CWE-269 · Improper Privilege Management (page 21)
Page 21 of 32 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-29614 | Medium | 5.0 | 2022-06-14 | SAP startservice - of SAP NetWeaver Application Server ABAP, Application Server Java, ABAP Platform and HANA Database - versions KERNEL 7.22, 7.49, 7.53, 7.77… |
CVE-2022-24077 | High | 7.8 | 2022-06-13 | Naver Cloud Explorer Beta allows the attacker to execute arbitrary code as System privilege via malicious DLL injection. |
CVE-2022-1654 | High | 8.8 | 2022-06-13 | Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 allow any authenticated attacker, including a subscriber or customer-level attacker, to gain administ… |
CVE-2022-2063 | High | 8.8 | 2022-06-13 | Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.7+. |
CVE-2017-20038 | Medium | 6.3 | 2022-06-11 | A vulnerability was found in SICUNET Access Controller 0.32-05z and classified as critical. Affected by this issue is some unknown functionality of the file ca… |
CVE-2017-20037 | Medium | 6.3 | 2022-06-11 | A vulnerability has been found in SICUNET Access Controller 0.32-05z and classified as critical. Affected by this vulnerability is an unknown functionality. Th… |
CVE-2022-30610 | Medium | 4.5 | 2022-06-10 | IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 is vulnerable to reverse tabnabbing where it could allow a page linked to from within IBM Spectrum C… |
CVE-2017-20028 | Medium | 5.6 | 2022-06-09 | A vulnerability was found in HumHub 0.20.1/1.0.0-beta.3. It has been classified as critical. This affects an unknown part. The manipulation leads to privilege… |
CVE-2017-20025 | High | 7.3 | 2022-06-09 | A vulnerability was found in Solare Solar-Log 2.8.4-56/3.5.2-85. It has been declared as critical. Affected by this vulnerability is an unknown functionality o… |
CVE-2017-20023 | Medium | 6.3 | 2022-06-09 | A vulnerability was found in Solare Solar-Log 2.8.4-56/3.5.2-85 and classified as critical. This issue affects some unknown processing of the component Network… |
CVE-2017-20021 | Medium | 6.5 | 2022-06-09 | A vulnerability, which was classified as critical, was found in Solare Solar-Log 2.8.4-56/3.5.2-85. This affects an unknown part of the component File Upload… |
CVE-2019-25068 | Medium | 6.3 | 2022-06-09 | A vulnerability classified as critical was found in Axios Italia Axios RE 1.7.0/7.0.0. This vulnerability affects unknown code of the file REDefault.aspx of th… |
CVE-2019-25066 | Medium | 6.3 | 2022-06-09 | A vulnerability has been found in ajenti 2.1.31 and classified as critical. This vulnerability affects unknown code of the component API. The manipulation lead… |
CVE-2016-15002 | High | 7.3 | 2022-06-09 | A vulnerability, which was classified as critical, was found in MONyog Ultimate 6.63. This affects an unknown part of the component Cookie Handler. The manipul… |
CVE-2022-31214 | High | 7.8 | 2022-06-09 | A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a bogus Firejail container that is accepted by the Firejail setuid… |
CVE-2022-32272 | Critical | 9.8 | 2022-06-09 | OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender Email Gateway Security before 5.6.1 have incorrect access control, res… |
CVE-2022-30743 | Medium | 5.3 | 2022-06-07 | Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the data of contact and gallery without permission. |
CVE-2022-30739 | Medium | 4.0 | 2022-06-07 | Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get an user email or phone number with a normal level per… |
CVE-2022-30736 | Medium | 5.3 | 2022-06-07 | Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the data of contact and gallery without permission. |
CVE-2022-30735 | Medium | 5.9 | 2022-06-07 | Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the access_token without permission. |
CVE-2020-36542 | High | 7.3 | 2022-06-07 | A vulnerability classified as critical has been found in Demokratian. This affects an unknown part of the file install/install3.php. The manipulation leads to… |
CVE-2019-9971 | High | 8.8 | 2022-06-07 | PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an attacker to gain root privileges by using sudo with the tcpdump comm… |
CVE-2022-21827 | High | 7.1 | 2022-05-26 | An improper privilege vulnerability has been discovered in Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows) <21.9.1.2 what could allow an… |
