CWE-269 · Improper Privilege Management (page 31)
Page 31 of 32 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-4844 | Medium | 6.7 | 2018-03-20 | A vulnerability has been identified in SIMATIC WinCC OA UI for Android (All versions < V3.15.10), SIMATIC WinCC OA UI for iOS (All versions < V3.15.10). Insuff… |
CVE-2018-1000133 | High | 7.5 | 2018-03-16 | Pitchfork version 1.4.6 RC1 contains an Improper Privilege Management vulnerability in Trident Pitchfork components that can result in A standard unprivileged… |
CVE-2018-1182 | High | 7.8 | 2018-03-08 | An issue was discovered in EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels (hardware appliance and software bundle deployment… |
CVE-2017-6152 | Medium | 6.7 | 2018-03-08 | A local user on F5 BIG-IQ Centralized Management 5.1.0-5.2.0 with the Access Manager role has privileges to change the passwords of other users on the system… |
CVE-2018-0821 | High | 7.0 | 2018-02-15 | AppContainer in Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability… |
CVE-2018-1000028 | High | 7.4 | 2018-02-09 | Linux kernel version after commit bdcf0a423ea1 - 4.15-rc4+, 4.14.8+, 4.9.76+, 4.4.111+ contains a Incorrect Access Control vulnerability in NFS server (nfsd) t… |
CVE-2017-10690 | Medium | 6.5 | 2018-02-09 | In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was… |
CVE-2017-10689 | Medium | 5.5 | 2018-02-09 | In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this… |
CVE-2018-1368 | Medium | 4.4 | 2018-02-09 | IBM Security Guardium Database Activity Monitor 9.0, 9.1, and 9.5 could allow a local user with low privileges to view report pages and perform some actions th… |
CVE-2017-15536 | High | 8.8 | 2018-02-05 | An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.x before 1.2.0. Several web application vulnerabilities allow malicious authenticated users… |
CVE-2018-5706 | High | 8.8 | 2018-01-16 | An issue was discovered in Octopus Deploy before 4.1.9. Any user with user editing permissions can modify teams to give themselves Administer System permission… |
CVE-2018-0010 | Medium | 6.5 | 2018-01-10 | A vulnerability in the Juniper Networks Junos Space Security Director allows a user who does not have SSH access to a device to reuse the URL that was created… |
CVE-2017-1493 | Medium | 5.4 | 2018-01-09 | IBM UrbanCode Deploy (UCD) 6.1 and 6.2 could allow an authenticated user to edit objects that they should not have access to due to improper access controls. I… |
CVE-2018-0751 | High | 7.1 | 2018-01-04 | The Windows Kernel API in Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Serve… |
CVE-2018-0748 | High | 7.8 | 2018-01-04 | The Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703… |
CVE-2018-4862 | High | 8.8 | 2018-01-03 | In Octopus Deploy versions 3.2.11 - 4.1.5 (fixed in 4.1.6), an authenticated user with ProcessEdit permission could reference an Azure account in such a way as… |
CVE-2017-9944 | Critical | 9.8 | 2017-12-27 | A vulnerability has been identified in Siemens 7KT PAC1200 data manager (7KT1260) in all versions < V2.03. The integrated web server (port 80/tcp) of the affec… |
CVE-2017-5254 | High | 8.8 | 2017-12-20 | In version 3.5 and prior of Cambium Networks ePMP firmware, the non-administrative users 'installer' and 'home' have the capability of changing passwords for o… |
CVE-2017-14380 | Medium | 6.7 | 2017-12-13 | In EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1.1, 8.0.0.0 - 8.0.0.4, 7.2.1.0 - 7.2.1.5, 7.2.0.x, and 7.1.1.x, a malicious compliance admin (compadmin) account us… |
CVE-2017-11319 | High | 8.8 | 2017-12-11 | Perspective ICM Investigation & Case 5.1.1.16 allows remote authenticated users to modify access level permissions and consequently gain privileges by leveragi… |
CVE-2017-17384 | High | 8.8 | 2017-12-07 | ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job. |
CVE-2017-13165 | Medium | 5.3 | 2017-12-06 | An elevation of privilege vulnerability in the kernel file system. Product: Android. Versions: Android kernel. Android ID A-31269937. |
CVE-2017-15055 | High | 8.1 | 2017-11-27 | TeamPass before 2.1.27.9 does not properly enforce item access control when requesting items.queries.php. It is then possible to copy any arbitrary item into a… |
CVE-2017-15053 | Medium | 4.9 | 2017-11-27 | TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting roles.queries.php. It is then possible for a manager user to modify a… |
