CWE-269 · Improper Privilege Management (page 20)
Page 20 of 32 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-36861 | Medium | 5.9 | 2022-09-09 | Custom permission misuse vulnerability in SystemUI prior to SMR Sep-2022 Release 1 allows attacker to use some protected functions with SystemUI privilege. |
CVE-2022-40297 | High | 7.8 | 2022-09-09 | UBports Ubuntu Touch 16.04 allows the screen-unlock passcode to be used for a privileged shell via Sudo. This passcode is only four digits, far below typical l… |
CVE-2022-36088 | Medium | 5.0 | 2022-09-07 | GoCD is a continuous delivery server. Windows installations via either the server or agent installers for GoCD prior to 22.2.0 do not adequately restrict permi… |
CVE-2022-31166 | High | 8.1 | 2022-09-07 | XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Starting in versions 11.3.7, 11.0.3, and 12.0RC1, it is possible to expl… |
CVE-2022-30298 | High | 7.0 | 2022-09-06 | An improper privilege management vulnerability [CWE-269] in Fortinet FortiSOAR before 7.2.1 allows a GUI user who has already found a way to modify system file… |
CVE-2021-43076 | Medium | 6.3 | 2022-09-06 | An improper privilege management vulnerability [CWE-269] in FortiADC versions 6.2.1 and below, 6.1.5 and below, 6.0.4 and below, 5.4.5 and below and 5.3.7 and… |
CVE-2021-25657 | High | 7.8 | 2022-09-02 | A privilege escalation vulnerability was discovered in Avaya IP Office Admin Lite and USB Creator that may potentially allow a local user to escalate privilege… |
CVE-2021-3020 | High | 8.8 | 2022-08-26 | An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the binary hawk_invoke (built from tools/hawk_invoke.c), intended t… |
CVE-2022-32840 | High | 7.8 | 2022-08-24 | This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5, watchOS 8.7, iOS 15.6 and iPadOS 15.6. An app may be able to execute… |
CVE-2021-0891 | High | 7.5 | 2022-08-24 | An unprivileged app can trigger PowerVR driver to return an uninitialized heap memory causing information disclosure.Product: AndroidVersions: Android SoCAndro… |
CVE-2022-31676 | High | 7.8 | 2022-08-23 | VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Gue… |
CVE-2022-36157 | High | 8.8 | 2022-08-19 | XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low Privilege account. |
CVE-2022-1901 | Medium | 5.3 | 2022-08-19 | In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview. |
CVE-2022-2568 | Medium | 6.5 | 2022-08-18 | A privilege escalation flaw was found in the Ansible Automation Platform. This flaw allows a remote authenticated user with 'change user' permissions to modify… |
CVE-2022-37025 | High | 7.8 | 2022-08-18 | An improper privilege management vulnerability in McAfee Security Scan Plus (MSS+) before 4.1.262.1 could allow a local user to modify a configuration file and… |
CVE-2020-10728 | High | 7.8 | 2022-08-16 | A flaw was found in automationbroker/apb container in versions up to and including 2.0.4-1. This container grants all users sudoer permissions allowing an unau… |
CVE-2022-37002 | Critical | 9.8 | 2022-08-10 | The SystemUI module has a privilege escalation vulnerability. Successful exploitation of this vulnerability can cause malicious applications to pop up windows… |
CVE-2022-31672 | High | 7.2 | 2022-08-10 | VMware vRealize Operations contains a privilege escalation vulnerability. A malicious actor with administrative network access can escalate privileges to root. |
CVE-2022-20361 | Critical | 9.8 | 2022-08-10 | In btif_dm_auth_cmpl_evt of btif_dm.cc, there is a possible vulnerability in Cross-Transport Key Derivation due to Weakness in Bluetooth Standard. This could l… |
CVE-2022-20360 | High | 7.8 | 2022-08-10 | In setChecked of SecureNfcPreferenceController.java, there is a missing permission check. This could lead to local escalation of privilege from the guest user… |
CVE-2022-20356 | High | 7.8 | 2022-08-10 | In shouldAllowFgsWhileInUsePermissionLocked of ActiveServices.java, there is a possible way to start foreground service from background due to improper input v… |
CVE-2022-20347 | High | 8.8 | 2022-08-10 | In onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due to a confused deputy. This could lead to remote escalation of p… |
