CWE-269 · Improper Privilege Management (page 29)
Page 29 of 32 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-15747 | High | 8.8 | 2019-10-07 | SITOS six Build v6.2.1 allows a user with the user role of Seminar Coordinator to escalate their permission to the Systemadministrator role due to insufficient… |
CVE-2019-4112 | Low | 3.3 | 2019-09-30 | IBM WebSphere eXtreme Scale 8.6 Admin Console allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 158105. |
CVE-2018-9425 | High | 7.8 | 2019-09-27 | In Platform, there is a possible bypass of user interaction requirements due to missing permission checks. This could lead to local escalation of privilege wit… |
CVE-2019-14220 | Medium | 6.5 | 2019-09-24 | An issue was discovered in BlueStacks 4.110 and below on macOS and on 4.120 and below on Windows. BlueStacks employs Android running in a virtual machine (VM)… |
CVE-2019-11280 | High | 8.8 | 2019-09-20 | Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.18, 2.4.x prior to 2.4.14, 2.5.x prior to 2.5.10, and 2.6.x prior to… |
CVE-2016-11011 | Medium | 6.5 | 2019-09-20 | The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation. |
CVE-2016-11004 | High | 8.8 | 2019-09-20 | The Elegant Themes Monarch plugin before 1.2.7 for WordPress has privilege escalation. |
CVE-2016-11003 | High | 8.8 | 2019-09-20 | The Elegant Themes Bloom plugin before 1.1.1 for WordPress has privilege escalation. |
CVE-2016-11002 | High | 8.8 | 2019-09-20 | The Elegant Themes Extra theme before 1.2.4 for WordPress has privilege escalation. |
CVE-2015-9390 | Medium | 4.3 | 2019-09-20 | The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wp_ajax functions are mishandled. |
CVE-2019-4477 | Medium | 6.5 | 2019-09-17 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a user with access to audit logs to obtain sensitive information, caused by improper handli… |
CVE-2016-10972 | Critical | 9.8 | 2019-09-16 | The newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel. |
CVE-2016-10971 | Critical | 9.8 | 2019-09-16 | The MemberSonic Lite plugin before 1.302 for WordPress has incorrect login access control because only knowlewdge of an e-mail address is required. |
CVE-2016-10968 | High | 8.8 | 2019-09-16 | The peepso-core plugin before 1.6.1 for WordPress has PeepSoProfilePreferencesAjax->save() privilege escalation. |
CVE-2019-1215 | High | 7.8 | 2019-09-11 | An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerabili… |
CVE-2019-16202 | Medium | 6.5 | 2019-09-10 | MISP before 2.4.115 allows privilege escalation in certain situations. After updating to 2.4.115, escalation attempts are blocked by the __checkLoggedActions f… |
CVE-2017-18596 | High | 8.8 | 2019-09-10 | The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions. |
CVE-2019-6997 | Medium | 4.3 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting in 10.7) and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7… |
CVE-2019-6996 | Medium | 4.3 | 2019-09-09 | An issue was discovered in GitLab Enterprise Edition 10.x (starting in 10.6) and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Inc… |
CVE-2019-6794 | Medium | 4.3 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclos… |
CVE-2019-6789 | Medium | 4.3 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclos… |
CVE-2018-21013 | Critical | 9.8 | 2019-09-09 | The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors involving xmlPath t… |
CVE-2019-9443 | Medium | 6.7 | 2019-09-06 | In the Android kernel in the vl53L0 driver there is a possible out of bounds write due to a permissions bypass. This could lead to local escalation of privileg… |
CVE-2019-1939 | High | 8.8 | 2019-09-05 | A vulnerability in the Cisco Webex Teams client for Windows could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected system… |
CVE-2019-4536 | Medium | 6.3 | 2019-08-29 | IBM i 7.4 users who have done a Restore User Profile (RSTUSRPRF) on a system which has been configured with Db2 Mirror for i might have user profiles with elev… |
CVE-2019-15720 | High | 7.8 | 2019-08-28 | CloudBerry Backup v6.1.2.34 allows local privilege escalation via a Pre or Post backup action. With only user-level access, a user can modify the backup plan a… |
