cve.bz

CWE-269: Improper Privilege Management, page 41

Filter

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

What the weakness is: CWE-269 at MITRE

Ask an AI about CWE-269

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-269: Improper Privilege Management and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/269.html and https://cve.bz/cve/cwe/269?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2024-33775EPSS 1.4%

    An issue with the Autodiscover component in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted Dashlet.

  2. 9.1CVE-2024-33308EPSS 0.7%

    An issue in TVS Motor Company Limited TVS Connet Android v.4.5.1 and iOS v.5.0.0 allows a remote attacker to escalate privileges via the Emergency Contact Feature. NOTE: this is disputed as discussed in the msn-official/CVE-Evidence reposi…

  3. 6.7CVE-2024-33522EPSS 0.2%

    In vulnerable versions of Calico (v3.27.2 and below), Calico Enterprise (v3.19.0-1, v3.18.1, v3.17.3 and below), and Calico Cloud (v19.2.0 and below), an attacker who has local access to the Kubernetes node, can escalate their privileges b…

  4. 7.8CVE-2024-27518EPSS 0.6%

    An issue in SUPERAntiSyware Professional X 10.0.1262 and 10.0.1264 allows unprivileged attackers to escalate privileges via a restore of a crafted DLL file into the C:\Program Files\SUPERAntiSpyware folder.

  5. 8.1CVE-2024-31502EPSS 0.6%

    An issue in Insurance Management System v.1.0.0 and before allows a remote attacker to escalate privileges via a crafted POST request to /admin/core/new_staff.

  6. 9.1CVE-2024-25343EPSS 0.5%

    Tenda N300 F3 router vulnerability allows users to bypass intended security policy and create weak passwords.

  7. 7.8CVE-2024-28241EPSS 0.2%

    The GLPI Agent is a generic management agent. Prior to version 1.7.2, a local user can modify GLPI-Agent code or used DLLs to modify agent logic and even gain higher privileges. Users should upgrade to GLPI-Agent 1.7.2 to receive a patch. …

  8. 9.8CVE-2023-51425EPSS 0.6%

    Improper Privilege Management vulnerability in Jacques Malgrange Rencontre – Dating Site allows Privilege Escalation.This issue affects Rencontre – Dating Site: from n/a through 3.10.1.

  9. 8.7CVE-2023-38292EPSS 0.4%

    Certain software builds for the TCL 20XE Android device contain a vulnerable, pre-installed app with a package name of com.tct.gcs.hiddenmenuproxy (versionCode='2', versionName='v11.0.1.0.0201.0') that allows local third-party apps to prog…

  10. 9.8CVE-2024-32418EPSS 1.1%

    An issue in flusity CMS v2.33 allows a remote attacker to execute arbitrary code via the add_addon.php component.

  11. 7.8CVE-2024-4018EPSS 0.2%

    Improper Privilege Management vulnerability in BeyondTrust U-Series Appliance on Windows, 64 bit (local appliance api modules) allows Privilege Escalation.This issue affects U-Series Appliance: from 3.4 before 4.0.3.

  12. 7.8CVE-2024-4017EPSS 0.2%

    Improper Privilege Management vulnerability in BeyondTrust U-Series Appliance on Windows, 64 bit (filesystem modules) allows DLL Side-Loading.This issue affects U-Series Appliance: from 3.4 before 4.0.3.

  13. 7.2CVE-2024-3470EPSS 0.6%

    An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed an attacker to use a deploy key pertaining to an organization to bypass an organization ruleset. An attacker would require access to a v…

  14. 8.8CVE-2024-21989EPSS 0.4%

    ONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x are susceptible to a vulnerability which when successfully exploited could allow a read-only user to escalate their privileges.

  15. 6.5CVE-2024-21121EPSS 0.4%

    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infr…

  16. 5.3CVE-2024-21118EPSS 0.2%

    Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). Supported versions that are affected are 8.5.6 and 8.5.7. Easily exploitable vulnerability allows low privileged attacker…

  17. 7.8CVE-2024-21111ExploitEPSS 1.8%

    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infr…

  18. 2.2CVE-2024-21101EPSS 0.4%

    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.5.33 and prior, 7.6.29 and prior, 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerabili…

  19. 7.8CVE-2024-21059EPSS 0.2%

    Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Or…

  20. 6.1CVE-2024-21034EPSS 0.4%

    Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated at…

  21. 8.8CVE-2024-32003EPSS 0.7%

    wn-dusk-plugin (Dusk plugin) is a plugin which integrates Laravel Dusk browser testing into Winter CMS. The Dusk plugin provides some special routes as part of its testing framework to allow a browser environment (such as headless Chrome) …

  22. 5.0CVE-2024-3388EPSS 0.3%

    A vulnerability in the GlobalProtect Gateway in Palo Alto Networks PAN-OS software enables an authenticated attacker to impersonate another user and send network packets to internal assets. However, this vulnerability does not allow the at…

  23. 7.8CVE-2024-29052EPSS 0.6%

    Windows Storage Elevation of Privilege Vulnerability

  24. 7.8CVE-2024-28905EPSS 0.5%

    Microsoft Brokering File System Elevation of Privilege Vulnerability

  25. 7.8CVE-2024-28904EPSS 0.5%

    Microsoft Brokering File System Elevation of Privilege Vulnerability

  26. 7.2CVE-2024-21324EPSS 2.3%

    Microsoft Defender for IoT Elevation of Privilege Vulnerability

  27. 8.2CVE-2024-0082EPSS 0.2%

    NVIDIA ChatRTX for Windows contains a vulnerability in the UI, where an attacker can cause improper privilege management by sending open file requests to the application. A successful exploit of this vulnerability might lead to local escal…

  28. 6.2CVE-2023-52543EPSS 0.1%

    Permission verification vulnerability in the system module. Impact: Successful exploitation of this vulnerability will affect availability.