CVE-2022-20239 | Critical | 9.8 | 2022-08-10 | remap_pfn_range' here may map out of size kernel memory (for example, may map the kernel area), and because the 'vma->vm_page_prot' can also be controlled by u… |
CVE-2022-35782 | Medium | 6.5 | 2022-08-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-35781 | Medium | 6.5 | 2022-08-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-35780 | Medium | 6.5 | 2022-08-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-35775 | Medium | 6.5 | 2022-08-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-35774 | Medium | 4.9 | 2022-08-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-35771 | High | 7.8 | 2022-08-09 | Windows Defender Credential Guard Elevation of Privilege Vulnerability |
CVE-2022-35768 | High | 7.8 | 2022-08-09 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2022-35765 | High | 7.8 | 2022-08-09 | Storage Spaces Direct Elevation of Privilege Vulnerability |
CVE-2022-35764 | High | 7.8 | 2022-08-09 | Storage Spaces Direct Elevation of Privilege Vulnerability |
CVE-2022-35763 | High | 7.8 | 2022-08-09 | Storage Spaces Direct Elevation of Privilege Vulnerability |
CVE-2022-35762 | High | 7.8 | 2022-08-09 | Storage Spaces Direct Elevation of Privilege Vulnerability |
CVE-2022-35761 | High | 7.8 | 2022-08-09 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2022-34706 | High | 7.8 | 2022-08-09 | Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability |
CVE-2022-34703 | High | 7.8 | 2022-08-09 | Windows Partition Management Driver Elevation of Privilege Vulnerability |
CVE-2022-34699 | High | 7.8 | 2022-08-09 | Windows Win32k Elevation of Privilege Vulnerability |
CVE-2022-34691 | High | 8.8 | 2022-08-09 | Active Directory Domain Services Elevation of Privilege Vulnerability |
CVE-2022-33646 | High | 7.0 | 2022-08-09 | Azure Batch Node Agent Elevation of Privilege Vulnerability |
CVE-2022-33640 | High | 7.8 | 2022-08-09 | System Center Operations Manager: Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability |
CVE-2022-36833 | High | 7.3 | 2022-08-05 | Improper Privilege Management vulnerability in Game Optimizing Service prior to versions 3.3.04.0 in Android 10, and 3.5.04.8 in Android 11 and above allows lo… |
CVE-2022-2498 | Medium | 6.4 | 2022-08-05 | An issue in pipeline subscriptions in GitLab EE affecting all versions from 12.8 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 triggered new… |
CVE-2022-35243 | High | 8.7 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.5.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when running in Appliance mode, an authentic… |
CVE-2022-33962 | Medium | 6.7 | 2022-08-04 | In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, certain iRules c… |
CVE-2022-35921 | Low | 3.5 | 2022-08-01 | fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement by users. Users of By… |
CVE-2022-2317 | Critical | 9.8 | 2022-08-01 | The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user sup… |
CVE-2022-2273 | High | 8.8 | 2022-08-01 | The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escal… |
CVE-2022-34338 | Medium | 6.5 | 2022-08-01 | IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could disclose sensitive information due to improper privilege management for storage provider types… |
CVE-2022-35291 | High | 8.1 | 2022-07-27 | Due to misconfigured application endpoints, SAP SuccessFactors attachment APIs allow attackers with user privileges to perform activities with admin privileges… |
CVE-2022-20907 | Medium | 6.0 | 2022-07-22 | Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabiliti… |
CVE-2022-20906 | Medium | 6.0 | 2022-07-22 | Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabiliti… |
CVE-2022-26113 | High | 7.7 | 2022-07-19 | An execution with unnecessary privileges vulnerability [CWE-250] in FortiClientWindows 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0 thr… |
CVE-2022-30526 | High | 7.8 | 2022-07-19 | A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware vers… |
CVE-2022-26118 | Medium | 6.7 | 2022-07-18 | A privilege chaining vulnerability [CWE-268] in FortiManager and FortiAnalyzer 6.0.x, 6.2.x, 6.4.0 through 6.4.7, 7.0.0 through 7.0.3 may allow a local and aut… |
