CWE-269 · Improper Privilege Management (page 26)
Page 26 of 32 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-3594 | High | 7.8 | 2020-11-06 | A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vul… |
CVE-2020-3593 | High | 7.8 | 2020-11-06 | A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vul… |
CVE-2020-27122 | Medium | 6.7 | 2020-11-06 | A vulnerability in the Microsoft Active Directory integration of Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to elevate p… |
CVE-2020-28046 | High | 7.8 | 2020-11-02 | An issue was discovered in ProlinOS through 2.4.161.8859R. An attacker with local code execution privileges as a normal user (MAINAPP) can escalate to root pri… |
CVE-2020-27655 | Medium | 6.5 | 2020-10-29 | Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resources via inbound Qui… |
CVE-2020-27654 | Critical | 9.8 | 2020-10-29 | Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port… |
CVE-2020-16262 | High | 7.8 | 2020-10-28 | Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation. |
CVE-2020-7125 | High | 8.8 | 2020-10-26 | A remote escalation of privilege vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2. |
CVE-2020-24848 | High | 7.8 | 2020-10-23 | FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform a system-level (root) local privilege e… |
CVE-2020-7020 | Low | 3.1 | 2020-10-22 | Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly… |
CVE-2020-9112 | High | 7.8 | 2020-10-19 | Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have a privilege elevation vulnerability. Due to lack of privilege restrictions on some of the busin… |
CVE-2020-16940 | High | 7.8 | 2020-10-16 | <p>An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles junction points. An attacker who successfu… |
CVE-2020-16902 | High | 7.8 | 2020-10-16 | <p>An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure l… |
CVE-2020-7334 | High | 7.7 | 2020-10-15 | Improper privilege assignment vulnerability in the installer McAfee Application and Change Control (MACC) prior to 8.3.2 allows local administrators to change… |
CVE-2020-7330 | High | 7.5 | 2020-10-14 | Privilege Escalation vulnerability in McAfee Total Protection (MTP) trial prior to 4.0.176.1 allows local users to schedule tasks which call malicious software… |
CVE-2020-15797 | Medium | 6.8 | 2020-10-13 | A vulnerability has been identified in DCA Vantage Analyzer (All versions < V4.5 are affected by CVE-2020-7590. In addition, serial numbers < 40000 running sof… |
CVE-2020-26880 | High | 7.8 | 2020-10-07 | Sympa through 6.2.57b.2 allows a local privilege escalation from the sympa user account to full root access by modifying the sympa.conf configuration file (whi… |
CVE-2020-26596 | High | 8.8 | 2020-10-07 | The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Ed… |
CVE-2020-8223 | Medium | 6.5 | 2020-10-05 | A logic error in Nextcloud Server 19.0.0 caused a privilege escalation allowing malicious users to reshare with higher permissions than they got assigned thems… |
CVE-2020-3396 | Medium | 6.8 | 2020-09-24 | A vulnerability in the file system on the pluggable USB 3.0 Solid State Drive (SSD) for Cisco IOS XE Software could allow an authenticated, physical attacker t… |
CVE-2020-3393 | Medium | 6.0 | 2020-09-24 | A vulnerability in the application-hosting subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to root on an… |
CVE-2015-4719 | Critical | 9.8 | 2020-09-24 | The client API authentication mechanism in Pexip Infinity before 10 allows remote attackers to gain privileges via a crafted request. |
CVE-2020-25595 | High | 7.8 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. The PCI passthrough code improperly uses register data. Code paths in Xen's MSI handling have been identified th… |
CVE-2020-8247 | High | 8.8 | 2020-09-18 | Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix… |
CVE-2020-0403 | Medium | 6.7 | 2020-09-17 | In the FPC TrustZone fingerprint App, there is a possible invalid command handler due to an exposed test feature. This could lead to local escalation of privil… |
CVE-2020-24046 | High | 7.2 | 2020-09-17 | A sandbox escape issue was discovered in TitanHQ SpamTitan Gateway 7.07. It limits the admin user to a restricted shell, allowing execution of a small number o… |
