CWE-269 · Improper Privilege Management (page 30)
Page 30 of 32 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-11965 | High | 7.8 | 2018-12-20 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Anyone can execute proptrigger.sh which will lead to… |
CVE-2018-1973 | High | 7.2 | 2018-12-20 | IBM API Connect 5.0.0.0 through 5.0.8.4 allows a user with limited 'API Administrator level access to give themselves full 'Administrator' level access through… |
CVE-2018-8619 | High | 7.5 | 2018-12-12 | A remote code execution vulnerability exists when the Internet Explorer VBScript execution policy does not properly restrict VBScript under specific conditions… |
CVE-2018-10143 | Critical | 9.8 | 2018-12-12 | The Palo Alto Networks Expedition Migration tool 1.0.107 and earlier may allow an unauthenticated attacker with remote access to run system level commands on t… |
CVE-2018-18344 | Medium | 6.5 | 2018-12-11 | Inappropriate allowance of the setDownloadBehavior devtools protocol feature in Extensions in Google Chrome prior to 71.0.3578.80 allowed a remote attacker wit… |
CVE-2018-1000866 | High | 8.8 | 2018-12-10 | A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer… |
CVE-2018-1000865 | High | 8.8 | 2018-12-10 | A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer… |
CVE-2018-19608 | Medium | 4.7 | 2018-12-05 | Arm Mbed TLS before 2.14.1, before 2.7.8, and before 2.1.17 allows a local unprivileged attacker to recover the plaintext of RSA decryption, which is used in R… |
CVE-2018-1941 | High | 8.4 | 2018-12-05 | IBM Campaign 9.1.0 and 9.1.2 could allow a local user to obtain admini privileges due to the application not validating access permissions. IBM X-Force ID: 153… |
CVE-2018-19853 | High | 8.8 | 2018-12-04 | An issue was discovered in hitshop through 2014-07-15. There is an elevation-of-privilege vulnerability (that allows control over the whole web site) via the a… |
CVE-2018-11912 | High | 7.8 | 2018-11-27 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper configuration of daemons may lead to unpriv… |
CVE-2018-11911 | High | 7.8 | 2018-11-27 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper configuration of script may lead to unprivi… |
CVE-2018-19411 | High | 8.8 | 2018-11-21 | PRTG Network Monitor before 18.2.40.1683 allows an authenticated user with a read-only account to create another user with a read-write account (including admi… |
CVE-2018-6080 | Medium | 6.5 | 2018-11-14 | Lack of access control checks in Instrumentation in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the renderer process to… |
CVE-2018-3635 | High | 7.8 | 2018-11-14 | Insufficient input validation in installer in Intel Rapid Store Technology (RST) before version 16.7 may allow an unprivileged user to potentially elevate priv… |
CVE-2018-2481 | High | 7.2 | 2018-11-13 | In some SAP standard roles, in SAP_ABA versions, 7.00 to 7.02, 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, 75C to 75D, a transaction code reserved for customer is us… |
CVE-2018-15762 | Critical | 9.0 | 2018-11-02 | Pivotal Operations Manager, versions 2.0.x prior to 2.0.24, versions 2.1.x prior to 2.1.15, versions 2.2.x prior to 2.2.7, and versions 2.3.x prior to 2.3.1, g… |
CVE-2018-15321 | Medium | 4.9 | 2018-10-31 | When BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.2.1-11.5.6, BIG-IQ Centralized Management 5.0.0-5.4.0 or 4.6.0, BIG-IQ Cl… |
CVE-2018-14828 | High | 7.8 | 2018-10-23 | Advantech WebAccess 8.3.1 and earlier has an improper privilege management vulnerability, which may allow an attacker to access those files and perform actions… |
CVE-2018-13400 | Medium | 4.7 | 2018-10-23 | Several administrative resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from… |
CVE-2018-15592 | High | 7.8 | 2018-10-15 | An issue was discovered in Ivanti Workspace Control before 10.3.10.0 and RES One Workspace. A local authenticated user can execute processes with elevated priv… |
CVE-2018-12596 | Critical | 9.8 | 2018-10-10 | Episerver Ektron CMS before 9.0 SP3 Site CU 31, 9.1 before SP3 Site CU 45, or 9.2 before SP2 Site CU 22 allows remote attackers to call aspx pages via the "act… |
CVE-2018-13802 | High | 7.2 | 2018-10-10 | A vulnerability has been identified in ROX II (All versions < V2.12.1). An authenticated attacker with a high-privileged user account access via SSH could circ… |
CVE-2018-13801 | High | 8.8 | 2018-10-10 | A vulnerability has been identified in ROX II (All versions < V2.12.1). An attacker with network access to port 22/tcp and valid low-privileged user credential… |