CVE-2017-15052 | Medium | 4.9 | 2017-11-27 | TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting users.queries.php. It is then possible for a manager user to delete a… |
CVE-2017-1000241 | High | 8.1 | 2017-11-17 | The application OpenEMR version 5.0.0, 5.0.1-dev and prior is affected by vertical privilege escalation vulnerability. This vulnerability can allow an authenti… |
CVE-2017-12635 | Critical | 9.8 | 2017-11-14 | Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to subm… |
CVE-2017-16520 | High | 7.5 | 2017-11-11 | Inedo BuildMaster before 5.8.2 does not properly restrict creation of RequireManageAllPrivileges event listeners. |
CVE-2017-14031 | High | 7.8 | 2017-11-06 | An Improper Access Control issue was discovered in Trihedral VTScada 11.3.03 and prior. A local, non-administrator user has privileges to read and write to the… |
CVE-2017-1000156 | Medium | 6.5 | 2017-11-03 | Mahara 15.04 before 15.04.9 and 15.10 before 15.10.5 and 16.04 before 16.04.3 are vulnerable to a group's configuration page being editable by any group member… |
CVE-2017-9450 | High | 7.8 | 2017-10-30 | The Amazon Web Services (AWS) CloudFormation bootstrap tools package (aka aws-cfn-bootstrap) before 1.4-19.10 allows local users to execute arbitrary code with… |
CVE-2017-5084 | Low | 3.3 | 2017-10-27 | Inappropriate implementation in image-burner in Google Chrome OS prior to 59.0.3071.92 allowed a local attacker to read local files via dbus-send commands to a… |
CVE-2017-15917 | Medium | 6.5 | 2017-10-26 | In Paessler PRTG Network Monitor 17.3.33.2830, it's possible to create a Map as a read-only user, by forging a request and sending it to the server. |
CVE-2017-14330 | Medium | 6.7 | 2017-10-23 | Extreme EXOS 16.x, 21.x, and 22.x allows administrators to obtain a root shell via vectors involving a privileged process. |
CVE-2017-14329 | Medium | 6.7 | 2017-10-23 | Extreme EXOS 16.x, 21.x, and 22.x allows administrators to obtain a root shell via vectors involving an exsh debug shell. |
CVE-2017-10292 | Low | 2.3 | 2017-10-19 | Vulnerability in the RDBMS Security component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Easily explo… |
CVE-2017-15014 | Medium | 4.3 | 2017-10-13 | OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design gap, which allows authenticated users to… |
CVE-2017-15013 | High | 8.8 | 2017-10-13 | OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design gap, which allows an authenticated user t… |
CVE-2017-10857 | Medium | 4.3 | 2017-10-12 | Cybozu Office 10.0.0 to 10.6.1 allows authenticated attackers to bypass access restriction to perform arbitrary actions via "Cabinet" function. |
CVE-2017-5722 | High | 7.5 | 2017-10-11 | Incorrect policy enforcement in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows attackers with… |
CVE-2017-13721 | Medium | 4.7 | 2017-10-10 | In X.Org Server (aka xserver and xorg-server) before 1.19.4, an attacker authenticated to an X server with the X shared memory extension enabled can cause abor… |
CVE-2017-12728 | High | 7.8 | 2017-10-05 | An Improper Privilege Management issue was discovered in SpiderControl SCADA Web Server Version 2.02.0007 and prior. Authenticated, non-administrative local us… |
CVE-2017-1000104 | Medium | 6.5 | 2017-10-05 | The Config File Provider Plugin is used to centrally manage configuration files that often include secrets, such as passwords. Users with only Overall/Read acc… |
CVE-2017-14349 | Critical | 9.8 | 2017-09-30 | An authentication vulnerability in HPE SiteScope product versions 11.2x and 11.3x, allows read-only accounts to view all SiteScope interfaces and monitors, pot… |
CVE-2017-8448 | High | 8.8 | 2017-09-29 | An error was found in the permission model used by X-Pack Alerting 5.0.0 to 5.6.0 whereby users mapped to certain built-in roles could create a watch that resu… |
CVE-2017-8447 | Medium | 6.5 | 2017-09-29 | An error was found in the X-Pack Security 5.3.0 to 5.5.2 privilege enforcement. If a user has either 'delete' or 'index' permissions on an index in a cluster… |
CVE-2017-9724 | High | 7.8 | 2017-09-21 | In all Qualcomm products with Android releases from CAF using the Linux kernel, user-level permissions can be used to gain access to kernel memory, specificall… |
CVE-2017-14484 | High | 7.3 | 2017-09-15 | The Gentoo sci-mathematics/gimps package before 28.10-r1 for Great Internet Mersenne Prime Search (GIMPS) allows local users to gain privileges by creating a h… |