CVE-2022-29333 | High | 7.8 | 2022-05-24 | A vulnerability in CyberLink Power Director v14 allows attackers to escalate privileges via a crafted .exe file. |
CVE-2014-125001 | High | 8.1 | 2022-05-24 | A vulnerability classified as critical has been found in Cardo Systems Scala Rider Q3. Affected is the file /cardo/api of the Cardo-Updater. Unauthenticated re… |
CVE-2022-31267 | Critical | 9.8 | 2022-05-21 | Gitblit 1.9.2 allows privilege escalation via the Config User Service: a control character can be placed in a profile data field, such as an emailAddress%3Atex… |
CVE-2022-29179 | High | 7.5 | 2022-05-20 | Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Prior to versions 1.9.16, 1.10… |
CVE-2022-1770 | High | 8.8 | 2022-05-20 | Improper Privilege Management in GitHub repository polonel/trudesk prior to 1.2.2. |
CVE-2022-30695 | High | 7.8 | 2022-05-16 | Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Snap Deploy (Windows) before… |
CVE-2021-23265 | Low | 3.5 | 2022-05-16 | A logged-in and authenticated user with a Reviewer Role may lock a content item. |
CVE-2022-29587 | Medium | 4.0 | 2022-05-16 | Konica Minolta bizhub MFP devices before 2022-04-14 have an internal Chromium browser that executes with root (aka superuser) access privileges. |
CVE-2022-29218 | High | 7.7 | 2022-05-13 | RubyGems is a package registry used to supply software for the Ruby language ecosystem. An ordering mistake in the code that accepts gem uploads allowed some g… |
CVE-2022-23743 | High | 7.8 | 2022-05-11 | Check Point ZoneAlarm before version 15.8.200.19118 allows a local actor to escalate privileges during the upgrade process. In addition, weak permissions in th… |
CVE-2022-20114 | High | 7.8 | 2022-05-10 | In placeCall of TelecomManager.java, there is a possible way for an application to keep itself running with foreground service importance due to a permissions… |
CVE-2022-20112 | Medium | 5.5 | 2022-05-10 | In getAvailabilityStatus of PrivateDnsPreferenceController.java, there is a possible way for a guest user to change private DNS settings due to a permissions b… |
CVE-2022-1397 | High | 8.8 | 2022-05-10 | API Privilege Escalation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Full system takeover. |
CVE-2021-27767 | Medium | 6.7 | 2022-05-06 | The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a pr… |
CVE-2021-27766 | Medium | 6.7 | 2022-05-06 | The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a pri… |
CVE-2021-27765 | Medium | 6.7 | 2022-05-06 | The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a… |
CVE-2022-29164 | High | 7.1 | 2022-05-06 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a… |
CVE-2022-27659 | Medium | 4.3 | 2022-05-05 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, an authenticated attacker can modify… |
CVE-2022-25782 | Medium | 5.4 | 2022-05-04 | Improper Handling of Insufficient Privileges vulnerability in Web UI of Secomea GateManager allows logged in user to access and update privileged information… |
CVE-2022-20759 | High | 8.8 | 2022-05-03 | A vulnerability in the web services interface for remote access VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Def… |
CVE-2021-4200 | Medium | 5.4 | 2022-05-02 | A Improper Privilege Management vulnerability in SUSE Rancher allows write access to the Catalog for any user when restricted-admin role is enabled. This issue… |
CVE-2021-36784 | High | 7.2 | 2022-05-02 | A Improper Privilege Management vulnerability in SUSE Rancher allows users with the restricted-admin role to escalate to full admin. This issue affects: SUSE R… |
CVE-2021-36207 | High | 8.8 | 2022-04-29 | Under certain circumstances improper privilege management in Metasys ADS/ADX/OAS servers versions 10 and 11 could allow an authenticated user to elevate their… |
CVE-2022-1227 | High | 8.8 | 2022-04-29 | A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded… |
CVE-2022-1108 | Medium | 6.7 | 2022-04-22 | A potential vulnerability due to improper buffer validation in the SMI handler LenovoFlashDeviceInterface in Thinkpad X1 Fold Gen 1 could be exploited by an at… |
CVE-2022-1107 | Medium | 6.7 | 2022-04-22 | During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovered in some ThinkPad… |
CVE-2022-0071 | High | 8.8 | 2022-04-19 | Incomplete fix for CVE-2021-3101. Hotdog, prior to v1.0.2, did not mimic the resource limits, device restrictions, or syscall filters of the target JVM process… |
