CWE-269 · Improper Privilege Management (page 27)
Page 27 of 32 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-7288 | High | 7.8 | 2020-05-08 | Privilege Escalation vulnerability in McAfee Exploit Detection and Response (EDR) for Mac prior to 3.1.0 Hotfix 1 allows a malicious script or program to perfo… |
CVE-2020-7287 | High | 7.8 | 2020-05-08 | Privilege Escalation vulnerability in McAfee Exploit Detection and Response (EDR) for Linux prior to 3.1.0 Hotfix 1 allows a malicious script or program to per… |
CVE-2020-7286 | High | 7.8 | 2020-05-08 | Privilege Escalation vulnerability in McAfee Exploit Detection and Response (EDR) for Windows prior to 3.1.0 Hotfix 1 allows a malicious script or program to p… |
CVE-2020-7285 | High | 7.8 | 2020-05-08 | Privilege Escalation vulnerability in McAfee MVISION Endpoint prior to 20.5.0.94 allows a malicious script or program to perform functions that the local execu… |
CVE-2020-7267 | High | 8.8 | 2020-05-08 | Privilege Escalation vulnerability in McAfee VirusScan Enterprise (VSE) for Linux prior to 2.0.3 Hotfix 2635000 allows local users to delete files the user wou… |
CVE-2020-7266 | High | 8.8 | 2020-05-08 | Privilege Escalation vulnerability in McAfee VirusScan Enterprise (VSE) for Windows prior to 8.8 Patch 14 Hotfix 116778 allows local users to delete files the… |
CVE-2020-7265 | High | 8.8 | 2020-05-08 | Privilege Escalation vulnerability in McAfee Endpoint Security (ENS) for Mac prior to 10.6.9 allows local users to delete files the user would otherwise not ha… |
CVE-2020-7264 | High | 8.8 | 2020-05-08 | Privilege Escalation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 Hotfix 199847 allows local users to delete files the user woul… |
CVE-2020-6652 | High | 7.8 | 2020-05-07 | Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager (IPM) v1.67 & prior allow non-admin users to upload the system configuration… |
CVE-2020-12689 | High | 8.8 | 2020-05-07 | An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can… |
CVE-2019-4266 | Low | 2.4 | 2020-05-06 | IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 does not have device jailbreak detection which could result in an attacker gaining sensitive informa… |
CVE-2019-19216 | High | 8.8 | 2020-04-30 | BMC Control-M/Agent 7.0.00.000 has an Insecure File Copy. |
CVE-2018-21226 | High | 8.8 | 2020-04-28 | Certain NETGEAR devices are affected by authentication bypass. This affects JNR1010v2 before 1.1.0.48, JWNR2010v5 before 1.1.0.48, WNR1000v4 before 1.1.0.48, W… |
CVE-2019-15790 | Low | 2.8 | 2020-04-28 | Apport reads and writes information on a crashed process to /proc/pid with elevated privileges. Apport then determines which user the crashed process belongs t… |
CVE-2020-12074 | High | 8.8 | 2020-04-23 | The users-customers-import-export-for-wp-woocommerce plugin before 1.3.9 for WordPress allows subscribers to import administrative accounts via CSV. |
CVE-2018-21124 | High | 8.8 | 2020-04-22 | NETGEAR WAC510 devices before 5.0.0.17 are affected by privilege escalation. |
CVE-2020-8474 | High | 7.8 | 2020-04-22 | Weak Registry permissions in ABB System 800xA Base allow low privileged users to read and modify registry settings related to control system functionality, all… |
CVE-2017-18837 | High | 7.8 | 2020-04-20 | Certain NETGEAR devices are affected by vertical privilege escalation. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ befo… |
CVE-2017-18830 | High | 7.8 | 2020-04-20 | Certain NETGEAR devices are affected by vertical privilege escalation. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ befo… |
CVE-2017-18829 | High | 7.8 | 2020-04-20 | Certain NETGEAR devices are affected by vertical privilege escalation. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ befo… |
CVE-2017-18826 | High | 7.8 | 2020-04-20 | Certain NETGEAR devices are affected by vertical privilege escalation. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ befo… |
CVE-2017-18822 | High | 7.8 | 2020-04-20 | Certain NETGEAR devices are affected by vertical privilege escalation. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ befo… |
CVE-2017-18838 | High | 7.8 | 2020-04-20 | Certain NETGEAR devices are affected by privilege escalation. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ before 12.0.2… |
CVE-2020-3250 | Critical | 9.8 | 2020-04-15 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication… |
