CWE-269: Improper Privilege Management, page 43
Filter
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
What the weakness is: CWE-269 at MITRE
Ask an AI about CWE-269
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-269: Improper Privilege Management and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/269.html and https://cve.bz/cve/cwe/269?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.0CVE-2024-22795EPSS 0.3%
Insecure Permissions vulnerability in Forescout SecureConnector v.11.3.06.0063 allows a local attacker to escalate privileges via the Recheck Compliance Status component.
- 7.8CVE-2024-22239EPSS 0.2%
Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for Networks may exploit this vulnerability to escalate privileges to gain regular shell access.
- 7.8CVE-2024-22237EPSS 0.2%
Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for Networks may exploit this vulnerability to escalate privileges to gain root access to the system.
- 7.8CVE-2023-32451EPSS 0.2%
Dell Display Manager application, version 2.1.1.17, contains a vulnerability that low privilege user can execute malicious code during installation and uninstallation
- 7.1CVE-2023-28049EPSS 0.1%
Dell Command | Monitor, versions prior to 10.9, contain an arbitrary folder deletion vulnerability. A locally authenticated malicious user may exploit this vulnerability in order to perform a privileged arbitrary file delete.
- 7.8CVE-2023-31005EPSS 0.2%
IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a local user to escalate their privileges due to an improper…
- 8.8CVE-2023-36496EPSS 0.5%
Delegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory Server.
- 8.8CVE-2024-24747ExploitEPSS 34%
MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hi…
- 8.8CVE-2024-21888EPSS 85%
A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an administrator.
- 7.8CVE-2024-0833EPSS 0.2%
In Telerik Test Studio versions prior to v2023.3.1330, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik Test Studio install is present, a lower …
- 7.8CVE-2024-0832EPSS 0.2%
In Telerik Reporting versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik Reporting install is present, a lower privileged …
- 7.8CVE-2024-0219EPSS 0.2%
In Telerik JustDecompile versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik JustDecompile install is present, a lower pri…
- 7.8CVE-2024-0674EPSS 0.1%
Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, which could allow a local user to acquire root permissions by modifying the updatescript.js, inserting special code inside the script and creatin…
- 7.6CVE-2024-21985EPSS 0.3%
ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 and 9.13.1P4 are susceptible to a vulnerability which could allow an authenticated user with multiple remote accounts with differing roles to perform actions via REST A…
- 7.8CVE-2024-23620EPSS 0.2%
An improper privilege management vulnerability exists in IBM Merge Healthcare eFilm Workstation. A local, authenticated attacker can exploit this vulnerability to escalate privileges to SYSTEM.
- 9.8CVE-2024-22922EPSS 0.8%
An issue in Projectworlds Vistor Management Systemin PHP v.1.0 allows a remtoe attacker to escalate privileges via a crafted script to the login page in the POST/index.php
- 8.8CVE-2023-43317EPSS 1.1%
An issue in Coign CRM Portal v.06.06 allows a remote attacker to escalate privileges via the userPermissionsList parameter in Session Storage component.
- 7.8CVE-2023-52337EPSS 0.2%
An improper access control vulnerability in Trend Micro Deep Security 20.0 and Trend Micro Cloud One - Endpoint and Workload Security Agent could allow a local attacker to escalate privileges on affected installations. Please note: an a…
- 7.8CVE-2023-52093EPSS 0.2%
An exposed dangerous function vulnerability in the Trend Micro Apex One agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privilege…
- 7.8CVE-2023-47201EPSS 0.1%
A plug-in manager origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execut…
- 8.8CVE-2024-0751EPSS 0.6%
A malicious devtools extension could have been used to escalate privileges. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.
- 7.5CVE-2023-52105EPSS 0.4%
The nearby module has a privilege escalation vulnerability. Successful exploitation of this vulnerability may affect availability.
- 7.5CVE-2023-52116EPSS 0.4%
Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerability may cause service exceptions of the device.
- 7.5CVE-2023-52114EPSS 0.3%
Data confidentiality vulnerability in the ScreenReader module. Successful exploitation of this vulnerability may affect service integrity.
- 7.5CVE-2023-52107EPSS 0.3%
Vulnerability of permissions being not strictly verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality.
- 7.8CVE-2023-6740EPSS 0.2%
Privilege escalation in jar_signature agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges
- 7.8CVE-2023-6735EPSS 0.3%
Privilege escalation in mk_tsm agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges
- 9.8CVE-2024-21638EPSS 1.7%
Azure IPAM (IP Address Management) is a lightweight solution developed on top of the Azure platform designed to help Azure customers manage their IP Address space easily and effectively. By design there is no write access to customers' Azu…
- 5.5CVE-2022-32931EPSS 0.2%
This issue was addressed with improved data protection. This issue is fixed in macOS Ventura 13. An app with root privileges may be able to access private information.
- 8.8CVE-2023-44250EPSS 0.9%
An improper privilege management vulnerability [CWE-269] in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a FortiProxy HA cluster version 7.4.0 through 7.4.1 allows an authenticated attacker to perform elevated…
- 7.8CVE-2023-47145EPSS 0.2%
IBM Db2 for Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow a local user to escalate their privileges to the SYSTEM user using the MSI repair functionality. IBM X-Force ID: 270402.
- 5.5CVE-2023-41784EPSS 0.2%
Permissions and Access Control Vulnerability in ZTE Red Magic 8 Pro
- 8.8CVE-2024-21622EPSS 0.6%
Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has bee…
- 6.5CVE-2023-30617EPSS 0.5%
Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1, and 1.5.2, an attacker who has gained root privilege of the node that kruise-daemon run can lever…
- 9.8CVE-2023-50921EPSS 0.5%
An issue was discovered on GL.iNet devices through 4.5.0. Attackers can invoke the add_user interface in the system module to gain root privileges. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4…
- 7.8CVE-2023-41776EPSS 0.2%
There is a local privilege escalation vulnerability of ZTE's ZXCLOUD iRAI.Attackers with regular user privileges can create a fake process, and to escalate local privileges.
- 7.8CVE-2023-48418EPSS 0.2%
In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecure default value. This could lead to local escalation of privilege with no additional execut…
- 9.8CVE-2023-48419EPSS 0.2%
An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in Elevation of Privilege
- 8.0CVE-2023-7080EPSS 0.6%
The V8 inspector intentionally allows arbitrary code execution within the Workers sandbox for debugging. wrangler dev would previously start an inspector server listening on all network interfaces. This would allow an attacker on the local…
- 7.1CVE-2023-51435EPSS 0.2%
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.
- 5.5CVE-2023-51433EPSS 0.1%
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.
- 5.5CVE-2023-51430EPSS 0.2%
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.
- 5.5CVE-2023-51429EPSS 0.2%
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.
- 5.5CVE-2023-23438EPSS 0.1%
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions
- 7.5CVE-2023-23430EPSS 0.3%
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
- 7.5CVE-2023-23429EPSS 0.3%
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
- 7.5CVE-2023-23428EPSS 0.3%
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
- 7.5CVE-2023-23427EPSS 0.3%
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
- 4.3CVE-2023-50267EPSS 0.3%
MeterSphere is a one-stop open source continuous testing platform. Prior to 2.10.10-lts, the authenticated attackers can update resources which don't belong to him if the resource ID is known. This issue if fixed in 2.10.10-lts. There are…
- 8.8CVE-2023-7090EPSS 0.7%
A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privi…