CVE-2022-0070 | High | 8.8 | 2022-04-19 | Incomplete fix for CVE-2021-3100. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic the Linux capa… |
CVE-2021-3101 | High | 8.8 | 2022-04-19 | Hotdog, prior to v1.0.1, did not mimic the capabilities or the SELinux label of the target JVM process. This would allow a container to gain full privileges on… |
CVE-2021-3100 | High | 8.8 | 2022-04-19 | The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM being patched, allowing it to escalate pr… |
CVE-2022-26795 | High | 7.8 | 2022-04-15 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2022-20739 | High | 7.3 | 2022-04-15 | A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operat… |
CVE-2020-16238 | Medium | 6.7 | 2022-04-14 | A vulnerability in the configuration import mechanism of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versio… |
CVE-2022-22187 | High | 7.8 | 2022-04-14 | An Improper Privilege Management vulnerability in the Windows Installer framework used in the Juniper Networks Juniper Identity Management Service (JIMS) allow… |
CVE-2022-1256 | High | 7.8 | 2022-04-14 | A local privilege escalation vulnerability in MA for Windows prior to 5.7.6 allows a local low privileged user to gain system privileges through running the re… |
CVE-2022-1332 | Medium | 4.3 | 2022-04-13 | One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom… |
CVE-2022-24842 | High | 8.8 | 2022-04-12 | MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. A security issue was found where an non-admin user is able to… |
CVE-2022-23160 | Medium | 5.4 | 2022-04-12 | Dell PowerScale OneFS, versions 8.2.0-9.3.0, contains an Improper Handling of Insufficient Permissions vulnerability. An remote malicious user could potentiall… |
CVE-2022-24812 | High | 8.0 | 2022-04-12 | Grafana is an open-source platform for monitoring and observability. When fine-grained access control is enabled and a client uses Grafana API Key to make requ… |
CVE-2021-39807 | High | 7.8 | 2022-04-12 | In handleNfcStateChanged of SecureNfcEnabler.java, there is a possible way to enable NFC from the Guest account due to a missing permission check. This could l… |
CVE-2021-39797 | High | 7.8 | 2022-04-12 | In several functions of of LauncherApps.java, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation… |
CVE-2022-27840 | Medium | 4.4 | 2022-04-11 | Improper access control vulnerability in SamsungRecovery prior to version 8.1.43.0 allows local attckers to delete arbitrary files as SamsungRecovery permissio… |
CVE-2022-22257 | High | 7.5 | 2022-04-11 | The customization framework has a vulnerability of improper permission control.Successful exploitation of this vulnerability may affect data integrity. |
CVE-2022-0556 | High | 7.3 | 2022-04-11 | A local privilege escalation vulnerability caused by incorrect permission assignment in some directories of the Zyxel AP Configurator (ZAC) version 1.1.4, whic… |
CVE-2021-36293 | Medium | 6.4 | 2022-04-08 | Dell VNX2 for File version 8.1.21.266 and earlier, contain a privilege escalation vulnerability. A local malicious admin may potentially exploit vulnerability… |
CVE-2021-36290 | Medium | 6.4 | 2022-04-08 | Dell VNX2 for File version 8.1.21.266 and earlier, contain a privilege escalation vulnerability. A local malicious admin may potentially exploit vulnerability… |
CVE-2022-26676 | Critical | 9.8 | 2022-04-07 | aEnrich a+HRD has inadequate privilege restrictions, an unauthenticated remote attacker can use the API function to upload and execute malicious scripts to con… |
CVE-2022-20782 | Medium | 6.5 | 2022-04-06 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive… |
CVE-2022-26251 | High | 7.2 | 2022-04-06 | The HTTP interface of Synaman v5.1 and below was discovered to allow authenticated attackers to execute arbitrary code and escalate privileges. |
CVE-2021-39784 | High | 7.8 | 2022-03-30 | In CellBroadcastReceiver, there is a possible path to enable specific cellular features due to a missing permission check. This could lead to local escalation… |
CVE-2021-39783 | High | 7.8 | 2022-03-30 | In rcsservice, there is a possible way to modify TTY mode due to a missing permission check. This could lead to local escalation of privilege with no additiona… |
