CWE-269 · Improper Privilege Management (page 28)
Page 28 of 32 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2012-4606 | High | 7.8 | 2020-01-23 | Citrix XenServer 4.1, 6.0, 5.6 SP2, 5.6 Feature Pack 1, 5.6 Common Criteria, 5.6, 5.5, 5.0, and 5.0 Update 3 contains a Local Privilege Escalation Vulnerabilit… |
CVE-2019-18899 | Medium | 6.2 | 2020-01-23 | The apt-cacher-ng package of openSUSE Leap 15.1 runs operations in user owned directory /run/apt-cacher-ng with root privileges. This can allow local attackers… |
CVE-2019-17202 | High | 7.8 | 2020-01-23 | FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at wil… |
CVE-2013-6773 | High | 7.8 | 2020-01-23 | Splunk 5.0.3 has an Unquoted Service Path in Windows for Universal Forwarder which can allow an attacker to escalate privileges |
CVE-2018-16272 | Critical | 9.8 | 2020-01-22 | The wpa_supplicant system service in Samsung Galaxy Gear series allows an unprivileged process to fully control the Wi-Fi interface, due to the lack of its D-B… |
CVE-2018-16271 | Medium | 6.5 | 2020-01-22 | The wemail_consumer_service (from the built-in application wemail) in Samsung Galaxy Gear series allows an unprivileged process to manipulate a user's mailbox… |
CVE-2018-16270 | High | 7.5 | 2020-01-22 | Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. This allows an unprivileged process to du… |
CVE-2018-16268 | Medium | 4.3 | 2020-01-22 | The SoundServer/FocusServer system services in Tizen allow an unprivileged process to perform media-related system actions, due to improper D-Bus security poli… |
CVE-2018-16267 | High | 8.1 | 2020-01-22 | The system-popup system service in Tizen allows an unprivileged process to perform popup-related system actions, due to improper D-Bus security policy configur… |
CVE-2018-16266 | High | 8.1 | 2020-01-22 | The Enlightenment system service in Tizen allows an unprivileged process to fully control or capture windows, due to improper D-Bus security policy configurati… |
CVE-2018-16265 | Medium | 6.5 | 2020-01-22 | The bt/bt_core system service in Tizen allows an unprivileged process to create a system user interface and control the Bluetooth pairing process, due to impro… |
CVE-2018-16263 | High | 8.8 | 2020-01-22 | The PulseAudio system service in Tizen allows an unprivileged process to control its A2DP MediaEndpoint, due to improper D-Bus security policy configurations… |
CVE-2018-16262 | High | 8.8 | 2020-01-22 | The pkgmgr system service in Tizen allows an unprivileged process to perform package management actions, due to improper D-Bus security policy configurations… |
CVE-2020-7047 | High | 8.8 | 2020-01-16 | The WordPress plugin, WP Database Reset through 3.1, contains a flaw that gave any authenticated user, with minimal permissions, the ability (with a simple wp-… |
CVE-2019-10940 | Critical | 9.9 | 2020-01-16 | A vulnerability has been identified in SINEMA Server (All versions < V14.0 SP2 Update 1). Incorrect session validation could allow an attacker with a valid ses… |
CVE-2019-15012 | High | 8.8 | 2020-01-15 | Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6… |
CVE-2015-5072 | Medium | 6.5 | 2020-01-15 | The BIRT Engine servlet in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users to "navigate" to a… |
CVE-2015-5071 | Medium | 6.5 | 2020-01-15 | AR System Mid Tier in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users to "navigate" to arbitr… |
CVE-2014-6448 | High | 7.8 | 2020-01-15 | Juniper Junos OS 13.2 before 13.2R5, 13.2X51, 13.2X52, and 13.3 before 13.3R3 allow local users to bypass intended restrictions and execute arbitrary Python co… |
CVE-2015-5466 | High | 7.8 | 2020-01-15 | Silicon Integrated Systems XGI WindowsXP Display Manager (aka XGI VGA Driver Manager and VGA Display Manager) 6.14.10.1090 allows local users to gain privilege… |
CVE-2015-7556 | High | 7.8 | 2020-01-15 | DeleGate 9.9.13 allows local users to gain privileges as demonstrated by the dgcpnod setuid program. |
CVE-2012-1563 | High | 7.5 | 2020-01-15 | Joomla! before 2.5.3 allows Admin Account Creation. |
CVE-2020-0635 | High | 7.8 | 2020-01-14 | An elevation of privilege vulnerability exists in Microsoft Windows when Windows fails to properly handle certain symbolic links, aka 'Windows Elevation of Pri… |
