CWE-280 · Improper Handling of Insufficient Permissions or Privileges (page 2)
Page 2 of 2 — CVEs classified under CWE-280, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-47766 | Medium | 4.9 | 2024-10-14 | Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition… |
CVE-2024-46988 | Medium | 4.8 | 2024-10-14 | Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.40, Tuleap Enterprise Edition 1… |
CVE-2024-24116 | Critical | 9.8 | 2024-10-02 | An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the system/config_menu.htm. |
CVE-2024-8451 | High | 7.5 | 2024-09-30 | Certain switch models from PLANET Technology have an SSH service that improperly handles insufficiently authenticated connection requests, allowing unauthorize… |
CVE-2024-6660 | High | 8.8 | 2024-07-17 | The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized modification of data tha… |
CVE-2024-36451 | High | 8.8 | 2024-07-10 | Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2.003. If this vulnerability is exploite… |
CVE-2024-39691 | Medium | 4.3 | 2024-07-05 | matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The fix for GHSA-wm4w-7h2q-3pf7 / CVE-2024-32000 included in matrix-appservice… |
CVE-2024-6302 | High | 8.1 | 2024-06-25 | Lack of privilege checking when processing a redaction in Conduit versions v0.6.0 and lower, allowing a local user to redact any message from users on the same… |
CVE-2024-5163 | Critical | 9.8 | 2024-06-17 | Improper permission settings for mobile applications (com.transsion.carlcare) may lead to user password and account security risks. |
CVE-2024-4468 | Medium | 4.3 | 2024-06-08 | The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functi… |
CVE-2024-35228 | Medium | 5.5 | 2024-05-30 | Wagtail is an open source content management system built on Django. Due to an improperly applied permission check in the `wagtail.contrib.settings` module, a… |
CVE-2024-36112 | Medium | 6.3 | 2024-05-28 | Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records (`extras.view_dynamicgroup` permis… |
CVE-2024-29852 | Low | 2.7 | 2024-05-22 | Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs. |
CVE-2024-35301 | Medium | 5.5 | 2024-05-16 | In JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope of the GitHub App token |
CVE-2024-27837 | Low | 3.3 | 2024-05-14 | A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.5. A local attacker may gain access to Keycha… |
CVE-2024-23704 | High | 7.8 | 2024-05-07 | In onCreate of WifiDialogActivity.java, there is a possible way to bypass the DISALLOW_ADD_WIFI_CONFIG restriction due to a missing permission check. This coul… |
CVE-2024-32882 | Low | 2.7 | 2024-05-02 | Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing through the `wagtail.c… |
CVE-2023-38298 | High | 8.8 | 2024-04-22 | Various software builds for the following TCL devices (30Z, A3X, 20XE, 10L) leak the device IMEI to a system property that can be accessed by any local app on… |
CVE-2024-32488 | High | 7.8 | 2024-04-15 | In Foxit PDF Reader and Editor before 2024.1, Local Privilege Escalation could occur during update checks because weak permissions on the update-service folder… |
CVE-2024-32000 | Medium | 4.3 | 2024-04-12 | matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. matrix-appservice-irc before version 2.0.0 can be exploited to leak the trunca… |
CVE-2023-52537 | High | 7.5 | 2024-04-08 | Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-30418 | High | 7.5 | 2024-04-07 | Vulnerability of insufficient permission verification in the app management module. Impact: Successful exploitation of this vulnerability will affect availabil… |
CVE-2024-29748 | High | 7.8 | 2024-04-05 | there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges n… |
CVE-2023-42931 | High | 7.8 | 2024-03-28 | The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.2, macOS Monterey 12.7.2. A process may gain admin p… |
CVE-2023-41972 | High | 7.3 | 2024-03-26 | In some rare cases, there is a password type validation missing in Revert Password check and for some features it could be disabled. Fixed Version: Win ZApp 4… |
CVE-2024-22078 | High | 8.8 | 2024-03-20 | An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Privilege escalation can occur via world writable files. The network… |