CVE-2022-34754 | Medium | 6.8 | 2022-07-13 | A CWE-269: Improper Privilege Management vulnerability exists that could allow elevated functionality when guessing credentials. Affected Products: Acti9 Power… |
CVE-2022-33710 | High | 7.8 | 2022-07-12 | Improper input validation vulnerability in BillingPackageInsraller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch activities as Gal… |
CVE-2022-33709 | High | 7.8 | 2022-07-12 | Improper input validation vulnerability in ApexPackageInstaller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch activities as Galaxy… |
CVE-2022-33708 | High | 7.8 | 2022-07-12 | Improper input validation vulnerability in AppsPackageInstaller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch activities as Galaxy… |
CVE-2022-23720 | High | 7.5 | 2022-06-30 | PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administr… |
CVE-2017-20121 | High | 7.8 | 2022-06-30 | A vulnerability was found in Teradici Management Console 2.2.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2017-20112 | High | 7.8 | 2022-06-29 | A vulnerability has been found in IVPN Client 2.6.6120.33863 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipu… |
CVE-2017-20111 | High | 7.3 | 2022-06-29 | A vulnerability, which was classified as critical, was found in Teleopti WFM 7.1.0. This affects an unknown part of the component Administration. The manipulat… |
CVE-2017-20107 | Medium | 5.3 | 2022-06-28 | A vulnerability, which was classified as problematic, was found in ShadeYouVPN.com Client 2.0.1.11. Affected is an unknown function. The manipulation leads to… |
CVE-2022-31039 | Medium | 4.3 | 2022-06-27 | Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room's settings even though they are no… |
CVE-2019-25071 | Medium | 6.3 | 2022-06-25 | A vulnerability was found in Apple iPhone up to 12.4.1. It has been declared as critical. Affected by this vulnerability is Siri. Playing an audio or video fil… |
CVE-2022-22390 | High | 7.5 | 2022-06-24 | IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an information disclosure caused by improper privilege management when… |
CVE-2020-21046 | High | 7.8 | 2022-06-24 | A local privilege escalation vulnerability was identified within the "luminati_net_updater_win_eagleget_com" service in EagleGet Downloader version 2.1.5.20 St… |
CVE-2022-2104 | Critical | 9.9 | 2022-06-24 | The www-data (Apache web server) account is configured to run sudo with no password for many commands (including /bin/sh and /bin/bash). |
CVE-2022-1517 | Critical | 10.0 | 2022-06-24 | LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an att… |
CVE-2022-32536 | High | 8.8 | 2022-06-23 | The user access rights validation in the web server of the Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 was insufficient. This would allow a… |
CVE-2022-32535 | Medium | 4.8 | 2022-06-23 | The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 runs its web server with root privilege. In combination with CVE-2022-23534 this could give… |
CVE-2022-29526 | Medium | 5.3 | 2022-06-23 | Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorr… |
CVE-2017-20081 | Medium | 6.3 | 2022-06-21 | A vulnerability, which was classified as critical, was found in Hindu Matrimonial Script. This affects an unknown part of the file /admin/reports.php. The mani… |
CVE-2017-20080 | Medium | 6.3 | 2022-06-21 | A vulnerability, which was classified as critical, has been found in Hindu Matrimonial Script. Affected by this issue is some unknown functionality of the file… |
CVE-2017-20079 | Medium | 6.3 | 2022-06-21 | A vulnerability classified as critical was found in Hindu Matrimonial Script. Affected by this vulnerability is an unknown functionality of the file /admin/pho… |
CVE-2017-20078 | Medium | 6.3 | 2022-06-21 | A vulnerability classified as critical has been found in Hindu Matrimonial Script. Affected is an unknown function of the file /admin/featured.php. The manipul… |
CVE-2017-20077 | Medium | 6.3 | 2022-06-21 | A vulnerability was found in Hindu Matrimonial Script. It has been rated as critical. This issue affects some unknown processing of the file /admin/success_sto… |
