CWE-280 · Improper Handling of Insufficient Permissions or Privileges (page 2)
Page 2 of 2 — CVEs classified under CWE-280, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-32882 | Low | 2.7 | 2024-05-02 | Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing through the `wagtail.c… |
CVE-2023-38298 | High | 8.8 | 2024-04-22 | Various software builds for the following TCL devices (30Z, A3X, 20XE, 10L) leak the device IMEI to a system property that can be accessed by any local app on… |
CVE-2024-32488 | High | 7.8 | 2024-04-15 | In Foxit PDF Reader and Editor before 2024.1, Local Privilege Escalation could occur during update checks because weak permissions on the update-service folder… |
CVE-2024-32000 | Medium | 4.3 | 2024-04-12 | matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. matrix-appservice-irc before version 2.0.0 can be exploited to leak the trunca… |
CVE-2023-52537 | High | 7.5 | 2024-04-08 | Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-30418 | High | 7.5 | 2024-04-07 | Vulnerability of insufficient permission verification in the app management module. Impact: Successful exploitation of this vulnerability will affect availabil… |
CVE-2024-29748 | High | 7.8 | 2024-04-05 | there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges n… |
CVE-2023-42931 | High | 7.8 | 2024-03-28 | The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.2, macOS Monterey 12.7.2. A process may gain admin p… |
CVE-2023-41972 | High | 7.3 | 2024-03-26 | In some rare cases, there is a password type validation missing in Revert Password check and for some features it could be disabled. Fixed Version: Win ZApp 4… |
CVE-2024-22078 | High | 8.8 | 2024-03-20 | An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Privilege escalation can occur via world writable files. The network… |
CVE-2024-22077 | Medium | 5.3 | 2024-03-20 | An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. The SQLite database file has weak permissions. |
CVE-2024-25844 | High | 7.5 | 2024-03-03 | An issue was discovered in Common-Services "So Flexibilite" (soflexibilite) module for PrestaShop before version 4.1.26, allows remote attackers to escalate pr… |
CVE-2024-0560 | Medium | 6.3 | 2024-02-28 | A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the auth_type is use_3scale_oidc_issuer_endpoint, the Toke… |
CVE-2024-1608 | Critical | 9.1 | 2024-02-20 | In OPPO Usercenter Credit SDK, there's a possible escalation of privilege due to loose permission check, This could lead to application internal information le… |
CVE-2024-0015 | High | 7.8 | 2024-02-16 | In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. This could lead to… |
CVE-2023-39249 | Medium | 6.3 | 2024-02-14 | Dell SupportAssist for Business PCs version 3.4.0 contains a local Authentication Bypass vulnerability that allows locally authenticated non-admin users to ga… |
CVE-2024-25108 | Critical | 9.9 | 2024-02-12 | Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to acce… |
CVE-2023-25543 | High | 7.8 | 2024-02-06 | Dell Power Manager, versions prior to 3.14, contain an Improper Authorization vulnerability in DPM service. A low privileged malicious user could potentially… |
CVE-2023-6189 | Medium | 4.3 | 2023-11-22 | Missing access permissions checks in the M-Files server before 23.11.13156.0 allow attackers to perform data write and export jobs using the M-Files API met… |
CVE-2023-43591 | High | 7.8 | 2023-11-15 | Improper privilege management in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local ac… |
CVE-2023-43087 | Medium | 4.3 | 2023-11-02 | Dell PowerScale OneFS 8.2.x, 9.0.0.x-9.5.0.x contains an improper handling of insufficient permissions. A low privileged remote attacker could potentially exp… |
CVE-2023-32489 | Medium | 6.7 | 2023-08-16 | Dell PowerScale OneFS 8.2x -9.5x contains a privilege escalation vulnerability. A local attacker with high privileges could potentially exploit this vulnerabi… |
CVE-2023-2480 | High | 7.5 | 2023-05-25 | Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applicati… |
CVE-2023-2020 | Medium | 4.3 | 2023-04-18 | Insufficient permission checks in the REST API in Tribe29 Checkmk <= 2.1.0p27 and <= 2.2.0b4 (beta) allow unauthorized users to schedule downtimes for any host. |
CVE-2023-0181 | High | 7.1 | 2023-04-01 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a kernel mode layer handler, where memory permissions are not correctly checked, wh… |
CVE-2023-28114 | Medium | 4.8 | 2023-03-22 | `cilium-cli` is the command line interface to install, manage, and troubleshoot Kubernetes clusters running Cilium. Prior to version 0.13.2,`cilium-cli`, when… |
CVE-2023-27087 | High | 7.5 | 2023-03-21 | Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageList parameter. |
CVE-2023-21421 | Medium | 5.9 | 2023-02-09 | Improper Handling of Insufficient Permissions or Privileges vulnerability in KnoxCustomManagerService prior to SMR Jan-2023 Release 1 allows attacker to access… |
CVE-2023-22737 | Medium | 6.5 | 2023-01-28 | wire-server provides back end services for Wire, a team communication and collaboration platform. Prior to version 2022-12-09, every member of a Conversation c… |