CVE-2024-22077 | Medium | 5.3 | 2024-03-20 | An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. The SQLite database file has weak permissions. |
CVE-2024-25844 | High | 7.5 | 2024-03-03 | An issue was discovered in Common-Services "So Flexibilite" (soflexibilite) module for PrestaShop before version 4.1.26, allows remote attackers to escalate pr… |
CVE-2024-0560 | Medium | 6.3 | 2024-02-28 | A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the auth_type is use_3scale_oidc_issuer_endpoint, the Toke… |
CVE-2024-1608 | Critical | 9.1 | 2024-02-20 | In OPPO Usercenter Credit SDK, there's a possible escalation of privilege due to loose permission check, This could lead to application internal information le… |
CVE-2024-0015 | High | 7.8 | 2024-02-16 | In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. This could lead to… |
CVE-2023-39249 | Medium | 6.3 | 2024-02-14 | Dell SupportAssist for Business PCs version 3.4.0 contains a local Authentication Bypass vulnerability that allows locally authenticated non-admin users to ga… |
CVE-2024-25108 | Critical | 9.9 | 2024-02-12 | Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to acce… |
CVE-2023-25543 | High | 7.8 | 2024-02-06 | Dell Power Manager, versions prior to 3.14, contain an Improper Authorization vulnerability in DPM service. A low privileged malicious user could potentially… |
CVE-2023-6189 | Medium | 4.3 | 2023-11-22 | Missing access permissions checks in the M-Files server before 23.11.13156.0 allow attackers to perform data write and export jobs using the M-Files API met… |
CVE-2023-43591 | High | 7.8 | 2023-11-15 | Improper privilege management in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local ac… |
CVE-2023-43087 | Medium | 4.3 | 2023-11-02 | Dell PowerScale OneFS 8.2.x, 9.0.0.x-9.5.0.x contains an improper handling of insufficient permissions. A low privileged remote attacker could potentially exp… |
CVE-2023-32489 | Medium | 6.7 | 2023-08-16 | Dell PowerScale OneFS 8.2x -9.5x contains a privilege escalation vulnerability. A local attacker with high privileges could potentially exploit this vulnerabi… |
CVE-2023-2480 | High | 7.5 | 2023-05-25 | Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applicati… |
CVE-2023-2020 | Medium | 4.3 | 2023-04-18 | Insufficient permission checks in the REST API in Tribe29 Checkmk <= 2.1.0p27 and <= 2.2.0b4 (beta) allow unauthorized users to schedule downtimes for any host. |
CVE-2023-0181 | High | 7.1 | 2023-04-01 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a kernel mode layer handler, where memory permissions are not correctly checked, wh… |
CVE-2023-28114 | Medium | 4.8 | 2023-03-22 | `cilium-cli` is the command line interface to install, manage, and troubleshoot Kubernetes clusters running Cilium. Prior to version 0.13.2,`cilium-cli`, when… |
CVE-2023-27087 | High | 7.5 | 2023-03-21 | Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageList parameter. |
CVE-2023-21421 | Medium | 5.9 | 2023-02-09 | Improper Handling of Insufficient Permissions or Privileges vulnerability in KnoxCustomManagerService prior to SMR Jan-2023 Release 1 allows attacker to access… |
CVE-2023-22737 | Medium | 6.5 | 2023-01-28 | wire-server provides back end services for Wire, a team communication and collaboration platform. Prior to version 2022-12-09, every member of a Conversation c… |
CVE-2022-4863 | Medium | 6.5 | 2022-12-30 | Improper Handling of Insufficient Permissions or Privileges in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-39912 | Medium | 6.2 | 2022-12-08 | Improper handling of insufficient permissions vulnerability in setSecureFolderPolicy in PersonaManagerService prior to Android T(13) allows local attackers to… |
CVE-2022-39886 | Medium | 5.9 | 2022-11-09 | Improper access control vulnerability in IpcRxServiceModeBigDataInfo in RIL prior to SMR Nov-2022 Release 1 allows local attacker to access Device information. |
CVE-2022-39885 | Medium | 5.9 | 2022-11-09 | Improper access control vulnerability in BootCompletedReceiver_CMCC in DeviceManagement prior to SMR Nov-2022 Release 1 allows local attacker to access to Devi… |
CVE-2022-39872 | Medium | 5.9 | 2022-10-07 | Improper restriction of broadcasting Intent in ShareLive prior to version 13.2.03.5 leaks MAC address of the connected Bluetooth device. |