CVE-2018-17855 | High | 8.8 | 2018-10-09 | An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of an user who can approve admin verifications in the registra… |
CVE-2018-0438 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Umbrella Enterprise Roaming Client (ERC) could allow an authenticated, local attacker to elevate privileges to Administrator. To e… |
CVE-2018-0437 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Umbrella Enterprise Roaming Client (ERC) could allow an authenticated, local attacker to elevate privileges to Administrator. To e… |
CVE-2018-0436 | High | 8.7 | 2018-10-05 | A vulnerability in Cisco Webex Teams, formerly Cisco Spark, could allow an authenticated, remote attacker to view and modify data for an organization other tha… |
CVE-2018-0425 | Critical | 9.8 | 2018-10-05 | A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco… |
CVE-2018-0503 | Medium | 4.3 | 2018-10-04 | Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where contrary to the documentation, $wgRateLimits entry for 'user' overrides that for… |
CVE-2018-14808 | Medium | 6.5 | 2018-10-01 | Emerson AMS Device Manager v12.0 to v13.5. Non-administrative users are able to change executable and library files on the affected products. |
CVE-2015-9267 | Medium | 5.5 | 2018-10-01 | Nullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a loc… |
CVE-2018-1550 | Medium | 6.2 | 2018-09-26 | IBM Spectrum Protect 7.1 and 8.1 could allow a local user to corrupt or delete highly sensitive information that would cause a denial of service to other users… |
CVE-2018-11614 | High | 8.8 | 2018-09-24 | This vulnerability allows remote attackers to escalate privileges on vulnerable installations of Samsung Members Fixed in version 2.4.25. An attacker must firs… |
CVE-2018-10502 | High | 7.8 | 2018-09-24 | This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Galaxy Apps Fixed in version 4.2.18.2. An attacker must… |
CVE-2018-14825 | Medium | 5.8 | 2018-09-24 | On Honeywell Mobile Computers (CT60 running Android OS 7.1, CN80 running Android OS 7.1, CT40 running Android OS 7.1, CK75 running Android OS 6.0, CN75 running… |
CVE-2018-11786 | High | 8.8 | 2018-09-18 | In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any user with rights to th… |
CVE-2018-13799 | Critical | 9.1 | 2018-09-12 | A vulnerability has been identified in SIMATIC WinCC OA V3.14 and prior (All versions < V3.14-P021). Improper access control to a data point of the affected pr… |
CVE-2018-10853 | High | 7.0 | 2018-09-11 | A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilege(… |
CVE-2018-10514 | High | 7.8 | 2018-08-30 | A Missing Impersonation Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products could allow a local attacker to escalate privileges… |
CVE-2018-15912 | High | 7.8 | 2018-08-29 | An issue was discovered in manjaro-update-system.sh in manjaro-system 20180716-1 on Manjaro Linux. A local attacker can install or remove arbitrary packages an… |
CVE-2018-14791 | High | 7.8 | 2018-08-23 | Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 may allow non-administrative users to change executable and library files on the affected produc… |
CVE-2018-14787 | High | 7.8 | 2018-08-22 | In Philips' IntelliSpace Cardiovascular (ISCV) products (ISCV Version 2.x or prior and Xcelera Version 4.1 or prior), an attacker with escalated privileges cou… |
CVE-2017-2662 | Medium | 4.3 | 2018-08-22 | A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter (filter set on th… |
CVE-2018-1000648 | High | 8.8 | 2018-08-20 | LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Write vulnerability in Patient file letter functions that can result in Write… |
CVE-2018-1000634 | High | 7.2 | 2018-08-20 | The Open Microscopy Environment OMERO.server version 5.4.0 to 5.4.6 contains an Improper Access Control vulnerability in User management that can result in adm… |
CVE-2018-0428 | Medium | 6.7 | 2018-08-15 | A vulnerability in the account management subsystem of Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to elevate privileges to… |
CVE-2018-14836 | Medium | 6.5 | 2018-08-02 | Subrion 4.2.1 is vulnerable to Improper Access control because user groups not having access to the Admin panel are able to access it (but not perform actions)… |
CVE-2018-1999032 | Medium | 6.5 | 2018-08-01 | A data modification vulnerability exists in Jenkins Agiletestware Pangolin Connector for TestRail Plugin 2.1 and earlier in GlobalConfig.java that allows attac… |