CVE-2022-4863 | Medium | 6.5 | 2022-12-30 | Improper Handling of Insufficient Permissions or Privileges in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-39912 | Medium | 6.2 | 2022-12-08 | Improper handling of insufficient permissions vulnerability in setSecureFolderPolicy in PersonaManagerService prior to Android T(13) allows local attackers to… |
CVE-2022-39886 | Medium | 5.9 | 2022-11-09 | Improper access control vulnerability in IpcRxServiceModeBigDataInfo in RIL prior to SMR Nov-2022 Release 1 allows local attacker to access Device information. |
CVE-2022-39885 | Medium | 5.9 | 2022-11-09 | Improper access control vulnerability in BootCompletedReceiver_CMCC in DeviceManagement prior to SMR Nov-2022 Release 1 allows local attacker to access to Devi… |
CVE-2022-39872 | Medium | 5.9 | 2022-10-07 | Improper restriction of broadcasting Intent in ShareLive prior to version 13.2.03.5 leaks MAC address of the connected Bluetooth device. |
CVE-2022-36874 | Medium | 5.9 | 2022-09-09 | Improper Handling of Insufficient Permissions or Privileges vulnerability in Waterplugin prior to 2.2.11.22040751 allows attacker to access device IMEI and Ser… |
CVE-2022-34368 | Medium | 6.1 | 2022-08-30 | Dell EMC NetWorker 19.2.1.x 19.3.x, 19.4.x, 19.5.x, 19.6.x and 19.7.0.0 contain an Improper Handling of Insufficient Permissions or Privileges vulnerability. A… |
CVE-2022-2193 | High | 7.5 | 2022-07-19 | Insecure Direct Object Reference vulnerability in HYPR Server before version 6.14.1 allows remote authenticated attackers to add a FIDO2 authenticator to arbit… |
CVE-2022-30727 | Medium | 6.2 | 2022-06-07 | Improper handling of insufficient permissions vulnerability in addAppPackageNameToAllowList in PersonaManagerService prior to SMR Jun-2022 Release 1 allows loc… |
CVE-2022-30725 | Medium | 4.0 | 2022-06-07 | Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionError function of Bluetooth prior to SMR J… |
CVE-2022-30724 | Medium | 4.0 | 2022-06-07 | Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionCompleted function of Bluetooth prior to S… |
CVE-2022-30723 | Medium | 4.0 | 2022-06-07 | Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in activateVoiceRecognitionWithDevice function of Bluetooth pr… |
CVE-2022-30716 | Medium | 4.0 | 2022-06-07 | Unprotected broadcast in sendIntentForToastDumpLog in DisplayToast prior to SMR Jun-2022 Release 1 allows untrusted applications to access toast message inform… |
CVE-2021-37851 | High | 7.3 | 2022-05-11 | Local privilege escalation in Windows products of ESET allows user who is logged into the system to exploit repair feature of the installer to run malicious co… |
CVE-2022-27167 | High | 7.1 | 2022-05-10 | Privilege escalation vulnerability in Windows products of ESET, spol. s r.o. allows attacker to exploit "Repair" and "Uninstall" features what may lead to arbi… |
CVE-2022-22292 | High | 7.1 | 2022-02-11 | Unprotected dynamic receiver in Telecom prior to SMR Feb-2022 Release 1 allows untrusted applications to launch arbitrary activity. |
CVE-2022-21814 | Medium | 6.1 | 2022-02-07 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver package, where improper handling of insufficient permissions or privileges ma… |
CVE-2021-37175 | Medium | 5.3 | 2021-09-14 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All… |
CVE-2021-38312 | High | 7.1 | 2021-09-02 | The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered unde… |
CVE-2020-10072 | Medium | 5.9 | 2021-05-25 | Improper Handling of Insufficient Permissions or Privileges in zephyr. Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Insufficient Permissi… |
CVE-2020-29031 | High | 7.1 | 2021-02-15 | An Insecure Direct Object Reference vulnerability exists in the web UI of the GateManager which allows an authenticated attacker to reset the password of any u… |
CVE-2020-26195 | Medium | 5.3 | 2021-02-09 | Dell EMC PowerScale OneFS versions 8.1.2 – 9.1.0 contain an issue where the OneFS SMB directory auto-create may erroneously create a directory for a user. A re… |
CVE-2020-3427 | Medium | 6.6 | 2020-10-14 | The Windows Logon installer prior to 4.1.2 did not properly validate file installation paths. This allows an attacker with local user privileges to coerce the… |
CVE-2020-8219 | High | 7.2 | 2020-07-30 | An insufficient permission check vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to change the password of a full administrator. |
CVE-2020-8117 | Medium | 4.3 | 2020-02-04 | Improper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be leaked when sharing a non-public event. |
CVE-2019-17437 | High | 7.8 | 2019-12-05 | An improper authentication check in Palo Alto Networks PAN-OS may allow an authenticated low privileged non-superuser custom role user to elevate privileges an… |
CVE-2019-13415 | Medium | 6.5 | 2019-08-13 | Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users can gain read access to data they are not autho… |
CVE-2019-6570 | High | 8.8 | 2019-04-17 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Due to insufficient checking of user permissions, an attacker may ac… |
CVE-2012-4550 | Medium | 5.3 | 2013-01-05 | A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans (EJB) access, the system does not co… |