  29. 7.5CVE-2023-52716EPSS 0.4%

    Vulnerability of starting activities in the background in the ActivityManagerService (AMS) module. Impact: Successful exploitation of this vulnerability will affect availability.

  30. 7.8CVE-2024-29741EPSS 0.1%

    In pblS2mpuResume of s2mpu.c, there is a possible mitigation bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for explo…

  31. 8.8CVE-2024-31498EPSS 0.6%

    Yubico ykman-gui (aka YubiKey Manager GUI) before 1.2.6 on Windows, when Edge is not used, allows privilege escalation because browser windows can open as Administrator.

  32. 6.0CVE-2024-20282EPSS 0.2%

    A vulnerability in Cisco Nexus Dashboard could allow an authenticated, local attacker with valid rescue-user credentials to elevate privileges to root on an affected device. This vulnerability is due to insufficient protections for a se…

  33. 7.8CVE-2024-0172EPSS 0.1%

    Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper privilege management security vulnerability. An unauthenticated local attacker could potentially exploit this vulnerability, leading to privilege escalation.

  34. 7.1CVE-2024-3137EPSS 0.4%

    Improper Privilege Management in uvdesk/community-skeleton

  35. 9.8CVE-2024-29667EPSS 0.6%

    SQL Injection vulnerability in Tongtianxing Technology Co., Ltd CMSV6 v.7.31.0.2 through v.7.31.0.3 allows a remote attacker to escalate privileges and obtain sensitive information via the ids parameter.

  36. 9.8CVE-2023-49232EPSS 1.5%

    An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to brute-force the password reset PINs of administrative users.

  37. 8.8CVE-2024-23537EPSS 1.1%

    Improper Privilege Management vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5. Users are recommended to upgrade to version 1.9.0, which fixes the issue.

  38. 6.7CVE-2024-25961EPSS 0.2%

    Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains an improper privilege management vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges.

  39. 6.5CVE-2024-28247EPSS 1.4%

    The Pi-hole is a DNS sinkhole that protects your devices from unwanted content without installing any client-side software. A vulnerability has been discovered in Pihole that allows an authenticated user on the platform to read internal se…

  40. 7.2CVE-2023-40289EPSS 18%

    A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker can exploit this to elevate privileges from a user with BMC administrative privileges.

  41. 8.5CVE-2024-1973EPSS 0.4%

    By leveraging the vulnerability, lower-privileged users of Content Manager can manipulate Content Manager clients to elevate privileges and perform unauthorized operations.

  42. 8.1CVE-2024-24892EPSS 0.9%

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Privilege Management vulnerability in openEuler migration-tools on Linux allows Command Injection, Restful Privilege Elevation. This vulne…

  43. 4.7CVE-2024-26247EPSS 1.1%

    Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

  44. 8.8CVE-2024-2228EPSS 0.4%

    This vulnerability allows an authenticated user to perform a Lifecycle Manager flow or other QuickLink for a target user outside of the defined QuickLink Population.

  45. 7.8CVE-2023-41099EPSS 0.1%

    In the Windows installer in Atos Eviden CardOS API before 5.5.5.2811, Local Privilege Escalation can occur.(from a regular user to SYSTEM).

  46. 4.3CVE-2023-47715EPSS 0.3%

    IBM Storage Protect Plus Server 10.1.0 through 10.1.16 could allow an authenticated user with read-only permissions to add or delete entries from an existing HyperVisor configuration. IBM X-Force ID: 271538.

  47. 9.8CVE-2023-48902EPSS 1.3%

    An issue was discovered in tramyardg autoexpress version 1.3.0, allows unauthenticated remote attackers to escalate privileges, update car data, delete vehicles, and upload car images via authentication bypass in uploadCarImages.php.

  48. 6.5CVE-2024-1908EPSS 0.6%

    An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed an attacker to use the Enterprise Actions GitHub Connect download token to fetch private repository data. An attacker would require an a…

  49. 7.8CVE-2024-2390EPSS 0.2%

    As a part of Tenable’s vulnerability disclosure program, a vulnerability in a Nessus plugin was identified and reported. This vulnerability could allow a malicious actor with sufficient permissions on a scan target to place a binary in a s…

  50. 7.8CVE-2024-28851EPSS 0.3%

    The Snowflake Hive metastore connector provides an easy way to query Hive-managed data via Snowflake. Snowflake Hive MetaStore Connector has addressed a potential elevation of privilege vulnerability in a `helper script` for the Hive MetaS…