 8.8 | 2022-12-21 | A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. A misconfiguration in /etc/sudoers within a con… |
CVE-2022-42046 | High | 7.8 | 2022-12-20 | wfshbr64.sys and wfshbr32.sys specially crafted IOCTL allows arbitrary user to perform local privilege escalation |
CVE-2022-46327 | Critical | 9.8 | 2022-12-20 | Some smartphones have configuration issues. Successful exploitation of this vulnerability may cause privilege escalation, which results in system service excep… |
CVE-2022-31707 | High | 7.2 | 2022-12-16 | vRealize Operations (vROps) contains a privilege escalation vulnerability. VMware has evaluated the severity of this issue to be in the Important severity rang… |
CVE-2022-42855 | High | 7.1 | 2022-12-15 | A logic issue was addressed with improved state management. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS… |
CVE-2022-42849 | High | 7.8 | 2022-12-15 | An access issue existed with privileged API calls. This issue was addressed with additional restrictions. This issue is fixed in iOS 16.2 and iPadOS 16.2, tvOS… |
CVE-2022-44689 | High | 7.8 | 2022-12-13 | Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability |
CVE-2022-38124 | Medium | 5.7 | 2022-12-13 | Debug tool in Secomea SiteManager allows logged-in administrator to modify system state in an unintended manner. |
CVE-2022-41268 | High | 8.5 | 2022-12-13 | In some SAP standard roles in SAP Business Planning and Consolidation - versions - SAP_BW 750, 751, 752, 753, 754, 755, 756, 757, DWCORE 200, 300, CPMBPC 810, … |
CVE-2022-4314 | Critical | 9.8 | 2022-12-12 | Improper Privilege Management in GitHub repository ikus060/rdiffweb prior to 2.5.2. |
CVE-2022-37929 | Medium | 6.7 | 2022-12-12 | Improper Privilege Management vulnerability in Hewlett Packard Enterprise Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary Flash Arrays. |
CVE-2021-3919 | Critical | 9.8 | 2022-12-12 | A potential security vulnerability has been identified in OMEN Gaming Hub and in HP Command Center which may allow escalation of privilege and/or denial of ser… |
CVE-2022-3641 | High | 8.8 | 2022-12-12 | Elevation of privilege in the Azure SQL Data Source in Devolutions Remote Desktop Manager 2022.3.13 to 2022.3.24 allows an authenticated user to spoof a privil… |
CVE-2022-23485 | Medium | 6.4 | 2022-12-10 | Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invit… |
CVE-2022-4264 | Medium | 6.5 | 2022-12-09 | Incorrect Privilege Assignment in M-Files Web (Classic) in M-Files before 22.8.11691.0 allows low privilege user to change some configuration. |
CVE-2022-41948 | Medium | 6.7 | 2022-12-08 | DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. Affected versions are subject to a privilege… |
CVE-2022-42888 | Critical | 9.8 | 2022-12-06 | Unauth. Privilege Escalation vulnerability in ARMember premium plugin <= 5.5.1 on WordPress. |
CVE-2022-4173 | High | 7.3 | 2022-12-06 | A vulnerability within the malware removal functionality of Avast and AVG Antivirus allowed an attacker with write access to the filesystem, to escalate his pr… |
CVE-2022-32633 | Medium | 6.7 | 2022-12-05 | In Wi-Fi, there is a possible memory access violation due to a logic error. This could lead to local escalation of privilege with System execution privileges n… |
CVE-2022-4281 | Medium | 6.3 | 2022-12-05 | A vulnerability has been found in Facepay 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /face-recognit… |
CVE-2022-46410 | High | 8.8 | 2022-12-04 | An issue was discovered in Veritas NetBackup Flex Scale through 3.0. An attacker with non-root privileges may escalate privileges to root by using specific com… |
CVE-2022-4270 | Low | 2.0 | 2022-12-02 | Incorrect privilege assignment issue in M-Files Web in M-Files Web versions before 22.5.11436.1 could have changed permissions accidentally. |
CVE-2022-23737 | Medium | 6.5 | 2022-12-01 | An improper privilege management vulnerability was identified in GitHub Enterprise Server that allowed users with improper privileges to create or delete pages… |
CVE-2022-1606 | Low | 2.4 | 2022-11-30 | Incorrect privilege assignment in M-Files Server versions before 22.3.11164.0 and before 22.3.11237.1 allows user to read unmanaged objects. |
CVE-2022-3088 | High | 7.8 | 2022-11-28 | UC-8100A-ME-T System Image: Versions v1.0 to v1.6, UC-2100 System Image: Versions v1.0 to v1.12, UC-2100-W System Image: Versions v1.0 to v 1.12, UC-3100… |