CVE-2020-3243 | Critical | 9.8 | 2020-04-15 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication… |
CVE-2020-11799 | Critical | 9.8 | 2020-04-15 | Z-Cron 5.6 Build 04 allows an unprivileged attacker to elevate privileges by modifying a privileged user's task. This can also affect all users who are signed… |
CVE-2019-12522 | Medium | 4.5 | 2020-04-15 | An issue was discovered in Squid through 4.7. When Squid is run as root, it spawns its child processes as a lesser user, by default the user nobody. This is do… |
CVE-2020-6992 | Medium | 6.7 | 2020-04-15 | A local privilege escalation vulnerability has been identified in the GE Digital CIMPLICITY HMI/SCADA product v10.0 and prior. If exploited, this vulnerability… |
CVE-2020-1014 | High | 7.8 | 2020-04-15 | An elevation of privilege vulnerability exists in the Microsoft Windows Update Client when it does not properly handle privileges, aka 'Microsoft Windows Updat… |
CVE-2020-0935 | Medium | 5.5 | 2020-04-15 | An elevation of privilege vulnerability exists when the OneDrive for Windows Desktop application improperly handles symbolic links, aka 'OneDrive for Windows E… |
CVE-2020-7255 | Low | 3.9 | 2020-04-15 | Privilege escalation vulnerability in the administrative user interface in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allo… |
CVE-2020-7274 | Medium | 6.6 | 2020-04-15 | Privilege escalation vulnerability in McTray.exe in McAfee Endpoint Security (ENS) for Windows Prior to 10.7.0 April 2020 Update allows local users to spawn un… |
CVE-2020-7273 | Medium | 6.7 | 2020-04-15 | Accessing functionality not properly constrained by ACLs vulnerability in the autorun start-up protection in McAfee Endpoint Security (ENS) for Windows Prior t… |
CVE-2020-7259 | Medium | 6.6 | 2020-04-15 | Exploitation of Privilege/Trust vulnerability in file in McAfee Endpoint Security (ENS) Prior to 10.7.0 February 2020 Update allows local users to bypass local… |
CVE-2020-7257 | High | 8.4 | 2020-04-15 | Privilege escalation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows local users to cause the deletion… |
CVE-2020-8327 | High | 7.3 | 2020-04-14 | A privilege escalation vulnerability was reported in LenovoBatteryGaugePackage for Lenovo System Interface Foundation bundled in Lenovo Vantage prior to versio… |
CVE-2020-6236 | High | 7.2 | 2020-04-14 | SAP Landscape Management, version 3.0, and SAP Adaptive Extensions, version 1.0, allows an attacker with admin_group privileges to change ownership and permiss… |
CVE-2020-10384 | High | 7.8 | 2020-04-14 | An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.6.1. There is a local privilege escalation from… |
CVE-2019-18822 | High | 8.8 | 2020-04-14 | A privilege escalation vulnerability in ZOOM Call Recording 6.3.1 allows its user account (i.e., the account under which the program runs - by default, the cal… |
CVE-2020-11708 | Critical | 9.8 | 2020-04-12 | An issue was discovered in ProVide (formerly zFTPServer) through 13.1. Privilege escalation can occur via the /ajax/SetUserInfo messages parameter because of t… |
CVE-2020-1991 | High | 7.8 | 2020-04-08 | An insecure temporary file vulnerability in Palo Alto Networks Traps allows a local authenticated Windows user to escalate privileges or overwrite system files… |
CVE-2020-1989 | High | 7.0 | 2020-04-08 | An incorrect privilege assignment vulnerability when writing application-specific files in the Palo Alto Networks Global Protect Agent for Linux on ARM platfor… |
CVE-2019-15789 | High | 8.8 | 2020-04-08 | Privilege escalation vulnerability in MicroK8s allows a low privilege user with local access to obtain root access to the host by provisioning a privileged con… |
CVE-2020-5302 | High | 8.2 | 2020-04-07 | MH-WikiBot (an IRC Bot for interacting with the Miraheze API), had a bug that allowed any unprivileged user to access the steward commands on the IRC interface… |
CVE-2019-19699 | High | 7.2 | 2020-04-06 | There is Authenticated remote code execution in Centreon Infrastructure Monitoring Software through 19.10 via Pollers misconfiguration, leading to system compr… |
CVE-2018-17954 | Critical | 9.3 | 2020-04-03 | An Improper Privilege Management in crowbar of SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud 9, SUSE OpenStack Cloud Crowbar 8, SUSE Ope… |