CVE-2019-4448 | High | 7.8 | 2019-08-26 | IBM DB2 High Performance Unload load for LUW 6.1, 6.1.0.1, 6.1.0.1 IF1, 6.1.0.2, 6.1.0.2 IF1, and 6.1.0.1 IF2 db2hpum and db2hpum_debug binaries are setuid roo… |
CVE-2019-11551 | Medium | 5.5 | 2019-08-21 | In Code42 Enterprise and Crashplan for Small Business through Client version 6.9.1, an attacker can craft a restore request to restore a file through the Code4… |
CVE-2019-11521 | High | 8.1 | 2019-08-20 | OX App Suite 7.10.1 allows Content Spoofing. |
CVE-2019-12889 | High | 7.0 | 2019-08-20 | An unauthenticated privilege escalation exists in SailPoint Desktop Password Reset 7.2. A user with local access to only the Windows logon screen can escalate… |
CVE-2019-1177 | High | 7.0 | 2019-08-14 | An elevation of privilege vulnerability exists in the way that the rpcss.dll handles objects in memory. An attacker who successfully exploited the vulnerabilit… |
CVE-2019-1175 | High | 7.0 | 2019-08-14 | An elevation of privilege vulnerability exists in the way that the psmsrv.dll handles objects in memory. An attacker who successfully exploited the vulnerabili… |
CVE-2019-1162 | High | 7.8 | 2019-08-14 | An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC). An attacker who successfully expl… |
CVE-2019-12618 | Critical | 9.8 | 2019-08-12 | HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver. |
CVE-2019-11270 | High | 7.5 | 2019-08-05 | Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the r… |
CVE-2019-1010178 | Critical | 9.8 | 2019-07-24 | Fred MODX Revolution < 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/component… |
CVE-2019-11553 | High | 8.8 | 2019-07-19 | In Code42 for Enterprise through 6.8.4, an administrator without web restore permission but with the ability to manage users in an organization can impersonate… |
CVE-2019-1010066 | High | 7.5 | 2019-07-18 | Lawrence Livermore National Laboratory msr-safe v1.1.0 is affected by: Incorrect Access Control. The impact is: An attacker could modify model specific registe… |
CVE-2019-12731 | High | 7.8 | 2019-07-12 | The Windows versions of Snapview Mikogo, versions before 5.10.2 are affected by insecure implementations which allow local attackers to escalate privileges. |
CVE-2019-7278 | Medium | 6.5 | 2019-07-01 | Optergy Proton/Enterprise devices have an Unauthenticated SMS Sending Service. |
CVE-2018-15557 | High | 8.8 | 2019-06-27 | An issue was discovered in the Quantenna WiFi Controller on Telus Actiontec WEB6000Q v1.1.02.22 devices. An attacker can statically set his/her IP to anything… |
CVE-2019-3735 | High | 7.8 | 2019-06-20 | Dell SupportAssist for Business PCs version 2.0 and Dell SupportAssist for Home PCs version 2.2, 2.2.1, 2.2.2, 2.2.3, 3.0, 3.0.1, 3.0.2, 3.1, 3.2, and 3.2.1 co… |
CVE-2019-4177 | Low | 3.3 | 2019-06-17 | IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-F… |
CVE-2019-4174 | Low | 3.3 | 2019-06-17 | IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-F… |
CVE-2019-1007 | High | 7.8 | 2019-06-12 | An elevation of privilege exists in Windows Audio Service. An attacker who successfully exploited the vulnerability could run arbitrary code with elevated priv… |
CVE-2019-12794 | Medium | 6.6 | 2019-06-11 | An issue was discovered in MISP 2.4.108. Organization admins could reset credentials for site admins (organization admins have the inherent ability to reset pa… |
CVE-2019-12775 | High | 8.8 | 2019-06-07 | An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They allow high-privileged… |
CVE-2019-4218 | Low | 3.3 | 2019-06-06 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Forc… |
CVE-2019-4048 | Low | 2.1 | 2019-06-06 | IBM Maximo Asset Management 7.6 could allow a physical user of the system to obtain sensitive information from a previous user of the same machine. IBM X-Force… |
CVE-2019-12176 | High | 7.8 | 2019-06-03 | Privilege escalation in the "HTC Account Service" and "ViveportDesktopService" in HTC VIVEPORT before 1.0.0.36 allows local attackers to escalate privileges to… |
CVE-2019-10144 | High | 7.7 | 2019-06-03 | rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` are given all capabilities du… |
CVE-2019-11896 | High | 7.1 | 2019-05-29 | A potential incorrect privilege assignment vulnerability exists in the 3rd party pairing mechanism of the Bosch Smart Home Controller (SHC) before 9.8.907 that… |