CVE-2022-41923 | Critical | 9.1 | 2022-11-23 | Grails Spring Security Core plugin is vulnerable to privilege escalation. The vulnerability allows an attacker access to one endpoint (i.e. the targeted endpoi… |
CVE-2022-0222 | High | 7.5 | 2022-11-22 | A CWE-269: Improper Privilege Management vulnerability exists that could cause a denial of service of the Ethernet communication of the controller when sending… |
CVE-2022-42459 | High | 7.2 | 2022-11-18 | Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin <= 9.7.1 on WordPress. |
CVE-2022-43308 | High | 7.8 | 2022-11-18 | INTELBRAS SG 2404 MR 20180928-rel64938 allows authenticated attackers to arbitrarily create Administrator accounts via crafted user cookies. |
CVE-2022-43138 | Critical | 9.8 | 2022-11-17 | Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API. |
CVE-2022-45183 | High | 8.8 | 2022-11-14 | Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with a valid app token to retrieve other app… |
CVE-2022-41339 | High | 7.8 | 2022-11-12 | In Zoho ManageEngine Mobile Device Manager Plus before 10.1.2207.5, the User Administration module allows privilege escalation. |
CVE-2022-39395 | Critical | 9.6 | 2022-11-10 | Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela Server and Vela Worker prior to version 0.16.0 a… |
CVE-2021-34579 | High | 7.5 | 2022-11-09 | In Phoenix Contact: FL MGUARD DM version 1.12.0 and 1.13.0 access to the Apache web server being installed as part of the FL MGUARD DM on Microsoft Windows doe… |
CVE-2022-37015 | Critical | 9.8 | 2022-11-08 | Symantec Endpoint Detection and Response (SEDR) Appliance, prior to 4.7.0, may be susceptible to a privilege escalation vulnerability, which is a type of issue… |
CVE-2022-44733 | High | 7.8 | 2022-11-07 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39… |
CVE-2022-44732 | High | 7.8 | 2022-11-07 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39… |
CVE-2022-42796 | High | 7.8 | 2022-11-01 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 15.7 and iPadOS 15.7, macOS Ventura 13. An app may be able to gain elevate… |
CVE-2022-32907 | High | 7.8 | 2022-11-01 | This issue was addressed with improved checks. This issue is fixed in tvOS 16, iOS 16, watchOS 9. An app may be able to execute arbitrary code with kernel priv… |
CVE-2022-32794 | High | 7.8 | 2022-11-01 | A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6… |
CVE-2022-3369 | High | 8.6 | 2022-11-01 | An Improper Access Control vulnerability in the bdservicehost.exe component, as used in Bitdefender Engines for Windows, allows an attacker to delete privilege… |
CVE-2022-3419 | Medium | 6.5 | 2022-10-31 | The Automatic User Roles Switcher WordPress plugin before 1.1.2 does not have authorisation and proper CSRF checks, allowing any authenticated users like subsc… |
CVE-2022-41974 | High | 7.8 | 2022-10-29 | multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local user… |
CVE-2022-39286 | High | 8.8 | 2022-10-26 | Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vuln… |
CVE-2022-43749 | Medium | 4.3 | 2022-10-26 | Improper privilege management vulnerability in summary report management in Synology Presto File Server before 2.1.2-1601 allows remote authenticated users to… |
CVE-2022-28169 | High | 8.8 | 2022-10-25 | Brocade Webtools in Brocade Fabric OS versions before Brocade Fabric OS versions v9.1.1, v9.0.1e, and v8.2.3c could allow a low privilege webtools, user, to ga… |
CVE-2022-34438 | Medium | 6.7 | 2022-10-21 | Dell PowerScale OneFS, versions 8.2.x-9.4.0.x, contain a privilege context switching error. A local authenticated malicious user with high privileges could pot… |
CVE-2022-41835 | High | 7.3 | 2022-10-19 | In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.5.0, excessive file permissions in F5OS allows an authenticated local attacker to execute li… |
CVE-2022-39422 | High | 7.5 | 2022-10-18 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.38. Difficu… |
CVE-2022-22239 | High | 8.2 | 2022-10-18 | An Execution with Unnecessary Privileges vulnerability in Management Daemon (mgd) of Juniper Networks Junos OS Evolved allows a locally authenticated attacker… |
CVE-2022-3421 | Medium | 5.6 | 2022-10-17 | An attacker can pre-create the `/Applications/Google\ Drive.app/Contents/MacOS` directory which is expected to be owned by root to be owned by a non-root user… |