CVE-2019-19348 | High | 7.0 | 2020-04-02 | An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/apb-base, affecting versions before the following 4.3.5, 4… |
CVE-2019-19346 | High | 7.0 | 2020-04-02 | An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/mariadb-apb, affecting versions before the following 4.3.5… |
CVE-2020-11466 | Medium | 4.3 | 2020-04-01 | An issue was discovered in Deskpro before 2019.8.0. The /api/tickets endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve… |
CVE-2020-11464 | Medium | 4.3 | 2020-04-01 | An issue was discovered in Deskpro before 2019.8.0. The /api/people endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve s… |
CVE-2020-7009 | High | 8.8 | 2020-03-31 | Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacke… |
CVE-2020-5291 | High | 7.2 | 2020-03-31 | Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the `bwrap --userns2` option ca… |
CVE-2020-10940 | High | 7.8 | 2020-03-27 | Local Privilege Escalation can occur in PHOENIX CONTACT PORTICO SERVER through 3.0.7 when installed to run as a service. |
CVE-2015-8534 | High | 7.8 | 2020-03-27 | MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was discovered (fixed and public… |
CVE-2015-7334 | High | 7.8 | 2020-03-27 | MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly… |
CVE-2015-7333 | High | 7.8 | 2020-03-27 | MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly… |
CVE-2020-8873 | Medium | 6.7 | 2020-03-23 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. An attacker must first obtain the… |
CVE-2020-10793 | High | 8.8 | 2020-03-23 | CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page. NOTE: A contributor to the… |
CVE-2019-19345 | High | 7.0 | 2020-03-20 | A vulnerability was found in all openshift/mediawiki-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file wa… |
CVE-2019-16071 | High | 8.8 | 2020-03-20 | Enigma NMS 65.0.0 and prior allows administrative users to create low-privileged accounts that do not have the ability to modify any settings in the system, on… |
CVE-2020-3265 | High | 7.8 | 2020-03-19 | A vulnerability in Cisco SD-WAN Solution software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system… |
CVE-2019-19355 | High | 7.0 | 2020-03-18 | An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ocp-release-operator-sdk. An attacker with access to the container co… |
CVE-2019-19351 | High | 7.0 | 2020-03-18 | An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/jenkins. An attacker with access to the container could use… |
CVE-2020-3950 | High | 7.8 | 2020-03-17 | VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contai… |
CVE-2020-7916 | Medium | 6.5 | 2020-03-16 | be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role v… |
CVE-2020-6584 | Medium | 6.5 | 2020-03-16 | Nagios Log Server 2.1.3 has Incorrect Access Control. |
CVE-2020-10589 | High | 7.8 | 2020-03-15 | v2rayL 2.1.3 allows local users to achieve root access because /etc/v2rayL/config.json is owned by a low-privileged user but contains commands that are execute… |
CVE-2020-10588 | High | 7.8 | 2020-03-15 | v2rayL 2.1.3 allows local users to achieve root access because /etc/v2rayL/add.sh and /etc/v2rayL/remove.sh are owned by a low-privileged user but execute as r… |
CVE-2020-10088 | High | 8.1 | 2020-03-13 | GitLab 12.5 through 12.8.1 has Insecure Permissions. Depending on particular group settings, it was possible for invited groups to be given the incorrect permi… |
CVE-2020-0799 | High | 7.8 | 2020-03-12 | An elevation of privilege vulnerability exists in Microsoft Windows when the Windows kernel fails to properly handle parsing of certain symbolic links, aka 'Wi… |
CVE-2020-0785 | High | 7.1 | 2020-03-12 | An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks, aka 'Windows User Profile Service E… |
CVE-2020-7254 | High | 7.7 | 2020-03-12 | Privilege Escalation vulnerability in the command line interface in McAfee Advanced Threat Defense (ATD) 4.x prior to 4.8.2 allows local users to execute arbit… |
CVE-2020-5253 | Low | 3.9 | 2020-03-10 | NetHack before version 3.6.0 allowed malicious use of escaping of characters in the configuration file (usually .nethackrc) which could be exploited. This bug… |
CVE-2020-8113 | Critical | 9.8 | 2020-03-06 | GitLab 10.7 and later through 12.7.2 has Incorrect Access Control. |
CVE-2020-6971 | High | 7.8 | 2020-03-05 | In Emerson ValveLink v12.0.264 to v13.4.118, a vulnerability in the ValveLink software may allow a local, unprivileged, trusted insider to escalate privileges… |