CVE-2020-0404 | Medium | 5.5 | 2020-09-17 | In uvc_scan_chain_forward of uvc_driver.c, there is a possible linked list corruption due to an unusual root cause. This could lead to local escalation of priv… |
CVE-2020-0074 | High | 7.8 | 2020-09-17 | In verifyIntentFiltersIfNeeded of PackageManagerService.java, there is a possible settings bypass allowing an app to become the default handler for arbitrary d… |
CVE-2020-16875 | High | 8.4 | 2020-09-11 | <p>A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments.</p> <p>An attacker who successfull… |
CVE-2020-9733 | High | 7.5 | 2020-09-10 | An AEM java servlet in AEM versions 6.5.5.0 (and below) and 6.4.8.1 (and below) executes with the permissions of a high privileged service user. If exploited… |
CVE-2020-7311 | High | 7.8 | 2020-09-10 | Privilege Escalation vulnerability in the installer in McAfee Agent (MA) for Windows prior to 5.6.6 allows local users to assume SYSTEM rights during the insta… |
CVE-2020-10056 | High | 7.8 | 2020-09-09 | A vulnerability has been identified in License Management Utility (LMU) (All versions < V2.4). The lmgrd service of the affected application is executed with l… |
CVE-2020-7324 | Medium | 6.1 | 2020-09-09 | Improper Access Control vulnerability in McAfee MVISION Endpoint prior to 20.9 Update allows local users to bypass security mechanisms and deny access to the S… |
CVE-2020-7523 | High | 7.8 | 2020-08-31 | Improper Privilege Management vulnerability exists in Schneider Electric Modbus Serial Driver (see security notification for versions) which could cause local… |
CVE-2020-4603 | High | 7.2 | 2020-08-27 | IBM Security Guardium Insights 2.0.1 performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or… |
CVE-2020-5916 | Medium | 6.8 | 2020-08-26 | In BIG-IP versions 15.1.0-15.1.0.4 and 15.0.0-15.0.1.3 the Certificate Administrator user role and higher privileged roles can perform arbitrary file reads out… |
CVE-2020-8624 | Medium | 4.3 | 2020-08-21 | In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1… |
CVE-2019-11847 | High | 7.3 | 2020-08-21 | An improper privilege management vulnerabitlity exists in ALEOS before 4.11.0, 4.9.4 and 4.4.9. An authenticated user can escalate to root via the command shel… |
CVE-2020-10290 | Medium | 6.8 | 2020-08-21 | Universal Robots controller execute URCaps (zip files containing Java-powered applications) without any permission restrictions and a wide API that presents ma… |
CVE-2020-7310 | Medium | 6.9 | 2020-08-21 | Privilege Escalation vulnerability in the installer in McAfee McAfee Total Protection (MTP) trial prior to 4.0.161.1 allows local users to change files that ar… |
CVE-2020-14215 | High | 7.5 | 2020-08-21 | Zulip Server before 2.1.5 has Incorrect Access Control because 0198_preregistrationuser_invited_as adds the administrator role to invitations. |
CVE-2020-14194 | Medium | 5.4 | 2020-08-21 | Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link. |
CVE-2020-15862 | High | 7.8 | 2020-08-20 | Net-SNMP through 5.8 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB provides the ability to run arbitrary commands as root. |
CVE-2020-15149 | Critical | 9.9 | 2020-08-20 | NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a runn… |
CVE-2020-7019 | Medium | 6.5 | 2020-08-18 | In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. If a user runs the same q… |
CVE-2020-7018 | High | 8.8 | 2020-08-18 | Elastic Enterprise Search before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is given the �developer� role, they will b… |
CVE-2020-1488 | High | 7.0 | 2020-08-17 | An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to sys… |
CVE-2015-8032 | Medium | 5.3 | 2020-08-14 | In Textpattern 4.5.7, an unprivileged author can change an article's markup setting. |
CVE-2020-24331 | High | 7.8 | 2020-08-13 | An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /et… |
CVE-2020-24330 | High | 7.8 | 2020-08-13 | An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gi… |
CVE-2020-7305 | Medium | 6.7 | 2020-08-13 | Privilege escalation vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows a low privileged remote attacker to create new rul… |