CVE-2018-0613 | High | 8.8 | 2018-07-26 | NEC Platforms Calsos CSDX and CSDJ series products (CSDX 1.37210411 and earlier, CSDX(P) 4.37210411 and earlier, CSDX(D) 3.37210411 and earlier, CSDX(S) 2.3721… |
CVE-2018-10906 | Medium | 5.3 | 2018-07-24 | In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to moun… |
CVE-2018-0343 | High | 8.8 | 2018-07-18 | A vulnerability in the configuration and management service of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to execute arbitrary cod… |
CVE-2016-9489 | High | 8.8 | 2018-07-13 | In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e… |
CVE-2018-0024 | High | 7.8 | 2018-07-11 | An Improper Privilege Management vulnerability in a shell session of Juniper Networks Junos OS allows an authenticated unprivileged attacker to gain full contr… |
CVE-2018-3682 | High | 8.2 | 2018-07-10 | BMC Firmware in Intel server boards, compute modules, and systems potentially allow an attacker with administrative privileges to make unauthorized read\writes… |
CVE-2018-9853 | Critical | 9.8 | 2018-07-10 | Insecure access control in freeSSHd version 1.3.1 allows attackers to obtain the privileges of the freesshd.exe process by leveraging the ability to login to a… |
CVE-2018-5884 | High | 8.4 | 2018-07-06 | Improper Access Control in Multimedia in Snapdragon Mobile and Snapdragon Wear, Non-standard applications without permission may acquire permission of Qualcomm… |
CVE-2018-13405 | High | 7.8 | 2018-07-06 | The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenar… |
CVE-2018-9334 | Medium | 5.5 | 2018-07-03 | The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.8 and earlier, and PAN-OS 8.1.0 may allow an attac… |
CVE-2018-4845 | High | 8.8 | 2018-06-26 | A vulnerability has been identified in RAPIDLab 1200 systems / RAPIDPoint 400 systems / RAPIDPoint 500 systems (All versions_without_ use of Siemens Healthinee… |
CVE-2018-1000503 | Medium | 4.3 | 2018-06-26 | MyBB Group MyBB contains a Incorrect Access Control vulnerability in Private forums that can result in Users can view posts from private forums without having… |
CVE-2018-0610 | High | 7.2 | 2018-06-26 | Local file inclusion vulnerability in Zenphoto 1.4.14 and earlier allows a remote attacker with an administrative privilege to execute arbitrary code or obtain… |
CVE-2018-0573 | Medium | 5.3 | 2018-06-26 | baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction for a content to vi… |
CVE-2018-0566 | Medium | 4.3 | 2018-06-26 | Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass authentication to obtain the schedules without access privilege via unspecified vectors. |
CVE-2018-12884 | Medium | 6.5 | 2018-06-26 | In Octopus Deploy 3.0 onwards (before 2018.6.7), an authenticated user with incorrect permissions may be able to create Accounts under the Infrastructure menu. |
CVE-2017-2672 | Medium | 6.5 | 2018-06-21 | A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with access to the foreman log file would be able… |
CVE-2018-9022 | Critical | 9.8 | 2018-06-18 | An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary code or commands by poiso… |
CVE-2018-9021 | Critical | 9.8 | 2018-06-18 | An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary commands with specially c… |
CVE-2018-5756 | Medium | 4.3 | 2018-06-16 | The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 does no… |
CVE-2018-1460 | High | 8.4 | 2018-06-15 | IBM Netezza Platform Software (IBM PureData System for Analytics 1.0.0) could allow a local user to modify a world writable file, which could be used to execut… |
CVE-2018-12261 | Medium | 4.4 | 2018-06-12 | An issue was discovered on Momentum Axel 720P 5.1.8 devices. All processes run as root. |
CVE-2018-5166 | High | 7.5 | 2018-06-11 | WebExtensions can use request redirection and a "filterReponseData" filter to bypass host permission settings to redirect network traffic and access content fr… |
CVE-2017-7803 | High | 7.5 | 2018-06-11 | When a page's content security policy (CSP) header contains a "sandbox" directive, other directives are ignored. This results in the incorrect enforcement of C… |
CVE-2017-7782 | Medium | 5.3 | 2018-06-11 | An error in the "WindowsDllDetourPatcher" where a RWX ("Read/Write/Execute") 4k block is allocated but never protected, violating DEP protections. Note: This a… |
CVE-2017-7767 | Medium | 5.5 | 2018-06-11 | The Mozilla Maintenance Service can be invoked by an unprivileged user to overwrite arbitrary files with junk data using the Mozilla Windows Updater, which run… |