CVE-2019-12183 | High | 7.5 | 2020-03-02 | Incorrect Access Control in Safescan Timemoto TM-616 and TA-8000 series allows remote attackers to read any file via the administrative API. |
CVE-2020-6968 | High | 7.8 | 2020-02-20 | Honeywell INNCOM INNControl 3 allows workstation users to escalate application user privileges through the modification of local configuration files. |
CVE-2020-3112 | High | 8.8 | 2020-02-19 | A vulnerability in the REST API endpoint of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to elevate privileges on the… |
CVE-2013-6295 | Critical | 9.8 | 2020-02-18 | PrestaShop 1.5.5 vulnerable to privilege escalation via a Salesman account via upload module |
CVE-2013-3323 | Critical | 9.8 | 2020-02-18 | A Privilege Escalation Vulnerability exists in IBM Maximo Asset Management 7.5, 7.1, and 6.2, when WebSeal with Basic Authentication is used, due to a failure… |
CVE-2019-6195 | Medium | 4.8 | 2020-02-14 | An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user… |
CVE-2014-4170 | Critical | 9.8 | 2020-02-13 | A Privilege Escalation Vulnerability exists in Free Reprintables ArticleFR 11.06.2014 due to insufficient access restrictions in the data.php script, which cou… |
CVE-2020-0686 | High | 7.8 | 2020-02-11 | An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege… |
CVE-2020-1708 | High | 7.0 | 2020-02-07 | It has been found in openshift-enterprise version 3.11 and all openshift-enterprise versions from 4.1 to, including 4.3, that multiple containers modify the pe… |
CVE-2020-8655 | High | 7.8 | 2020-02-07 | An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability, allowing the apache user to run arbit… |
CVE-2015-2909 | Critical | 9.8 | 2020-02-06 | Dedicated Micros DV-IP Express, SD Advanced, SD, EcoSense, and DS2 devices rely on a GUI warning to help ensure that the administrator configures login credent… |
CVE-2016-9928 | High | 7.4 | 2020-02-06 | MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as an entity on a 3rd p… |
CVE-2015-3613 | Critical | 9.8 | 2020-02-04 | A vulnerability exists in in FortiManager 5.2.1 and earlier and 5.0.10 and earlier in the WebUI FTP backup page |
CVE-2020-5182 | Medium | 6.5 | 2020-02-03 | The J-BusinessDirectory extension before 5.2.9 for Joomla! allows Reverse Tabnabbing. In some configurations, the link to the business website can be entered b… |
CVE-2015-0949 | High | 7.8 | 2020-01-30 | The System Management Mode (SMM) implementation in Dell Latitude E6430 BIOS Revision A09, HP EliteBook 850 G1 BIOS revision L71 Ver. 01.09, and possibly other… |
CVE-2020-8092 | Low | 1.6 | 2020-01-30 | A privilege escalation vulnerability in BDLDaemon as used in Bitdefender Antivirus for Mac allows a local attacker to obtain authentication tokens for requests… |
CVE-2020-7908 | Medium | 4.3 | 2020-01-30 | In JetBrains TeamCity before 2019.1.5, reverse tabnabbing was possible on several pages. |
CVE-2013-4583 | High | 8.8 | 2020-01-28 | The parse_cmd function in lib/gitlab_shell.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1 and gitlab-shell… |
CVE-2019-5472 | High | 7.5 | 2020-01-28 | An authorization issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 that prevented owners and maintainer to delete epic comments. |
CVE-2019-5468 | High | 8.8 | 2020-01-28 | An privilege escalation issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 when Mattermost slash commands are used with a blocked accoun… |
CVE-2019-11288 | High | 7.0 | 2020-01-27 | In Pivotal tc Server, 3.x versions prior to 3.2.19 and 4.x versions prior to 4.0.10, and Pivotal tc Runtimes, 7.x versions prior to 7.0.99.B, 8.x versions prio… |
CVE-2020-3115 | High | 8.8 | 2020-01-26 | A vulnerability in the CLI of the Cisco SD-WAN Solution vManage software could allow an authenticated, local attacker to elevate privileges to root-level privi… |
CVE-2019-1454 | Medium | 5.5 | 2020-01-24 | An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks, aka 'Windows User Profile Service E… |
CVE-2018-8654 | Medium | 6.5 | 2020-01-24 | An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Server, aka 'Microsoft Dynamics 365 Elevation of Privilege Vulnerability'. |
CVE-2012-6302 | High | 7.8 | 2020-01-24 | Soapbox through 0.3.1: Sandbox bypass - runs a second instance of Soapbox within a sandboxed Soapbox. |