CVE-2022-36874 | Medium | 5.9 | 2022-09-09 | Improper Handling of Insufficient Permissions or Privileges vulnerability in Waterplugin prior to 2.2.11.22040751 allows attacker to access device IMEI and Ser… |
CVE-2022-34368 | Medium | 6.1 | 2022-08-30 | Dell EMC NetWorker 19.2.1.x 19.3.x, 19.4.x, 19.5.x, 19.6.x and 19.7.0.0 contain an Improper Handling of Insufficient Permissions or Privileges vulnerability. A… |
CVE-2022-2193 | High | 7.5 | 2022-07-19 | Insecure Direct Object Reference vulnerability in HYPR Server before version 6.14.1 allows remote authenticated attackers to add a FIDO2 authenticator to arbit… |
CVE-2022-30727 | Medium | 6.2 | 2022-06-07 | Improper handling of insufficient permissions vulnerability in addAppPackageNameToAllowList in PersonaManagerService prior to SMR Jun-2022 Release 1 allows loc… |
CVE-2022-30725 | Medium | 4.0 | 2022-06-07 | Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionError function of Bluetooth prior to SMR J… |
CVE-2022-30724 | Medium | 4.0 | 2022-06-07 | Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionCompleted function of Bluetooth prior to S… |
CVE-2022-30723 | Medium | 4.0 | 2022-06-07 | Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in activateVoiceRecognitionWithDevice function of Bluetooth pr… |
CVE-2022-30716 | Medium | 4.0 | 2022-06-07 | Unprotected broadcast in sendIntentForToastDumpLog in DisplayToast prior to SMR Jun-2022 Release 1 allows untrusted applications to access toast message inform… |
CVE-2021-37851 | High | 7.3 | 2022-05-11 | Local privilege escalation in Windows products of ESET allows user who is logged into the system to exploit repair feature of the installer to run malicious co… |
CVE-2022-27167 | High | 7.1 | 2022-05-10 | Privilege escalation vulnerability in Windows products of ESET, spol. s r.o. allows attacker to exploit "Repair" and "Uninstall" features what may lead to arbi… |
CVE-2022-22292 | High | 7.1 | 2022-02-11 | Unprotected dynamic receiver in Telecom prior to SMR Feb-2022 Release 1 allows untrusted applications to launch arbitrary activity. |
CVE-2022-21814 | Medium | 6.1 | 2022-02-07 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver package, where improper handling of insufficient permissions or privileges ma… |
CVE-2021-37175 | Medium | 5.3 | 2021-09-14 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All… |
CVE-2021-38312 | High | 7.1 | 2021-09-02 | The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered unde… |
CVE-2020-10072 | Medium | 5.9 | 2021-05-25 | Improper Handling of Insufficient Permissions or Privileges in zephyr. Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Insufficient Permissi… |
CVE-2020-29031 | High | 7.1 | 2021-02-15 | An Insecure Direct Object Reference vulnerability exists in the web UI of the GateManager which allows an authenticated attacker to reset the password of any u… |
CVE-2020-26195 | Medium | 5.3 | 2021-02-09 | Dell EMC PowerScale OneFS versions 8.1.2 – 9.1.0 contain an issue where the OneFS SMB directory auto-create may erroneously create a directory for a user. A re… |
CVE-2020-3427 | Medium | 6.6 | 2020-10-14 | The Windows Logon installer prior to 4.1.2 did not properly validate file installation paths. This allows an attacker with local user privileges to coerce the… |
CVE-2020-8219 | High | 7.2 | 2020-07-30 | An insufficient permission check vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to change the password of a full administrator. |
CVE-2020-8117 | Medium | 4.3 | 2020-02-04 | Improper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be leaked when sharing a non-public event. |
CVE-2019-17437 | High | 7.8 | 2019-12-05 | An improper authentication check in Palo Alto Networks PAN-OS may allow an authenticated low privileged non-superuser custom role user to elevate privileges an… |
CVE-2019-13415 | Medium | 6.5 | 2019-08-13 | Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users can gain read access to data they are not autho… |
CVE-2019-6570 | High | 8.8 | 2019-04-17 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Due to insufficient checking of user permissions, an attacker may ac… |
CVE-2012-4550 | Medium | 5.3 | 2013-01-05 | A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans (EJB) access, the system does not co… |