CVE-2019-11893 | High | 8.0 | 2019-05-29 | A potential incorrect privilege assignment vulnerability exists in the app permission update API of the Bosch Smart Home Controller (SHC) before 9.8.905 that m… |
CVE-2019-11891 | High | 8.0 | 2019-05-29 | A potential incorrect privilege assignment vulnerability exists in the app pairing mechanism of the Bosch Smart Home Controller (SHC) before 9.8.905 that may r… |
CVE-2019-7394 | High | 8.8 | 2019-05-28 | A privilege escalation vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA… |
CVE-2019-1000 | Medium | 5.3 | 2019-05-16 | An elevation of privilege vulnerability exists in Microsoft Azure Active Directory Connect build 1.3.20.0, which allows an attacker to execute two PowerShell c… |
CVE-2019-0301 | High | 8.8 | 2019-05-14 | Under certain conditions, it is possible to request the modification of role or privilege assignments through SAP Identity Management REST Interface Version 2… |
CVE-2019-11888 | Critical | 9.8 | 2019-05-13 | Go through 1.12.5 on Windows mishandles process creation with a nil environment in conjunction with a non-nil token, which allows attackers to obtain sensitive… |
CVE-2019-6617 | Medium | 6.5 | 2019-05-03 | On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, a user with the Resource Administrator role is able to overwrite… |
CVE-2019-3805 | Medium | 4.7 | 2019-05-03 | A flaw was discovered in wildfly versions up to 16.0.0.Final that would allow local users who are able to execute init.d script to terminate arbitrary processe… |
CVE-2019-11632 | High | 8.1 | 2019-05-01 | In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUnscoped or VariableEditUnscoped permissi… |
CVE-2018-15207 | High | 7.2 | 2019-04-30 | BPC SmartVista 2 has Improper Access Control in the SVFE module, where it fails to appropriately restrict access: a normal user is able to access the SVFE2/pag… |
CVE-2019-4047 | Medium | 4.3 | 2019-04-29 | IBM Jazz Reporting Service (JRS) 6.0.6 could allow an authenticated user to access the execution log files as a guest user, and obtain the information of the s… |
CVE-2019-3843 | High | 7.8 | 2019-04-26 | It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID… |
CVE-2019-4222 | Medium | 4.3 | 2019-04-25 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 could allow an authenticated user to view process definition of a business process without per… |
CVE-2019-3789 | Medium | 6.5 | 2019-04-24 | Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platfor… |
CVE-2019-3786 | High | 7.1 | 2019-04-24 | Cloud Foundry BOSH Backup and Restore CLI, all versions prior to 1.5.0, does not check the authenticity of backup scripts in BOSH. A remote authenticated malic… |
CVE-2019-10239 | High | 7.8 | 2019-04-24 | Robotronic RunAsSpc 3.7.0.0 protects stored credentials insufficiently, which allows locally authenticated attackers (under the same user context) to obtain cl… |
CVE-2019-7155 | Medium | 6.5 | 2019-04-16 | An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has In… |
CVE-2018-4008 | High | 7.8 | 2019-04-15 | An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the RunVpncScript command. The command takes a user-supplie… |
CVE-2019-6525 | High | 8.8 | 2019-04-11 | AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of system processes and inter-node communica… |
CVE-2019-6287 | High | 8.1 | 2019-04-10 | In Rancher 2.0.0 through 2.1.5, project members have continued access to create, update, read, and delete namespaces in a project after they have been removed… |
CVE-2019-0735 | High | 7.8 | 2019-04-09 | An elevation of privilege vulnerability exists when the Windows Client Server Run-Time Subsystem (CSRSS) fails to properly handle objects in memory, aka 'Windo… |
CVE-2018-14894 | High | 7.8 | 2019-04-09 | CyberArk Endpoint Privilege Manager 10.2.1.603 and earlier allows an attacker (who is able to edit permissions of a file) to bypass intended access restriction… |
CVE-2017-17544 | High | 7.2 | 2019-04-09 | A privilege escalation vulnerability in Fortinet FortiOS 6.0.0 to 6.0.6, 5.6.0 to 5.6.10, 5.4 and below allows admin users to elevate their profile to super_ad… |
