CWE-269
Improper Privilege Management
Description
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-122 · CAPEC-233 · CAPEC-58
CVEs mapped to this weakness (3,702)
page 182 of 186| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-21638 | Cri | 0.00 | 9.1 | 0.02 | Jan 10, 2024 | Azure IPAM (IP Address Management) is a lightweight solution developed on top of the Azure platform designed to help Azure customers manage their IP Address space easily and effectively. By design there is no write access to customers' Azure environments as the Service Principal… | ||
| CVE-2023-51386 | Hig | 0.00 | 7.8 | 0.00 | Dec 22, 2023 | Sandbox Accounts for Events provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially read data from the events table by sending request payloads to the events API, collecting… | ||
| CVE-2023-41036 | Hig | 0.00 | 7.8 | 0.00 | Nov 7, 2023 | Macvim is a text editor for MacOS. Prior to version 178, Macvim makes use of an insecure interprocess communication (IPC) mechanism which could lead to a privilege escalation. Distributed objects are a concept introduced by Apple which allow one program to vend an interface to… | ||
| CVE-2023-5408 | Hig | 0.00 | 7.2 | 0.01 | Nov 2, 2023 | A privilege escalation flaw was found in the node restriction admission plugin of the kubernetes api server of OpenShift. A remote attacker who modifies the node role label could steer workloads from the control plane and etcd nodes onto different worker nodes and gain broader… | ||
| CVE-2023-41053 | Low | 0.00 | 3.3 | 0.00 | Sep 6, 2023 | Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0… | ||
| CVE-2023-39520 | Med | 0.00 | 5.5 | 0.00 | Aug 7, 2023 | Cryptomator encrypts data being stored on cloud infrastructure. The MSI installer provided on the homepage for Cryptomator version 1.9.2 allows local privilege escalation for low privileged users, via the `repair` function. The problem occurs as the repair function of the MSI is… | ||
| CVE-2023-37907 | Hig | 0.00 | 7.0 | 0.00 | Jul 25, 2023 | Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation (LPE) for low privileged users, if already installed. The problem occurs as the repair… | ||
| CVE-2023-32696 | Hig | 0.00 | 8.8 | 0.01 | May 30, 2023 | CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.1, the `ckan` user (equivalent to www-data) owned code and configuration files in the docker container and the `ckan` user had the permissions to use sudo.… | ||
| CVE-2023-1326 | Hig | 0.00 | 7.7 | 0.01 | Apr 13, 2023 | A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unprivileged users to run sudo apport-cli, less is configured as the pager, and the terminal size can be set: a local… | ||
| CVE-2023-28855 | Med | 0.00 | 6.5 | 0.01 | Apr 5, 2023 | Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows any authenticated user to write data to any fields container, including those to which they have no configured access.… | ||
| CVE-2023-0664 | Hig | 0.00 | 7.8 | 0.00 | Mar 29, 2023 | A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system. | ||
| CVE-2023-27589 | Med | 0.00 | 6.5 | 0.01 | Mar 14, 2023 | Minio is a Multi-Cloud Object Storage framework. Starting with RELEASE.2020-12-23T02-24-12Z and prior to RELEASE.2023-03-13T19-46-17Z, a user with `consoleAdmin` permissions can potentially create a user that matches the root credential `accessKey`. Once this user is created… | ||
| CVE-2023-25149 | Hig | 0.00 | 8.8 | 0.01 | Feb 14, 2023 | TimescaleDB, an open-source time-series SQL database, has a privilege escalation vulnerability in versions 2.8.0 through 2.9.2. During installation, TimescaleDB creates a telemetry job that is runs as the installation user. The queries run as part of the telemetry data… | ||
| CVE-2022-3422 | Hig | 0.00 | 7.5 | 0.01 | Oct 7, 2022 | Account Takeover :: when see the info i can see the hash pass i can creaked it ............... Account Takeover :: when see the info i can see the forgot_password_token the hacker can send the request and changed the pass | ||
| CVE-2022-36075 | Low | 0.00 | 2.6 | 0.01 | Sep 15, 2022 | Nextcloud files access control is a nextcloud app to manage access control for files. Users with limited access can see file names in certain cases where they do not have privilege to do so. This issue has been addressed and it is recommended that the Nextcloud Files Access… | ||
| CVE-2022-36088 | Med | 0.00 | 5.0 | 0.00 | Sep 7, 2022 | GoCD is a continuous delivery server. Windows installations via either the server or agent installers for GoCD prior to 22.2.0 do not adequately restrict permissions when installing outside of the default location. This could allow a malicious user with local access to the… | ||
| CVE-2021-3020 | Hig | 0.00 | 8.8 | 0.01 | Aug 26, 2022 | An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the binary hawk_invoke (built from tools/hawk_invoke.c), intended to be used as a setuid program. This allows the hacluster user to invoke certain commands as root (with an attempt to… | ||
