cve.bz

CWE-269: Improper Privilege Management, page 45

Filter

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

What the weakness is: CWE-269 at MITRE

Ask an AI about CWE-269

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-269: Improper Privilege Management and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/269.html and https://cve.bz/cve/cwe/269?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2023-21397EPSS 0.1%

    In Setup Wizard, there is a possible way to save a WiFi network due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitat…

  2. 7.8CVE-2023-21396EPSS 0.1%

    In Activity Manager, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

  3. 5.5CVE-2023-21376EPSS 0.09%

    In Telephony, there is a possible way to retrieve the ICCID due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

  4. 7.8CVE-2023-21374EPSS 0.10%

    In System UI, there is a possible factory reset protection bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploit…

  5. 7.8CVE-2023-21343EPSS 0.1%

    In ActivityStarter, there is a possible background activity launch due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploita…

  6. 7.8CVE-2023-40685EPSS 0.2%

    Management Central as part of IBM i 7.2, 7.3, 7.4, and 7.5 Navigator contains a local privilege escalation vulnerability. A malicious actor with command line access to the operating system can exploit this vulnerability to elevate privile…

  7. 7.8CVE-2023-40686EPSS 0.2%

    Management Central as part of IBM i 7.2, 7.3, 7.4, and 7.5 Navigator contains a local privilege escalation vulnerability. A malicious actor with command line access to the operating system can exploit this vulnerability to elevate privile…

  8. 7.8CVE-2022-3701EPSS 0.1%

    A privilege elevation vulnerability was reported in the Lenovo Vantage SystemUpdate plugin version 2.0.0.212 and earlier that could allow a local attacker to execute arbitrary code with elevated privileges.

  9. 7.8CVE-2023-44219EPSS 0.2%

    A local privilege escalation vulnerability in SonicWall Directory Services Connector Windows MSI client 4.1.21 and earlier versions allows a local low-privileged user to gain system privileges through running the recovery feature.

  10. 7.8CVE-2023-34057EPSS 0.2%

    VMware Tools contains a local privilege escalation vulnerability. A malicious actor with local user access to a guest virtual machine may elevate privileges within the virtual machine.

  11. 8.8CVE-2023-5622EPSS 0.5%

    Under certain conditions, Nessus Network Monitor could allow a low privileged user to escalate privileges to NT AUTHORITY\SYSTEM on Windows hosts by replacing a specially crafted file.

  12. 8.8CVE-2023-41966EPSS 0.8%

    The application suffers from a privilege escalation vulnerability. A user with read permissions can elevate privileges by sending a HTTP POST to set a parameter.

  13. 7.8CVE-2023-5671EPSS 0.2%

    HP Print and Scan Doctor for Windows may potentially be vulnerable to escalation of privilege. HP is releasing software updates to mitigate the potential vulnerability.

  14. 8.8CVE-2023-4607EPSS 0.5%

    An authenticated XCC user can change permissions for any user through a crafted API command.

  15. 7.8CVE-2023-43506EPSS 0.2%

    A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges to those of a higher role. A successful exploit allows malicious users to execute arbitrary code with roo…

  16. 8.2CVE-2023-39740EPSS 0.7%

    The leakage of the client secret in Onigiriya-musubee Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.

  17. 8.2CVE-2023-39734EPSS 0.7%

    The leakage of the client secret in VISION MEAT WORKS TrackDiner10/10_mc Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.

  18. 8.2CVE-2023-39733EPSS 0.7%

    The leakage of the client secret in TonTon-Tei Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.

  19. 8.2CVE-2023-39732EPSS 0.7%

    The leakage of the client secret in Tokueimaru_waiting Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.

  20. 5.5CVE-2021-26734EPSS 0.2%

    Zscaler Client Connector Installer on Windows before version 3.4.0.124 improperly handled directory junctions during uninstallation. A local adversary may be able to delete folders in an elevated context.

  21. 7.8CVE-2023-34045EPSS 0.2%

    VMware Fusion(13.x prior to 13.5) contains a local privilege escalation vulnerability that occurs during installation for the first time (the user needs to drag or copy the application to a folder from the '.dmg' volume) or when installi…

  22. 7.8CVE-2023-46277EPSS 0.3%

    please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

  23. 7.8CVE-2023-27795EPSS 0.2%

    An issue found in IXP Data Easy Install v.6.6.14884.0 allows a local attacker to gain privileges via a static XOR key.

  24. 7.8CVE-2023-27793EPSS 0.2%

    An issue discovered in IXP Data Easy Install v.6.6.14884.0 allows local attackers to gain escalated privileges via weak encoding of sensitive information.

