cve.bz

CWE-269: Improper Privilege Management, page 46

Filter

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

What the weakness is: CWE-269 at MITRE

Ask an AI about CWE-269

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-269: Improper Privilege Management and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/269.html and https://cve.bz/cve/cwe/269?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2023-43663EPSS 0.4%

    PrestaShop is an Open Source e-commerce web application. In affected versions any module can be disabled or uninstalled from back office, even with low user right. This allows low privileged users to disable portions of a shops functionali…

  2. 7.8CVE-2023-40375EPSS 0.2%

    Integrated application server for IBM i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability. A malicious actor with command line access to the host operating system can elevate privileges to gain root access to the …

  3. 8.8CVE-2023-33972EPSS 0.6%

    Scylladb is a NoSQL data store using the seastar framework, compatible with Apache Cassandra. Authenticated users who are authorized to create tables in a keyspace can escalate their privileges to access a table in the same keyspace, even …

  4. 8.8CVE-2023-41326EPSS 37%

    GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A logged user from any profile can hijack the Ka…

  5. 8.8CVE-2023-41324EPSS 0.9%

    GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. An API user that have read access on users resou…

  6. 8.8CVE-2023-41322EPSS 0.9%

    GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A user with write access to another user can mak…

  7. 5.3CVE-2023-41312EPSS 0.4%

    Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause several apps to be activated automatically.

  8. 7.5CVE-2023-41309EPSS 0.7%

    Permission control vulnerability in the MediaPlaybackController module. Successful exploitation of this vulnerability may affect availability.

  9. 9.8CVE-2023-39375EPSS 0.8%

    SiberianCMS - CWE-274: Improper Handling of Insufficient Privileges

  10. 6.7CVE-2023-34043EPSS 0.2%

    VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges to 'root'.

  11. 9.8CVE-2023-43457EPSS 1.4%

    An issue in Service Provider Management System v.1.0 allows a remote attacker to gain privileges via the ID parameter in the /php-spms/admin/?page=user/ endpoint.

  12. 7.5CVE-2023-41301EPSS 0.4%

    Vulnerability of unauthorized API access in the PMS module. Successful exploitation of this vulnerability may cause features to perform abnormally.

  13. 7.8CVE-2023-43766EPSS 0.2%

    Certain WithSecure products allow Local privilege escalation via the lhz archive unpack handler. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoi…

  14. 9.8CVE-2023-4662EPSS 1.2%

    Execution with Unnecessary Privileges vulnerability in Saphira Saphira Connect allows Remote Code Inclusion. This issue affects Saphira Connect: before 9.

  15. 9.8CVE-2023-36657EPSS 0.7%

    An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Built-in features of Windows (desktop shortcuts, narrator) can be abused for privilege escalation.

  16. 5.3CVE-2023-42468EPSS 1.2%

    The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of improper export of the com.cutestudio.dialer.activities.DialerActivity component. A th…

  17. 9.8CVE-2023-36765EPSS 1.0%

    Microsoft Office Elevation of Privilege Vulnerability

  18. 7.8CVE-2023-35676EPSS 0.1%

    In createQuickShareAction of SaveImageInBackgroundTask.java, there is a possible way to trigger a background activity launch due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution priv…

  19. 7.8CVE-2023-35674KEVEPSS 2.6%

    In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is…

  20. 5.5CVE-2023-35671EPSS 0.2%

    In onHostEmulationData of HostEmulationManager.java, there is a possible way for a general purpose NFC reader to read the full card number and expiry details when the device is in locked screen mode due to a logic error in the code. This c…

  21. 7.8CVE-2023-35667EPSS 0.09%

    In updateList of NotificationAccessSettings.java, there is a possible way to hide approved notification listeners in the settings due to a logic error in the code. This could lead to local escalation of privilege with no additional executi…

  22. 4.9CVE-2023-20194EPSS 0.7%

    A vulnerability in the ERS API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device. To exploit this vulnerability, an attacker must have valid Administ…

  23. 3.3CVE-2023-41053EPSS 0.3%

    Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configur…

  24. 8.8CVE-2020-10129EPSS 0.9%

    SearchBlox before Version 9.2.1 is vulnerable to Privileged Escalation-Lower user is able to access Admin functionality.

  25. 5.5CVE-2023-30713EPSS 0.1%

    Improper privilege management vulnerability in FolderLockNotifier in One UI Home prior to SMR Sep-2023 Release 1 allows local attackers to change some settings of the folder lock.