CVE-2021-39782 | High | 7.8 | 2022-03-30 | In Telephony, there is a possible unauthorized modification of the PLMN SIM file due to a missing permission check. This could lead to local escalation of priv… |
CVE-2021-39772 | High | 8.8 | 2022-03-30 | In Bluetooth, there is a possible way to access the a2dp audio control switch due to a missing permission check. This could lead to local escalation of privile… |
CVE-2003-5001 | Medium | 5.3 | 2022-03-28 | A vulnerability was found in ISS BlackICE PC Protection and classified as critical. Affected by this issue is the component Cross Site Scripting Detection. The… |
CVE-2022-24783 | Critical | 10.0 | 2022-03-25 | Deno is a runtime for JavaScript and TypeScript. The versions of Deno between release 1.18.0 and 1.20.2 (inclusive) are vulnerable to an attack where a malicio… |
CVE-2022-1003 | Low | 3.3 | 2022-03-18 | One of the API in Mattermost version 6.3.0 and earlier fails to properly protect the permissions, which allows the system administrators to combine the two dis… |
CVE-2022-24637 | Critical | 9.8 | 2022-03-18 | Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privilege… |
CVE-2022-24072 | Medium | 6.1 | 2022-03-17 | The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store web page via devtools… |
CVE-2022-22141 | High | 7.8 | 2022-03-11 | 'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL configuration. CENTU… |
CVE-2022-24750 | High | 8.8 | 2022-03-10 | UltraVNC is a free and open source remote pc access software. A vulnerability has been found in versions prior to 1.3.8.0 in which the DSM plugin module, which… |
CVE-2022-24931 | High | 7.9 | 2022-03-10 | Improper access control vulnerability in dynamic receiver in ApkInstaller prior to SMR MAR-2022 Release allows unauthorized attackers to execute arbitrary acti… |
CVE-2022-20051 | Medium | 5.5 | 2022-03-10 | In ims service, there is a possible unexpected application behavior due to incorrect privilege assignment. This could lead to local denial of service with no a… |
CVE-2022-23296 | High | 7.8 | 2022-03-09 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2022-25311 | High | 7.3 | 2022-03-08 | A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The affe… |
CVE-2022-24408 | High | 7.8 | 2022-03-08 | A vulnerability has been identified in SINUMERIK MC (All versions < V1.15 SP1), SINUMERIK ONE (All versions < V6.15 SP1). The sc SUID binary on affected device… |
CVE-2022-0441 | Critical | 9.8 | 2022-03-07 | The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to regi… |
CVE-2022-25089 | Critical | 9.8 | 2022-03-03 | Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY_LOCAL_MACHINE via UITasks.PersistentRegistry… |
CVE-2022-23921 | High | 7.5 | 2022-02-25 | Exploitation of this vulnerability may result in local privilege escalation and code execution. GE maintains exploitation of this vulnerability is only possibl… |
CVE-2022-25636 | High | 7.8 | 2022-02-24 | net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds write. This is relat… |
CVE-2022-25372 | High | 7.8 | 2022-02-20 | Pritunl Client through 1.2.3019.52 on Windows allows local privilege escalation, related to an ACL entry for CREATOR OWNER in platform_windows.go. |
CVE-2022-23604 | High | 8.8 | 2022-02-15 | x26-Cogs is a repository of cogs made by Twentysix for the Red Discord bot. Among these cogs is the Defender cog, a tool for Discord server moderation. A vulne… |
CVE-2022-25150 | High | 7.8 | 2022-02-14 | In Malwarebytes Binisoft Windows Firewall Control before 6.8.1.0, programs executed from the Tools tab can be used to escalate privileges. |
CVE-2022-24927 | Medium | 4.2 | 2022-02-11 | Improper privilege management vulnerability in Samsung Video Player prior to version 7.3.15.30 allows attackers to execute video files without permission. |
CVE-2021-22801 | Critical | 9.8 | 2022-02-11 | A CWE-269: Improper Privilege Management vulnerability exists that could cause an arbitrary command execution when the software is configured with specially cr… |
CVE-2021-36302 | Critical | 9.9 | 2022-02-09 | All Dell EMC Integrated System for Microsoft Azure Stack Hub versions contain a privilege escalation vulnerability. A remote malicious user with standard level… |
CVE-2021-3813 | Medium | 6.5 | 2022-02-09 | Improper Privilege Management in GitHub repository chatwoot/chatwoot prior to v2.2. |
CVE-2021-37852 | High | 7.8 | 2022-02-09 | ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the contex… |