CVE-2012-4761 | High | 7.8 | 2020-01-13 | A Privilege Escalation vulnerability exists in the unquoted Service Binary in SDPAgent or SDBAgent in Safend Data Protector Agent 3.4.5586.9772, which could le… |
CVE-2012-4760 | High | 7.8 | 2020-01-13 | A Privilege Escalation vulnerability exists in the SDBagent service in Safend Data Protector Agent 3.4.5586.9772, which could let a local malicious user obtain… |
CVE-2020-6949 | High | 8.8 | 2020-01-13 | A privilege escalation issue was discovered in the postUser function in HashBrown CMS through 1.3.3. An editor user can change the password hash of an admin us… |
CVE-2019-19728 | High | 7.5 | 2020-01-13 | SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 executes srun --uid with incorrect privileges. |
CVE-2012-4767 | Medium | 6.1 | 2020-01-13 | An issue exists in Safend Data Protector Agent 3.4.5586.9772 in the securitylayer.log file in the logs.9972 directory, which could let a malicious user decrypt… |
CVE-2013-6231 | High | 8.8 | 2020-01-10 | SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script |
CVE-2019-19544 | High | 7.8 | 2020-01-08 | CA Automic Dollar Universe 5.3.3 contains a vulnerability, related to the uxdqmsrv binary being setuid root, that allows local attackers to elevate privileges… |
CVE-2016-6590 | High | 7.8 | 2020-01-08 | A privilege escalation vulnerability exists when loading DLLs during boot up and reboot in Symantec IT Management Suite 8.0 prior to 8.0 HF4 and Suite 7.6 prio… |
CVE-2019-14819 | High | 8.8 | 2020-01-07 | A flaw was found during the upgrade of an existing OpenShift Container Platform 3.x cluster. Using CRI-O, the dockergc service account is assigned to the curre… |
CVE-2019-19585 | High | 7.8 | 2020-01-06 | An issue was discovered in rConfig 3.9.3. The install script updates the /etc/sudoers file for rconfig specific tasks. After an "rConfig specific Apache config… |
CVE-2013-4161 | High | 7.8 | 2019-12-31 | gksu-polkit-0.0.3-6.fc18 was reported as fixing the issue in CVE-2012-5617 but the patch was improperly applied and it did not fixed the security issue. |
CVE-2019-7479 | High | 7.2 | 2019-12-31 | A vulnerability in SonicOS allow authenticated read-only admin can elevate permissions to configuration mode. This vulnerability affected SonicOS Gen 5 version… |
CVE-2013-2016 | High | 7.8 | 2019-12-30 | A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. If the virtio devic… |
CVE-2012-5663 | High | 7.5 | 2019-12-30 | The isearch package (textproc/isearch) before 1.47.01nb1 uses the tempnam() function to create insecure temporary files into a publicly-writable area (/tmp). |
CVE-2019-20074 | High | 8.8 | 2019-12-30 | On Netis DL4323 devices, any user role can view sensitive information, such as a user password or the FTP password, via the form2saveConf.cgi page. |
CVE-2013-5027 | Critical | 9.8 | 2019-12-27 | Collabtive 1.0 has incorrect access control |
CVE-2013-4975 | High | 8.8 | 2019-12-27 | Hikvision DS-2CD7153-E IP Camera has Privilege Escalation |
CVE-2013-4867 | Medium | 6.3 | 2019-12-27 | Electronic Arts Karotz Smart Rabbit 12.07.19.00 allows Python module hijacking |
CVE-2019-20043 | Medium | 4.3 | 2019-12-27 | In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a… |
CVE-2019-19151 | Medium | 5.5 | 2019-12-23 | On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IQ versions 7.0.0, 6.0.0-6.1.0, and 5.0.0-5.4.0, iW… |
CVE-2019-6685 | High | 7.8 | 2019-12-23 | On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, users with access to edit iRules are a… |
CVE-2012-2312 | High | 7.8 | 2019-12-18 | An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reuse… |
CVE-2019-5259 | Medium | 6.5 | 2019-12-16 | There is an information leakage vulnerability on some Huawei products(AR120-S;AR1200;AR1200-S;AR150;AR150-S;AR160;AR200;AR200-S;AR2200;AR2200-S;AR3200;AR3600)… |
CVE-2019-19783 | Medium | 6.5 | 2019-12-16 | An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-de… |
CVE-2019-5250 | High | 7.8 | 2019-12-13 | Mate 20 Pro smartphones with versions earlier than 9.1.0.135(C00E133R3P1) have an improper authorization vulnerability. The software does not properly restrict… |
CVE-2019-16777 | High | 7.7 | 2019-12-13 | Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritt… |
CVE-2019-19726 | High | 7.8 | 2019-12-12 | OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be defeated by setting a very small RLIMI… |