CVE-2020-11552 | Critical | 9.8 | 2020-08-11 | An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce user privileges associ… |
CVE-2020-15826 | Medium | 4.3 | 2020-08-08 | In JetBrains TeamCity before 2020.1, users are able to assign more permissions than they have. |
CVE-2020-15824 | High | 8.8 | 2020-08-08 | In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there is a script-cache privilege escalation… |
CVE-2020-13522 | High | 7.1 | 2020-08-04 | An exploitable arbitrary file delete vulnerability exists in SoftPerfect RAM Disk 4.1 spvve.sys driver. A specially crafted I/O request packet (IRP) can allow… |
CVE-2020-5617 | High | 7.8 | 2020-08-04 | Privilege escalation vulnerability in SKYSEA Client View Ver.12.200.12n to 15.210.05f allows an attacker to obtain unauthorized privileges and modify/obtain se… |
CVE-2020-5773 | High | 8.8 | 2020-08-03 | Improper Access Control in Teltonika firmware TRB2_R_00.02.04.01 allows a low privileged user to perform unauthorized write operations. |
CVE-2019-4589 | Medium | 4.3 | 2020-08-03 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to privlege escalation where the "My schedules and subscriptions" page is visible and accessible to a less pri… |
CVE-2020-14162 | High | 7.8 | 2020-07-30 | An issue was discovered in Pi-Hole through 5.0. The local www-data user has sudo privileges to execute the pihole core script as root without a password, which… |
CVE-2020-14493 | High | 8.8 | 2020-07-29 | A low-privilege user may use SQL syntax to write arbitrary files to the OpenClinic GA 5.09.02 and 5.89.05b server, which may allow the execution of arbitrary c… |
CVE-2020-9669 | Critical | 9.8 | 2020-07-17 | Adobe Creative Cloud Desktop Application versions 5.1 and earlier have a lack of exploit mitigations vulnerability. Successful exploitation could lead to privi… |
CVE-2020-10286 | High | 8.8 | 2020-07-15 | the main user account has restricted privileges but is in the sudoers group and there is not any mechanism in place to prevent sudo su or sudo -i to be run gai… |
CVE-2020-1431 | High | 7.8 | 2020-07-14 | An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to sys… |
CVE-2020-1416 | High | 8.8 | 2020-07-14 | An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual Studio and Visual Stud… |
CVE-2020-1412 | High | 8.8 | 2020-07-14 | A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Remote… |
CVE-2020-7578 | High | 8.1 | 2020-07-14 | A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All versions < V8.2). Authenticated users could hav… |
CVE-2020-11956 | Critical | 9.8 | 2020-07-14 | An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. There is a least privilege violation. |
CVE-2020-6013 | High | 8.8 | 2020-07-06 | ZoneAlarm Firewall and Antivirus products before version 15.8.109.18436 allow an attacker who already has access to the system to execute code at elevated priv… |
CVE-2020-7283 | High | 7.5 | 2020-07-03 | Privilege Escalation vulnerability in McAfee Total Protection (MTP) before 16.0.R26 allows local users to create and edit files via symbolic link manipulation… |
CVE-2020-7281 | High | 7.5 | 2020-07-03 | Privilege Escalation vulnerability in McAfee Total Protection (MTP) prior to 16.0.R26 allows local users to delete files the user would otherwise not have acce… |
CVE-2020-8179 | Medium | 4.1 | 2020-07-02 | Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other users decks. |
CVE-2020-15368 | Medium | 5.5 | 2020-06-29 | AsrDrv103.sys in the ASRock RGB Driver does not properly restrict access from user space, as demonstrated by triggering a triple fault via a request to zero CR… |
CVE-2020-14976 | Medium | 5.5 | 2020-06-23 | GNS3 ubridge through 0.9.18 on macOS, as used in GNS3 server before 2.1.17, allows a local attacker to read arbitrary files because it handles configuration-fi… |
CVE-2017-18885 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by accessing unintended API endpoints on a… |
CVE-2017-18884 | High | 8.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by using a registered OAuth application wit… |
CVE-2019-20886 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.8.0. The first user is sometimes inadvertently a system admin. |