CVE-2019-10676 | Medium | 6.5 | 2019-04-08 | An issue was discovered in Uniqkey Password Manager 1.14. Upon entering new credentials to a site that is not registered within this product, a pop-up window w… |
CVE-2018-4310 | Critical | 10.0 | 2019-04-03 | An access issue was addressed with additional sandbox restrictions. This issue affected versions prior to iOS 12, macOS Mojave 10.14. |
CVE-2019-1754 | High | 8.8 | 2019-03-28 | A vulnerability in the authorization subsystem of Cisco IOS XE Software could allow an authenticated but unprivileged (level 1), remote attacker to run privile… |
CVE-2018-19648 | High | 8.8 | 2019-03-27 | An issue was discovered in ADTRAN PMAA 1.6.2-1, 1.6.3, and 1.6.4. NETCONF Access Management (NACM) allows unprivileged users to create privileged users and exe… |
CVE-2019-3849 | High | 8.8 | 2019-03-26 | A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed… |
CVE-2018-16838 | Medium | 5.4 | 2019-03-25 | A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side… |
CVE-2019-5415 | High | 7.5 | 2019-03-21 | A bug in handling the ignore files and directories feature in serve 6.5.3 allows an attacker to read a file or list the directory that the victim has not allow… |
CVE-2018-11767 | High | 7.4 | 2019-03-21 | In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default gro… |
CVE-2018-18252 | High | 7.8 | 2019-03-15 | An issue was discovered in CapMon Access Manager 5.4.1.1005. CALRunElevated.exe provides "NT AUTHORITY\SYSTEM" access to unprivileged users via the --system op… |
CVE-2019-6601 | Medium | 5.5 | 2019-03-13 | In BIG-IP 13.0.0, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, the Application Acceleration Manager (AAM) wamd process used in processing of images and… |
CVE-2019-3785 | High | 8.1 | 2019-03-13 | Cloud Foundry Cloud Controller, versions prior to 1.78.0, contain an endpoint with improper authorization. A remote authenticated malicious user with read perm… |
CVE-2019-9624 | High | 7.8 | 2019-03-07 | Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Download" privileges to upload a crafted… |
CVE-2019-1588 | Medium | 4.4 | 2019-03-06 | A vulnerability in the Cisco Nexus 9000 Series Fabric Switches running in Application-Centric Infrastructure (ACI) mode could allow an authenticated, local att… |
CVE-2018-19725 | Critical | 9.8 | 2019-03-05 | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a security bypass vulnera… |
CVE-2018-5839 | High | 7.1 | 2019-02-25 | Improperly configured memory protection allows read/write access to modem image from HLOS kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IO… |
CVE-2019-3475 | High | 7.8 | 2019-02-20 | A local privilege escalation vulnerability in the famtd component of Micro Focus Filr 3.0 allows a local attacker authenticated as a low privilege user to esca… |
CVE-2019-5768 | Medium | 6.5 | 2019-02-19 | DevTools API not correctly gating on extension capability in DevTools in Google Chrome prior to 72.0.3626.81 allowed an attacker who convinced a user to instal… |
CVE-2018-19012 | High | 7.8 | 2019-01-28 | Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. Via a specific dialo… |
CVE-2018-19635 | Critical | 9.8 | 2019-01-22 | CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to escalate privileges in the user interface. |
CVE-2017-6924 | High | 7.4 | 2019-01-15 | In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does no… |
CVE-2018-16888 | Medium | 4.7 | 2019-01-14 | It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged u… |
CVE-2018-0671 | Medium | 6.7 | 2019-01-09 | Privilege escalation vulnerability in INplc-RT 3.08 and earlier allows an attacker with administrator rights to execute arbitrary code on the Windows system vi… |
CVE-2018-1000624 | High | 7.5 | 2018-12-28 | Battelle V2I Hub 2.5.1 is vulnerable to a denial of service, caused by the failure to restrict access to a sensitive functionality. By visiting http://V2I_HUB/… |
CVE-2018-20193 | High | 8.8 | 2018-12-21 | Certain Secure Access SA Series SSL VPN products (originally developed by Juniper Networks but now sold and supported by Pulse Secure, LLC) allow privilege esc… |
CVE-2018-15331 | High | 7.8 | 2018-12-20 | On BIG-IP AAM 13.0.0 or 12.1.0-12.1.3.7, the dcdb_convert utility used by BIG-IP AAM fails to drop group permissions when executing helper scripts, which could… |