CVE-2017-14124 | Medium | 6.3 | 2017-09-13 | In eLux RP 5.x before 5.5.1000 LTSR and 5.6.x before 5.6.2 CR when classic desktop mode is used, it is possible to start applications other than defined, even… |
CVE-2017-14312 | High | 7.8 | 2017-09-11 | Nagios Core through 4.3.4 initially executes /usr/sbin/nagios as root but supports configuration options in which this file is owned by a non-root account (and… |
CVE-2016-0732 | High | 8.8 | 2017-09-07 | The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple… |
CVE-2017-12422 | Medium | 6.5 | 2017-08-29 | NetApp StorageGRID Webscale 10.2.x before 10.2.2.3, 10.3.x before 10.3.0.4, and 10.4.x before 10.4.0.2 allow remote authenticated users to delete arbitrary obj… |
CVE-2017-13707 | Critical | 9.8 | 2017-08-27 | Privilege escalation in Replibit Backup Manager earlier than version 2017.08.04 allows attackers to gain root privileges via sudo command execution. The vi pro… |
CVE-2017-8446 | Medium | 5.3 | 2017-08-18 | The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonation vulnerability… |
CVE-2017-6767 | High | 7.1 | 2017-08-17 | A vulnerability in Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to gain higher privileges than the a… |
CVE-2017-9662 | Medium | 5.3 | 2017-08-14 | An Improper Privilege Management issue was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. Monitouch V-SFT is installed in a di… |
CVE-2017-10142 | Medium | 5.4 | 2017-08-08 | Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Hospitality Applications (subcomponent: Mobile Apps). Supported versions th… |
CVE-2017-10104 | High | 7.4 | 2017-08-08 | Vulnerability in the Java Advanced Management Console component of Oracle Java SE (subcomponent: Server). The supported version that is affected is Java Advanc… |
CVE-2017-10103 | Medium | 6.5 | 2017-08-08 | Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that… |
CVE-2017-10098 | Medium | 5.4 | 2017-08-08 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions t… |
CVE-2017-10094 | Medium | 5.4 | 2017-08-08 | Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 9.3.5… |
CVE-2017-10046 | Medium | 5.4 | 2017-08-08 | Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access). Supported ve… |
CVE-2017-10000 | High | 7.7 | 2017-08-08 | Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Hospitality Applications (subcomponent: Reporting). Supported versions that… |
CVE-2017-9940 | High | 8.1 | 2017-08-08 | A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker with access to a low-privileged user accou… |
CVE-2017-7916 | Medium | 6.5 | 2017-08-07 | A Permissions, Privileges, and Access Controls issue was discovered in ABB VSN300 WiFi Logger Card versions 1.8.15 and prior, and VSN300 WiFi Logger Card for R… |
CVE-2017-11438 | Medium | 6.3 | 2017-08-02 | GitLab Community Edition (CE) and Enterprise Edition (EE) before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add the… |
CVE-2017-11747 | Medium | 5.5 | 2017-07-30 | main.c in Tinyproxy 1.8.4 and earlier creates a /run/tinyproxy/tinyproxy.pid file after dropping privileges to a non-root account, which might allow local user… |
CVE-2017-11681 | High | 8.8 | 2017-07-27 | Incorrect Access Control vulnerability in Hashtopussy 0.4.0 allows remote authenticated users to execute actions that should only be available for administrati… |
CVE-2017-11467 | Critical | 9.8 | 2017-07-20 | OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbit… |
CVE-2017-7532 | Medium | 6.5 | 2017-07-17 | In Moodle 3.x, course creators are able to change system default settings for courses. |
CVE-2017-11361 | High | 8.8 | 2017-07-17 | Inteno routers have a JUCI ACL misconfiguration that allows the "user" account to read files, write to files, and add root SSH keys via JSON commands to ubus… |
CVE-2017-1000003 | Critical | 9.8 | 2017-07-17 | ATutor versions 2.2.1 and earlier are vulnerable to an incorrect access control check vulnerability in the Social Application component resulting in privilege… |
CVE-2017-8032 | Medium | 6.6 | 2017-07-10 | In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x versions prior to v3.6.13, 3.9.x versions prior to v3.9.15, 3… |
CVE-2017-6732 | Medium | 6.7 | 2017-07-10 | A vulnerability in the installation procedure for Cisco Prime Network Software could allow an authenticated, local attacker to elevate their privileges to root… |