  26. 7.8CVE-2023-32426EPSS 0.2%

    A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3. An app may be able to gain root privileges.

  27. 8.8CVE-2023-29166EPSS 0.6%

    A logic issue was addressed with improved state management. This issue is fixed in Pro Video Formats 2.2.5. A user may be able to elevate privileges.

  28. 7.8CVE-2020-35593EPSS 0.3%

    BMC PATROL Agent through 20.08.00 allows local privilege escalation via vectors involving pconfig +RESTART -host.

  29. 8.8CVE-2023-40918EPSS 0.7%

    KnowStreaming 3.3.0 is vulnerable to Escalation of Privileges. Unauthorized users can create a new user with an admin role.

  30. 9.8CVE-2023-36100EPSS 0.7%

    An issue was discovered in IceCMS version 2.0.1, allows attackers to escalate privileges and gain sensitive information via UserID parameter in api/User/ChangeUser.

  31. 8.8CVE-2023-4697EPSS 0.8%

    Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2.

  32. 7.8CVE-2023-41743EPSS 0.4%

    Local privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40278, Acronis Cyber Protect Cloud Agent (Windows) before build…

  33. 9.8CVE-2023-31175EPSS 0.4%

    An Execution with Unnecessary Privileges vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to run system commands with the highest level privilege on the system. See Instru…

  34. 7.8CVE-2022-45451EPSS 0.5%

    Local privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40173, Acronis Agent (Windows) before build 30600, Acronis Cybe…

  35. 8.8CVE-2023-3636EPSS 0.9%

    The WP Project Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.6.4 due to insufficient restriction on the 'save_users_map_name' function. This makes it possible for authenticated attac…

  36. 7.2CVE-2023-20266EPSS 0.5%

    A vulnerability in Cisco Emergency Responder, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an authenticated, rem…

  37. 8.8CVE-2023-32457EPSS 0.6%

    Dell PowerScale OneFS, versions 8.2.2.x-9.5.0.x, contains an improper privilege management vulnerability. A remote attacker with low privileges could potentially exploit this vulnerability, leading to escalation of privileges.

  38. 9.6CVE-2019-13690EPSS 0.4%

    Inappropriate implementation in OS in Google Chrome on ChromeOS prior to 75.0.3770.80 allowed a remote attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)

  39. 7.5CVE-2023-32559EPSS 1.8%

    A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal mod…

  40. 9.8CVE-2023-4404EPSS 0.9%

    The Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.7.0.12 due to insufficient restriction on the 'update_core_user' function. This makes it possible for unauthent…

  41. 9.8CVE-2023-38734EPSS 0.7%

    IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an LDAP directory. IBM X-Force ID: 262481.

  42. 5.5CVE-2023-3699EPSS 0.2%

    An Improper Privilege Management vulnerability was found in ASUSTOR Data Master (ADM) allows an unprivileged local users to modify the storage devices configuration. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below a…

  43. 7.5CVE-2021-35309EPSS 0.5%

    An issue discovered in Samsung SyncThru Web Service SPL 5.93 06-09-2014 allows attackers to gain escalated privileges via MITM attacks.

  44. 3.3CVE-2023-25647EPSS 0.2%

    There is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile phone could monitor the touch event.

  45. 6.7CVE-2023-32490EPSS 0.2%

    Dell PowerScale OneFS 8.2x -9.5x contains an improper privilege management vulnerability. A high privilege local attacker could potentially exploit this vulnerability, leading to system takeover.

  46. 7.8CVE-2023-32487EPSS 0.2%

    Dell PowerScale OneFS, 8.2.x - 9.5.0.x, contains an elevation of privilege vulnerability. A low privileged local attacker could potentially exploit this vulnerability, leading to denial of service, code execution and information disclosure.

  47. 7.8CVE-2023-21272EPSS 0.2%

    In readFrom of Uri.java, there is a possible bad URI permission grant due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exp…

  48. 7.8CVE-2023-21269EPSS 0.09%

    In startActivityInner of ActivityStarter.java, there is a possible way to launch an activity into PiP mode from the background due to BAL bypass. This could lead to local escalation of privilege with no additional execution privileges need…

  49. 7.8CVE-2023-38721EPSS 0.2%

    The IBM i 7.2, 7.3, 7.4, and 7.5 product Facsimile Support for i contains a local privilege escalation vulnerability. A malicious actor could gain access to a command line with elevated privileges allowing root access to the host operati…

  50. 8.0CVE-2023-0872ExploitEPSS 3.3%

    The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30,…