CVE-2019-13738 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in navigation in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass site isolation via a crafted HTML page. |
CVE-2013-0293 | High | 7.8 | 2019-12-10 | oVirt Node: Lock screen accepts F2 to drop to shell causing privilege escalation |
CVE-2019-2225 | High | 8.8 | 2019-12-06 | When pairing with a Bluetooth device, it may be possible to pair a malicious device without any confirmation from the user, and that device may be able to inte… |
CVE-2012-2148 | Low | 3.3 | 2019-12-06 | An issue exists in the property replacements feature in any descriptor in JBoxx AS 7.1.1 ignores java security policies |
CVE-2012-1615 | High | 7.8 | 2019-12-06 | A Privilege Escalation vulnerability exits in Fedoraproject Sectool due to an incorrect DBus file. |
CVE-2012-1104 | Medium | 5.3 | 2019-12-05 | A Security Bypass vulnerability exists in the phpCAS 1.2.2 library from the jasig project due to the way proxying of services are managed. |
CVE-2018-0728 | High | 7.5 | 2019-12-04 | This improper access control vulnerability in Helpdesk allows attackers to access the system logs. To fix the vulnerability, QNAP recommend updating QTS and He… |
CVE-2019-3990 | Medium | 4.3 | 2019-12-03 | A User Enumeration flaw exists in Harbor. The issue is present in the "/users" API endpoint. This endpoint is supposed to be restricted to administrators. This… |
CVE-2019-4465 | Low | 3.3 | 2019-12-03 | IBM Cloud Pak System 2.3 and 2.3.0.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 163774. |
CVE-2012-4480 | High | 7.8 | 2019-12-02 | mom creates world-writable pid files in /var/run |
CVE-2019-19014 | High | 7.8 | 2019-12-02 | An issue was discovered in TitanHQ WebTitan before 5.18. It has a sudoers file that enables low-privilege users to execute a vast number of commands as root, i… |
CVE-2019-6668 | Medium | 5.5 | 2019-11-27 | The BIG-IP APM Edge Client for macOS bundled with BIG-IP APM 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.1.0-13.1.1.5, 12.1.0-12.1.5, and 11.5.1-11.6.5… |
CVE-2013-2625 | Medium | 6.5 | 2019-11-27 | An Access Bypass issue exists in OTRS Help Desk before 3.2.4, 3.1.14, and 3.0.19, OTRS ITSM before 3.2.3, 3.1.8, and 3.0.7, and FAQ before 2.2.3, 2.1.4, and 2… |
CVE-2019-7319 | High | 8.3 | 2019-11-26 | An issue was discovered in Cloudera Hue 6.0.0 through 6.1.0. When using one of following authentication backends: LdapBackend, PamBackend, SpnegoDjangoBackend… |
CVE-2017-7399 | High | 8.8 | 2019-11-26 | Cloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.1 allows a read-only Cloudera Manager user to discover the usernames of other u… |
CVE-2015-7831 | High | 8.8 | 2019-11-26 | In Cloudera Hue, there is privilege escalation by a read-only user when CDH 5.x brefore 5.4.9 is used. |
CVE-2012-6639 | High | 8.8 | 2019-11-25 | An privilege elevation vulnerability exists in Cloud-init before 0.7.0 when requests to an untrusted system are submitted for EC2 instance data. |
CVE-2019-13705 | Medium | 4.3 | 2019-11-25 | Insufficient policy enforcement in extensions in Google Chrome prior to 78.0.3904.70 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2019-13702 | High | 7.8 | 2019-11-25 | Inappropriate implementation in installer in Google Chrome on Windows prior to 78.0.3904.70 allowed a local attacker to perform privilege escalation via a craf… |
CVE-2012-5617 | High | 7.8 | 2019-11-25 | gksu-polkit: permissive PolicyKit policy configuration file allows privilege escalation |
CVE-2019-3466 | High | 7.8 | 2019-11-20 | The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which coul… |
CVE-2011-3349 | High | 7.8 | 2019-11-19 | lightdm before 0.9.6 writes in .dmrc and Xauthority files using root permissions while the files are in user controlled folders. A local user can overwrite roo… |
CVE-2011-4954 | High | 7.8 | 2019-11-19 | cobbler has local privilege escalation via the use of insecure location for PYTHON_EGG_CACHE |
CVE-2018-18368 | High | 7.8 | 2019-11-15 | Symantec Endpoint Protection Manager (SEPM), prior to 14.2 RU1, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an… |
CVE-2011-2910 | Medium | 6.7 | 2019-11-15 | The AX.25 daemon (ax25d) in ax25-tools before 0.0.8-13 does not check the return value of a setuid call. The setuid call is responsible for dropping privileges… |