CVE-2020-9225 | High | 7.8 | 2020-06-18 | FusionSphere OpenStack 6.5.1 have an improper permissions management vulnerability. The software does not correctly perform a privilege assignment when an acto… |
CVE-2020-7509 | High | 7.2 | 2020-06-16 | A CWE-269: Improper privilege management (write) vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to eleva… |
CVE-2020-13854 | Critical | 9.8 | 2020-06-11 | Artica Pandora FMS 7.44 allows privilege escalation. |
CVE-2020-12850 | High | 7.0 | 2020-06-11 | The following vulnerability applies only to the Pydio Cells Enterprise OVF version 2.0.4. Prior versions of the Pydio Cells Enterprise OVF (such as version 2.0… |
CVE-2020-12713 | High | 7.2 | 2020-06-11 | An issue was discovered in CipherMail Community Gateway and Professional/Enterprise Gateway 1.0.1 through 4.7.1-0 and CipherMail Webmail Messenger 1.1.1 throug… |
CVE-2020-12757 | Critical | 9.8 | 2020-06-10 | HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default ti… |
CVE-2020-7280 | High | 7.8 | 2020-06-10 | Privilege Escalation vulnerability during daily DAT updates when using McAfee Virus Scan Enterprise (VSE) prior to 8.8 Patch 15 allows local users to cause the… |
CVE-2019-3588 | Medium | 6.3 | 2020-06-10 | Privilege Escalation vulnerability in Microsoft Windows client (McTray.exe) in McAfee VirusScan Enterprise (VSE) 8.8 prior to Patch 14 may allow unauthorized u… |
CVE-2019-3585 | High | 7.0 | 2020-06-10 | Privilege Escalation vulnerability in Microsoft Windows client (McTray.exe) in McAfee VirusScan Enterprise (VSE) 8.8 prior to Patch 14 may allow local users to… |
CVE-2019-3617 | High | 7.5 | 2020-06-10 | Privilege escalation vulnerability in McAfee Total Protection (ToPS) for Mac OS prior to 4.6 allows local users to gain root privileges via incorrect protectio… |
CVE-2020-8320 | Medium | 6.4 | 2020-06-09 | An internal shell was included in BIOS image in some ThinkPad models that could allow escalation of privilege. |
CVE-2020-7014 | High | 8.8 | 2020-06-03 | The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an a… |
CVE-2020-13776 | Medium | 6.7 | 2020-06-03 | systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privil… |
CVE-2020-13695 | High | 7.2 | 2020-06-01 | In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user has sudo privileges to execute grep as root without a passwo… |
CVE-2020-10936 | High | 7.8 | 2020-05-27 | Sympa before 6.2.56 allows privilege escalation. |
CVE-2020-9046 | High | 8.8 | 2020-05-26 | A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by… |
CVE-2020-3812 | Medium | 5.5 | 2020-05-26 | qmail-verify as used in netqmail 1.06 is prone to an information disclosure vulnerability. A local attacker can test for the existence of files and directories… |
CVE-2020-8021 | Medium | 5.3 | 2020-05-19 | a Improper Access Control vulnerability in of Open Build Service allows remote attackers to read files of an OBS package where the sourceaccess/access is disab… |
CVE-2019-17066 | High | 7.8 | 2020-05-18 | In Ivanti WorkSpace Control before 10.4.40.0, a user can elevate rights on the system by hijacking certain user registries. This is possible because pwrgrid.ex… |
CVE-2020-12860 | Medium | 5.3 | 2020-05-18 | COVIDSafe through v1.0.17 allows a remote attacker to access phone name and model information because a BLE device can have four roles and COVIDSafe uses all o… |
CVE-2020-12798 | High | 7.8 | 2020-05-15 | Cellebrite UFED 5.0 to 7.5.0.845 implements local operating system policies that can be circumvented to obtain a command prompt via the Windows file dialog tha… |
CVE-2020-7291 | High | 7.8 | 2020-05-08 | Privilege Escalation vulnerability in McAfee Active Response (MAR) for Mac prior to 2.4.3 Hotfix 1 allows a malicious script or program to perform functions th… |
CVE-2020-7290 | High | 7.8 | 2020-05-08 | Privilege Escalation vulnerability in McAfee Active Response (MAR) for Linux prior to 2.4.3 Hotfix 1 allows a malicious script or program to perform functions… |
CVE-2020-7289 | High | 7.8 | 2020-05-08 | Privilege Escalation vulnerability in McAfee Active Response (MAR) for Windows prior to 2.4.3 Hotfix 1 allows a malicious script or program to perform function… |