  25. 7.8CVE-2023-45883EPSS 0.2%

    A privilege escalation vulnerability exists within the Qumu Multicast Extension v2 before 2.0.63 for Windows. When a standard user triggers a repair of the software, a pop-up window opens with SYSTEM privileges. Standard users may use this…

  26. 8.8CVE-2023-41715EPSS 0.8%

    SonicOS post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunnel allows users to elevate their privileges inside the tunnel.

  27. 8.2CVE-2023-22099EPSS 0.4%

    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.12. Easily exploitable vulnerability allows high privileged attacker with logon to the inf…

  28. 7.8CVE-2023-20598EPSS 0.5%

    An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOCTL request to gain I/O control over arbitrary hardware ports or physical addresses resulting in a potential arbitrary co…

  29. 8.8CVE-2023-43120EPSS 0.9%

    An issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, before 22.7 and before 31.7.1 allows attackers to gain escalated privileges via crafted HTTP request.

  30. 4.3CVE-2023-4834EPSS 0.4%

    In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an improperly implemented access validation allows an authenticated, low privileged attacker to gain read access to limite…

  31. 7.2CVE-2023-4822EPSS 1.3%

    Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permission…

  32. 9.8CVE-2023-44809EPSS 1.1%

    D-Link device DIR-820L 1.05B03 is vulnerable to Insecure Permissions.

  33. 7.8CVE-2023-38280EPSS 0.2%

    IBM HMC (Hardware Management Console) 10.1.1010.0 and 10.2.1030.0 could allow a local user to escalate their privileges to root access on a restricted shell. IBM X-Force ID: 260740.

  34. 7.8CVE-2023-40377EPSS 0.1%

    Backup, Recovery, and Media Services (BRMS) for IBM i 7.2, 7.3, and 7.4 contains a local privilege escalation vulnerability. A malicious actor with command line access to the host operating system can elevate privileges to gain component …

  35. 7.8CVE-2023-40378EPSS 0.1%

    IBM Directory Server for IBM i contains a local privilege escalation vulnerability. A malicious actor with command line access to the host operating system can elevate privileges to gain component access to the host operating system. IBM…

  36. 7.8CVE-2023-27316EPSS 0.2%

    SnapCenter versions 4.8 through 4.9 are susceptible to a vulnerability which may allow an authenticated SnapCenter Server user to become an admin user on a remote system where a SnapCenter plug-in has been installed.

  37. 7.8CVE-2023-38817EPSS 0.5%

    An issue in Inspect Element Ltd Echo.ac v.5.2.1.0 allows a local attacker to gain privileges via a crafted command to the echo_driver.sys component. NOTE: the vendor's position is that the reported ability for user-mode applications to exe…

  38. 8.8CVE-2023-43960EPSS 1.4%

    An issue in DLINK DPH-400SE FRU 2.2.15.8 allows a remote attacker to escalate privileges via the User Modify function in the Maintenance/Access function component.

  39. 6.7CVE-2023-4936EPSS 0.2%

    It is possible to sideload a compromised DLL during the installation at elevated privilege.

  40. 9.8CVE-2023-44105EPSS 0.5%

    Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this vulnerability may cause features to perform abnormally.

  41. 9.8CVE-2023-44106EPSS 0.5%

    API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may cause features to perform abnormally.

  42. 7.0CVE-2023-36721EPSS 0.4%

    Windows Error Reporting Service Elevation of Privilege Vulnerability

  43. 8.4CVE-2023-36569EPSS 0.5%

    Microsoft Office Elevation of Privilege Vulnerability

  44. 9.8CVE-2023-5214EPSS 0.4%

    In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified.

  45. 7.8CVE-2023-26236EPSS 0.2%

    An issue was discovered in WatchGuard EPDR 8.0.21.0002. Due to a weak implementation of message handling between WatchGuard EPDR processes, it is possible to perform a Local Privilege Escalation on Windows by sending a crafted message to a…

  46. 9.8CVE-2023-5402EPSS 0.7%

    A CWE-269: Improper Privilege Management vulnerability exists that could cause a remote code execution when the transfer command is used over the network.

  47. 8.8CVE-2023-20235EPSS 0.9%

    A vulnerability in the on-device application development workflow feature for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an authenticated, remote attacker to access the underlying operating system…

  48. 7.8CVE-2023-44217EPSS 0.2%

    A local privilege escalation vulnerability in SonicWall Net Extender MSI client for Windows 10.2.336 and earlier versions allows a local low-privileged user to gain system privileges through running repair functionality.

  49. 8.8CVE-2023-36628EPSS 0.6%

    A flaw exists in VASA which allows users with access to a vSphere/ESXi VMware admin on a FlashArray to gain root access through privilege escalation.

  50. 4.3CVE-2023-43664EPSS 0.5%

    PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list all modules without any access rights: method `ajaxProcessGetPossibleHookingListForModule` doesn't check access rights. …