CVE-2017-6728 | High | 7.0 | 2017-07-10 | A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary code at the root privilege level on an af… |
CVE-2017-1000082 | Critical | 9.8 | 2017-07-07 | systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the service in question with root privileges rath… |
CVE-2017-1326 | Medium | 4.3 | 2017-06-22 | IBM Sterling File Gateway does not properly restrict user requests based on permission level. This allows for users to update data related to other users, by m… |
CVE-2017-7922 | High | 7.6 | 2017-06-21 | An Improper Privilege Management issue was discovered in Cambium Networks ePMP. The privileges for SNMP community strings are not properly restricted, which ma… |
CVE-2017-7918 | Medium | 6.8 | 2017-06-21 | An Improper Access Control issue was discovered in Cambium Networks ePMP. After a valid user has used SNMP configuration export, an attacker is able to remotel… |
CVE-2017-4992 | Critical | 9.8 | 2017-06-13 | An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v261; UAA release 2.x versions prior to v2.7.4.17, 3.6.x versions prior to v3… |
CVE-2017-4991 | High | 7.2 | 2017-06-13 | An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v260; UAA release 2.x versions prior to v2.7.4.16, 3.6.x versions prior to v3… |
CVE-2017-4973 | High | 8.8 | 2017-06-13 | An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3… |
CVE-2016-8219 | Medium | 6.5 | 2017-06-13 | An issue was discovered in Cloud Foundry Foundation cf-release versions prior to 250 and CAPI-release versions prior to 1.12.0. A user with the SpaceAuditor ro… |
CVE-2017-9324 | High | 8.8 | 2017-06-12 | In Open Ticket Request System (OTRS) 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an attacker with agent permission is capable of opening… |
CVE-2017-7312 | Critical | 9.8 | 2017-06-07 | An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, anyone can add a vendor account or read existing vend… |
CVE-2016-2192 | Medium | 6.5 | 2017-06-06 | PostgreSQL PL/Java before 1.5.0 allows remote authenticated users to alter type mappings for types they do not own. |
CVE-2016-0767 | Medium | 6.5 | 2017-06-06 | PostgreSQL PL/Java before 1.5.0 allows remote authenticated users with USAGE permission on the public schema to alter the public schema classpath. |
CVE-2017-8438 | High | 8.8 | 2017-06-05 | Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the run_as functionality. This bug prevents transitioning into the specif… |
CVE-2017-7505 | High | 8.8 | 2017-05-26 | Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organiz… |
CVE-2017-6623 | High | 7.8 | 2017-05-18 | A vulnerability in a script file that is installed as part of the Cisco Policy Suite (CPS) Software distribution for the CPS appliance could allow an authentic… |
CVE-2017-7489 | Medium | 6.3 | 2017-05-15 | In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link. |
CVE-2017-4982 | Critical | 9.8 | 2017-05-08 | EMC Mainframe Enablers ResourcePak Base versions 7.6.0, 8.0.0, and 8.1.0 contains a fix for a privilege management vulnerability that could potentially be expl… |
CVE-2017-5689 | Critical | 9.8 | 2017-05-02 | An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Stand… |
CVE-2017-8114 | High | 8.8 | 2017-04-29 | Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The… |
CVE-2017-2094 | Medium | 4.3 | 2017-04-28 | Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Workflow and the "MultiReport" function to alter or delete i… |
CVE-2017-8308 | High | 7.5 | 2017-04-27 | In Avast Antivirus before v17, an unprivileged user (and thus malware or a virus) can mark an arbitrary process as Trusted from the perspective of the Avast pr… |
CVE-2017-6339 | Medium | 6.5 | 2017-04-05 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 before CP 1746 mismanages certain key and certificate data. Per IWSVA documentation, by defaul… |
CVE-2017-0360 | Medium | 5.3 | 2017-04-04 | file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with… |
CVE-2017-5671 | High | 8.8 | 2017-03-29 | Honeywell Intermec PM23, PM42, PM43, PC23, PC43, PD43, and PC42 industrial printers before 10.11.013310 and 10.12.x before 10.12.013309 have /usr/bin/lua insta… |
CVE-2017-6507 | Medium | 5.9 | 2017-03-24 | An issue was discovered in AppArmor before 2.12. Incorrect handling of unknown AppArmor profiles in AppArmor init scripts, upstart jobs, and/or systemd unit fi… |