CVE-2017-5409 | Medium | 5.5 | 2018-06-11 | The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a special path to the callback parameter throug… |
CVE-2018-11190 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 2 of 6). |
CVE-2018-1495 | Medium | 6.5 | 2018-05-29 | IBM FlashSystem V840 and V900 products could allow an authenticated attacker with specialized access to overwrite arbitrary files which could cause a denial of… |
CVE-2018-6674 | Medium | 6.8 | 2018-05-25 | Privilege Escalation vulnerability in Microsoft Windows client (McTray.exe) in McAfee VirusScan Enterprise (VSE) 8.8 prior to Patch 13 allows local users to sp… |
CVE-2018-1134 | Medium | 6.5 | 2018-05-25 | An issue was discovered in Moodle 3.x. Students who submitted assignments and exported them to portfolios can download any stored Moodle file by changing the d… |
CVE-2017-14187 | Medium | 6.2 | 2018-05-24 | A local privilege escalation and local code execution vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8, and 5.2 and below versions allows attac… |
CVE-2018-11323 | High | 8.8 | 2018-05-22 | An issue was discovered in Joomla! Core before 3.8.8. Inadequate checks allowed users to modify the access levels of user groups with higher permissions. |
CVE-2018-1000400 | High | 8.8 | 2018-05-18 | Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error (CWE-270) vulnerability in the handling of ambient capabilities that can res… |
CVE-2018-8841 | High | 7.8 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-8853 | High | 8.8 | 2018-05-04 | Philips Brilliance CT devices operate user functions from within a contained kiosk in a Microsoft Windows operating system. Windows boots by default with eleva… |
CVE-2018-10168 | High | 8.8 | 2018-05-03 | TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows do not control privileges for usage of the Web API, allowing a low-privilege u… |
CVE-2018-0245 | Medium | 5.3 | 2018-05-02 | A vulnerability in the REST API of Cisco 5500 and 8500 Series Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to view sy… |
CVE-2018-10550 | High | 7.5 | 2018-04-30 | In Octopus Deploy before 2018.4.7, target and tenant tag variable scopes were not checked against the list of tenants the user has access to. |
CVE-2018-10079 | High | 7.8 | 2018-04-20 | Geist WatchDog Console 3.2.2 uses a weak ACL for the C:\ProgramData\WatchDog Console directory, which allows local users to modify configuration data by updati… |
CVE-2018-10190 | High | 7.8 | 2018-04-17 | A vulnerability in London Trust Media Private Internet Access (PIA) VPN Client v77 for Windows could allow an unauthenticated, local attacker to run executable… |
CVE-2018-10172 | High | 8.8 | 2018-04-16 | 7-Zip through 18.01 on Windows implements the "Large memory pages" option by calling the LsaAddAccountRights function to add the SeLockMemoryPrivilege privileg… |
CVE-2018-4173 | Medium | 5.5 | 2018-04-13 | An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. The issue involves the "Status Bar" component… |
CVE-2017-0358 | High | 7.8 | 2018-04-13 | Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elev… |
CVE-2017-5703 | Medium | 6.0 | 2018-04-03 | Configuration of SPI Flash in platforms based on multiple Intel platforms allow a local attacker to alter the behavior of the SPI flash potentially leading to… |
CVE-2018-1000141 | Critical | 9.1 | 2018-03-23 | I, Librarian version 4.9 and earlier contains an Incorrect Access Control vulnerability in ajaxdiscussion.php that can result in any users gaining unauthorized… |
CVE-2017-0935 | High | 8.8 | 2018-03-22 | Ubiquiti Networks EdgeOS version 1.9.1.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of protection of the file system… |
CVE-2017-0934 | High | 8.8 | 2018-03-22 | Ubiquiti Networks EdgeOS version 1.9.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of protection of the file system le… |
CVE-2017-0932 | High | 8.8 | 2018-03-22 | Ubiquiti Networks EdgeOS version 1.9.1.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of validation on the input of the… |
CVE-2017-5736 | High | 8.8 | 2018-03-20 | An elevation of privilege in Intel Software Guard Extensions Platform Software Component before 1.9.105.42329 allows a local attacker to execute arbitrary code… |
CVE-2017-8187 | High | 7.2 | 2018-03-20 | Huawei FusionSphere OpenStack V100R006C00SPC102(NFV) has a privilege escalation vulnerability. Due to improper privilege restrictions, an attacker with high pr… |