CVE-2019-15799 | High | 8.8 | 2019-11-14 | An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. User accounts created through the web interface of the device, when given… |
CVE-2019-14590 | Medium | 5.5 | 2019-11-14 | Improper access control in the API for the Intel(R) Graphics Driver versions before 26.20.100.7209 may allow an authenticated user to potentially enable inform… |
CVE-2019-15332 | Low | 3.3 | 2019-11-14 | The Lava Z61 Android device with a build fingerprint of LAVA/Z61_2GB/Z61_2GB:8.1.0/O11019/1533889281:user/release-keys contains a pre-installed app with a pack… |
CVE-2019-3651 | High | 8.8 | 2019-11-13 | Information Disclosure vulnerability in McAfee Advanced Threat Defense (ATD prior to 4.8 allows remote authenticated attackers to gain access to ePO as an admi… |
CVE-2010-4664 | High | 8.8 | 2019-11-13 | In ConsoleKit before 0.4.2, an intended security policy restriction bypass was found. This flaw allows an authenticated system user to escalate their privilege… |
CVE-2019-2193 | High | 7.8 | 2019-11-13 | In WelcomeActivity.java and related files, there is a possible permissions bypass due to a partially provisioned Device Policy Client. This could lead to local… |
CVE-2019-1405 | High | 7.8 | 2019-11-12 | An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP… |
CVE-2019-1388 | High | 7.8 | 2019-11-12 | An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Di… |
CVE-2019-18845 | High | 7.1 | 2019-11-09 | The MsIo64.sys and MsIo32.sys drivers in Patriot Viper RGB before 1.1 allow local users (including low integrity processes) to read and write to arbitrary memo… |
CVE-2019-18623 | Critical | 9.8 | 2019-11-08 | Escalation of privileges in EnergyCAP 7 through 7.5.6 allows an attacker to access data. If an unauthenticated user clicks on a link on the public dashboard, t… |
CVE-2006-4243 | Critical | 9.8 | 2019-11-06 | linux vserver 2.6 before 2.6.17 suffers from privilege escalation in remount code. |
CVE-2013-4251 | High | 7.8 | 2019-11-04 | The scipy.weave component in SciPy before 0.12.1 creates insecure temporary directories. |
CVE-2013-2012 | High | 7.3 | 2019-10-31 | autojump before 21.5.8 allows local users to gain privileges via a Trojan horse custom_install directory in the current working directory. |
CVE-2019-18365 | Medium | 4.3 | 2019-10-31 | In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages. |
CVE-2019-18425 | Critical | 9.8 | 2019-10-31 | An issue was discovered in Xen through 4.12.x allowing 32-bit PV guest OS users to gain guest OS privileges by installing and using descriptors. There is missi… |
CVE-2018-18931 | High | 8.8 | 2019-10-29 | An issue was discovered in the Tightrope Media Carousel digital signage product 7.0.4.104. Due to insecure default permissions on the C:\TRMS\Services director… |
CVE-2019-4546 | High | 8.8 | 2019-10-29 | After installing the IBM Maximo Health- Safety and Environment Manager 7.6.1, a user is granted additional privileges that they are not normally allowed to acc… |
CVE-2019-16897 | Critical | 9.8 | 2019-10-28 | In K7 Antivirus Premium 16.0.xxx through 16.0.0120; K7 Total Security 16.0.xxx through 16.0.0120; and K7 Ultimate Security 16.0.xxx through 16.0.0120, the modu… |
CVE-2019-10716 | High | 7.7 | 2019-10-21 | An Information Disclosure issue in Verodin Director 3.5.3.1 and earlier reveals usernames and passwords of integrated security technologies via a /integrations… |
CVE-2019-15901 | High | 8.8 | 2019-10-18 | An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. A setusercontext(3) call with flags to change the UID, primary GID… |
CVE-2019-17631 | Critical | 9.1 | 2019-10-17 | From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks. |
CVE-2019-16519 | High | 7.8 | 2019-10-14 | ESET Cyber Security 6.7.900.0 for macOS allows a local attacker to execute unauthorized commands as root by abusing an undocumented feature in scheduled tasks. |
CVE-2019-9745 | High | 7.8 | 2019-10-14 | CloudCTI HIP Integrator Recognition Configuration Tool allows privilege escalation via its EXQUISE integration. This tool communicates with a service (Recognit… |
CVE-2019-14838 | Medium | 4.9 | 2019-10-14 | A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime sta… |
CVE-2018-21025 | Critical | 9.8 | 2019-10-08 | In Centreon VM through 19.04.3, centreon-backup.pl allows attackers to become root via a crafted script, due to incorrect rights of sourced configuration files. |