| CVE-2022-31039 | Med | 0.00 | 4.3 | 0.01 | Jun 27, 2022 | Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room's settings even though they are not authorized to do so. Only the room owner and administrator should be able to view a room's settings. This issue has… | ||
| CVE-2022-2023 | Cri | 0.00 | 9.8 | 0.03 | Jun 20, 2022 | Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4. | ||
| CVE-2022-1770 | Hig | 0.00 | 8.8 | 0.03 | May 20, 2022 | Improper Privilege Management in GitHub repository polonel/trudesk prior to 1.2.2. |
- risk 0.00cvss 9.1epss 0.02
Azure IPAM (IP Address Management) is a lightweight solution developed on top of the Azure platform designed to help Azure customers manage their IP Address space easily and effectively. By design there is no write access to customers' Azure environments as the Service Principal…
- risk 0.00cvss 7.8epss 0.00
Sandbox Accounts for Events provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially read data from the events table by sending request payloads to the events API, collecting…
- risk 0.00cvss 7.8epss 0.00
Macvim is a text editor for MacOS. Prior to version 178, Macvim makes use of an insecure interprocess communication (IPC) mechanism which could lead to a privilege escalation. Distributed objects are a concept introduced by Apple which allow one program to vend an interface to…
- risk 0.00cvss 7.2epss 0.01
A privilege escalation flaw was found in the node restriction admission plugin of the kubernetes api server of OpenShift. A remote attacker who modifies the node role label could steer workloads from the control plane and etcd nodes onto different worker nodes and gain broader…
- risk 0.00cvss 3.3epss 0.00
Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0…
- risk 0.00cvss 5.5epss 0.00
Cryptomator encrypts data being stored on cloud infrastructure. The MSI installer provided on the homepage for Cryptomator version 1.9.2 allows local privilege escalation for low privileged users, via the `repair` function. The problem occurs as the repair function of the MSI is…
- risk 0.00cvss 7.0epss 0.00
Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation (LPE) for low privileged users, if already installed. The problem occurs as the repair…
- risk 0.00cvss 8.8epss 0.01
CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.1, the `ckan` user (equivalent to www-data) owned code and configuration files in the docker container and the `ckan` user had the permissions to use sudo.…
- risk 0.00cvss 7.7epss 0.01
A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unprivileged users to run sudo apport-cli, less is configured as the pager, and the terminal size can be set: a local…
- risk 0.00cvss 6.5epss 0.01
Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows any authenticated user to write data to any fields container, including those to which they have no configured access.…
- risk 0.00cvss 7.8epss 0.00
A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system.
- risk 0.00cvss 6.5epss 0.01
Minio is a Multi-Cloud Object Storage framework. Starting with RELEASE.2020-12-23T02-24-12Z and prior to RELEASE.2023-03-13T19-46-17Z, a user with `consoleAdmin` permissions can potentially create a user that matches the root credential `accessKey`. Once this user is created…
- risk 0.00cvss 8.8epss 0.01
TimescaleDB, an open-source time-series SQL database, has a privilege escalation vulnerability in versions 2.8.0 through 2.9.2. During installation, TimescaleDB creates a telemetry job that is runs as the installation user. The queries run as part of the telemetry data…
- risk 0.00cvss 7.5epss 0.01
Account Takeover :: when see the info i can see the hash pass i can creaked it ............... Account Takeover :: when see the info i can see the forgot_password_token the hacker can send the request and changed the pass
- risk 0.00cvss 2.6epss 0.01
Nextcloud files access control is a nextcloud app to manage access control for files. Users with limited access can see file names in certain cases where they do not have privilege to do so. This issue has been addressed and it is recommended that the Nextcloud Files Access…
- risk 0.00cvss 5.0epss 0.00
GoCD is a continuous delivery server. Windows installations via either the server or agent installers for GoCD prior to 22.2.0 do not adequately restrict permissions when installing outside of the default location. This could allow a malicious user with local access to the…
- risk 0.00cvss 8.8epss 0.01
An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the binary hawk_invoke (built from tools/hawk_invoke.c), intended to be used as a setuid program. This allows the hacluster user to invoke certain commands as root (with an attempt to…
- risk 0.00cvss 4.3epss 0.01
Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room's settings even though they are not authorized to do so. Only the room owner and administrator should be able to view a room's settings. This issue has…
- risk 0.00cvss 9.8epss 0.03
Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4.
- risk 0.00cvss 8.8epss 0.03
Improper Privilege Management in GitHub repository polonel/trudesk prior to 1.2.2.