CVE-2022-2249 | High | 7.7 | 2022-10-12 | Privilege escalation related vulnerabilities were discovered in Avaya Aura Communication Manager that may allow local administrative users to escalate their pr… |
CVE-2022-41032 | High | 7.8 | 2022-10-11 | NuGet Client Elevation of Privilege Vulnerability |
CVE-2022-3422 | High | 7.5 | 2022-10-07 | Account Takeover :: when see the info i can see the hash pass i can creaked it ............... Account Takeover :: when see the info i can see the forgot_passw… |
CVE-2022-2975 | High | 7.7 | 2022-10-06 | A vulnerability related to weak permissions was detected in Avaya Aura Application Enablement Services web application, allowing an administrative user to modi… |
CVE-2022-2637 | Medium | 5.4 | 2022-10-06 | Incorrect Privilege Assignment vulnerability in Hitachi Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalat… |
CVE-2022-41975 | High | 7.8 | 2022-09-30 | RealVNC VNC Server before 6.11.0 and VNC Viewer before 6.22.826 on Windows allow local privilege escalation via MSI installer Repair mode. |
CVE-2022-39032 | High | 8.8 | 2022-09-28 | Smart eVision has an improper privilege management vulnerability. A remote attacker with general user privilege can exploit this vulnerability to escalate to a… |
CVE-2022-41604 | High | 8.8 | 2022-09-27 | Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. This occurs because of weak permissions for the %PROGRA… |
CVE-2022-32829 | High | 7.8 | 2022-09-23 | This issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to execute arbitrary co… |
CVE-2022-32826 | High | 7.8 | 2022-09-23 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 1… |
CVE-2022-32819 | High | 7.8 | 2022-09-23 | A logic issue was addressed with improved state management. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macO… |
CVE-2022-32801 | High | 7.8 | 2022-09-23 | This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5. An app may be able to gain root privileges. |
CVE-2022-32782 | Medium | 4.4 | 2022-09-23 | This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.4. An app with root privileges may be able to access private in… |
CVE-2022-32781 | Medium | 4.4 | 2022-09-23 | This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.4, iOS 15.5 and iPadOS 15.5, Security Update 2022-005 Catalina… |
CVE-2022-35257 | High | 7.8 | 2022-09-23 | A local privilege escalation vulnerability in UI Desktop for Windows (Version 0.55.1.2 and earlier) allows a malicious actor with local access to a Windows dev… |
CVE-2022-30121 | Medium | 6.7 | 2022-09-23 | The “LANDesk(R) Management Agent” service exposes a socket and once connected, it is possible to launch commands only for signed executables. This is a securit… |
CVE-2022-3068 | High | 8.8 | 2022-09-21 | Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3. |
CVE-2022-3079 | High | 7.5 | 2022-09-20 | Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of… |
CVE-2022-38351 | High | 8.8 | 2022-09-19 | A vulnerability in Suprema BioStar (aka Bio Star) 2 v2.8.16 allows attackers to escalate privileges to System Administrator via a crafted PUT request to the up… |
CVE-2022-40142 | High | 7.8 | 2022-09-19 | A security link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service agents could allow a local att… |
CVE-2022-39007 | Critical | 9.8 | 2022-09-16 | The location module has a vulnerability of bypassing permission verification.Successful exploitation of this vulnerability may cause privilege escalation. |
CVE-2022-36075 | Low | 2.6 | 2022-09-15 | Nextcloud files access control is a nextcloud app to manage access control for files. Users with limited access can see file names in certain cases where they… |
CVE-2020-36603 | Medium | 6.5 | 2022-09-14 | The HoYoVerse (formerly miHoYo) Genshin Impact mhyprot2.sys 1.0.0.0 anti-cheat driver does not adequately restrict unprivileged function calls, allowing local… |
CVE-2022-22483 | Medium | 6.5 | 2022-09-13 | IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to an information disclosure in some scenarios due to unauthorized access cau… |
CVE-2022-39203 | High | 8.8 | 2022-09-13 | matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. Attackers can specify a specific string of characters, which would confuse the bridge in… |
CVE-2022-39202 | Medium | 4.3 | 2022-09-13 | matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. The Internet Relay Chat (IRC) protocol allows you to specify multiple modes in a single… |