CVE-2017-20076 | Medium | 6.3 | 2022-06-21 | A vulnerability was found in Hindu Matrimonial Script. It has been declared as critical. This vulnerability affects unknown code of the file /admin/searchview… |
CVE-2017-20075 | Medium | 6.3 | 2022-06-21 | A vulnerability was found in Hindu Matrimonial Script. It has been classified as critical. This affects an unknown part of the file /admin/payment.php. The man… |
CVE-2017-20074 | Medium | 6.3 | 2022-06-21 | A vulnerability was found in Hindu Matrimonial Script and classified as critical. Affected by this issue is some unknown functionality of the file /admin/newsl… |
CVE-2017-20073 | Medium | 6.3 | 2022-06-21 | A vulnerability has been found in Hindu Matrimonial Script and classified as critical. Affected by this vulnerability is an unknown functionality of the file /… |
CVE-2017-20072 | Medium | 6.3 | 2022-06-21 | A vulnerability, which was classified as critical, was found in Hindu Matrimonial Script. Affected is an unknown function of the file /admin/generalsettings.ph… |
CVE-2017-20071 | Medium | 6.3 | 2022-06-21 | A vulnerability, which was classified as critical, has been found in Hindu Matrimonial Script. This issue affects some unknown processing of the file /admin/re… |
CVE-2017-20070 | Medium | 6.3 | 2022-06-21 | A vulnerability classified as critical was found in Hindu Matrimonial Script. This vulnerability affects unknown code of the file /admin/communitymanagement.ph… |
CVE-2017-20069 | Medium | 6.3 | 2022-06-21 | A vulnerability classified as critical has been found in Hindu Matrimonial Script. This affects an unknown part of the file /admin/countrymanagement.php. The m… |
CVE-2017-20068 | Medium | 6.3 | 2022-06-21 | A vulnerability was found in Hindu Matrimonial Script. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/u… |
CVE-2022-1823 | High | 7.9 | 2022-06-20 | Improper privilege management vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local user to modify a configuratio… |
CVE-2022-26668 | High | 7.3 | 2022-06-20 | ASUS Control Center API has a broken access control vulnerability. An unauthenticated remote attacker can call privileged API functions to perform partial syst… |
CVE-2017-20063 | Medium | 6.3 | 2022-06-20 | A vulnerability was found in Elefant CMS 1.3.12-RC. It has been classified as critical. Affected is an unknown function of the file /filemanager/upload/drop of… |
CVE-2022-2023 | Critical | 9.8 | 2022-06-20 | Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4. |
CVE-2022-34006 | High | 7.8 | 2022-06-19 | An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050. When installing, Microsoft SQL Express 2019 installs by default with an SQL instan… |
CVE-2020-36549 | High | 8.8 | 2022-06-17 | A vulnerability classified as critical was found in GE Voluson S8. Affected is the underlying Windows XP operating system. Missing patches might introduce an e… |
CVE-2018-25044 | Medium | 6.3 | 2022-06-17 | A vulnerability, which was classified as critical, has been found in uTorrent. This issue affects some unknown processing of the component Guest Account. The m… |
CVE-2018-25041 | Medium | 6.3 | 2022-06-17 | A vulnerability was found in uTorrent. It has been rated as critical. Affected by this issue is some unknown functionality of the component JSON RPC Server. Th… |
CVE-2018-25040 | Medium | 6.3 | 2022-06-17 | A vulnerability was found in uTorrent Web. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component HTTP R… |
CVE-2022-26057 | Medium | 6.7 | 2022-06-15 | Vulnerabilities in the Mint WorkBench allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary conten… |
CVE-2022-20819 | Medium | 6.5 | 2022-06-15 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive… |
CVE-2017-20049 | Critical | 9.8 | 2022-06-15 | A vulnerability, was found in legacy Axis devices such as P3225 and M3005. This affects an unknown part of the component CGI Script. The manipulation leads to… |
CVE-2022-31594 | Medium | 6.7 | 2022-06-14 | A highly privileged user can exploit SUID-root program to escalate his privileges to root on a local Unix system. |