cve.bz

CWE-269: Improper Privilege Management, page 48

Filter

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

What the weakness is: CWE-269 at MITRE

Ask an AI about CWE-269

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-269: Improper Privilege Management and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/269.html and https://cve.bz/cve/cwe/269?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2023-33966EPSS 0.6%

    Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in `node:http` or `node:https` modules are incorrectly not checked against the network permission allow l…

  2. 9.8CVE-2023-29734EPSS 0.9%

    An issue found in edjing Mix v.7.09.01 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the database.

  3. 8.8CVE-2023-32696EPSS 0.8%

    CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.1, the `ckan` user (equivalent to www-data) owned code and configuration files in the docker container and the `ckan` u…

  4. 6.7CVE-2022-45853EPSS 0.2%

    The privilege escalation vulnerability in the Zyxel GS1900-8 firmware version V2.70(AAHH.3) and the GS1900-8HP firmware version V2.70(AAHI.3) could allow an authenticated, local attacker with administrator privileges to execute some syst…

  5. 7.8CVE-2023-30601EPSS 0.3%

    Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue affects Apache Cassandra: from 4.0.0 through 4.0.9, from 4.1.0 through 4.1.1. WORKAROU…

  6. 9.8CVE-2023-31062EPSS 1.3%

    Improper Privilege Management Vulnerabilities in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0.  When the attacker has access to a valid (but unprivileged) account, the exploit can be e…

  7. 7.5CVE-2023-1694EPSS 0.4%

    The Settings module has the file privilege escalation vulnerability.Successful exploitation of this vulnerability may affect confidentiality.

  8. 7.5CVE-2023-1693EPSS 0.4%

    The Settings module has the file privilege escalation vulnerability.Successful exploitation of this vulnerability may affect confidentiality.

  9. 7.8CVE-2022-45452EPSS 0.2%

    Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Agent (Windows) before build 30430, Acronis Cyber Protect 15 (Windows) before build 30984.

  10. 4.3CVE-2023-2679EPSS 0.4%

    Data leakage in Adobe connector in Snow Software SPE 9.27.0 on Windows allows privileged user to observe other users data.

  11. 5.5CVE-2023-29819EPSS 0.2%

    An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to bypass protections via a crafted payload.

  12. 5.4CVE-2023-25834EPSS 0.3%

    Changes to user permissions in Portal for ArcGIS 10.9.1 and below are incompletely applied in specific use cases. This issue may allow users to access content that they are no longer privileged to access.

  13. 7.1CVE-2020-23362EPSS 0.7%

    Insecure Permissons vulnerability found in Shop_CMS YerShop all versions allows a remote attacker to escalate privileges via the cover_id parameter.

  14. 7.5CVE-2023-29350EPSS 2.6%

    Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

  15. 9.9CVE-2023-22651EPSS 0.8%

    Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. A failure in the update logic of Rancher's admission Webhook may lead to the misconfiguration of the Webhook. This component enforces validation rul…

  16. 8.8CVE-2022-3405ExploitEPSS 5.3%

    Code execution and sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 29486, Acronis Cyber Backup 12.5 (Window…

  17. 5.9CVE-2023-29056EPSS 0.4%

    A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to use an LDAP server for Authentication/Authorization and have the login permission…

  18. 9.8CVE-2023-1966EPSS 0.9%

    Instruments with Illumina Universal Copy Service v1.x and v2.x contain an unnecessary privileges vulnerability. An unauthenticated malicious actor could upload and execute code remotely at the operating system level, which could allow an a…

  19. 6.6CVE-2023-30024EPSS 0.5%

    The MagicJack device, a VoIP solution for internet phone calls, contains a hidden NAND flash memory partition allowing unauthorized read/write access. Attackers can exploit this by replacing the original software with a malicious version, …

  20. 5.7CVE-2023-28261EPSS 0.6%

    Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

  21. 7.8CVE-2023-26246EPSS 0.3%

    An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUpgrade binary file, which is used during the firmware installation process, can be modified by an attacker to bypass the…

  22. 7.8CVE-2023-26245EPSS 0.3%

    An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUpgrade binary file, which is used during the firmware installation process, can be modified by an attacker to bypass the…

  23. 7.8CVE-2023-26244EPSS 0.3%

    An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppDMClient binary file, which is used during the firmware installation process, can be modified by an attacker to bypass th…

  24. 7.8CVE-2023-26243EPSS 0.3%

    An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The decryption binary used to decrypt firmware files has an information leak that allows an attacker to read the AES key and ini…

  25. 8.8CVE-2023-30622EPSS 0.2%

    Clusternet is a general-purpose system for controlling Kubernetes clusters across different environments. An issue in clusternet prior to version 0.15.2 can be leveraged to lead to a cluster-level privilege escalation. The clusternet has a…

  26. 9.8CVE-2023-25133EPSS 1.0%

    Improper privilege management vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 3…

  27. 8.8CVE-2023-2240EPSS 0.7%

    Improper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4.

  28. 7.8CVE-2022-47505EPSS 0.2%

    The SolarWinds Platform was susceptible to the Local Privilege Escalation Vulnerability. This vulnerability allows a local adversary with a valid system user account to escalate local privileges.

  29. 7.8CVE-2023-28122EPSS 0.2%

    A local privilege escalation (LPE) vulnerability in UI Desktop for Windows (Version 0.59.1.71 and earlier) allows a malicious actor with local access to a Windows device running said application to submit arbitrary commands as SYSTEM.This …

  30. 8.8CVE-2023-22645EPSS 0.5%

    An Improper Privilege Management vulnerability in SUSE kubewarden allows attackers to read arbitrary secrets if they get access to the ServiceAccount kubewarden-controller This issue affects: SUSE kubewarden kubewarden-controller versions …

  31. 8.2CVE-2023-21990EPSS 0.3%

    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.44 and Prior to 7.0.8. Easily exploitable vulnerability allows high privileged attacker w…

  32. 7.8CVE-2023-21987EPSS 0.7%

    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.44 and Prior to 7.0.8. Difficult to exploit vulnerability allows low privileged attacker …

  33. 7.0CVE-2023-21896EPSS 0.2%

    Vulnerability in the Oracle Solaris product of Oracle Systems (component: NSSwitch). Supported versions that are affected are 10 and 11. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure w…

  34. 5.5CVE-2023-1548EPSS 0.1%

    A CWE-269: Improper Privilege Management vulnerability exists that could cause a local user to perform a denial of service through the console server service that is part of EcoStruxure Control Expert. Affected Products: EcoStruxure Contro…

  35. 9.9CVE-2023-22946EPSS 1.1%

    In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing maliciou…

  36. 9.8CVE-2023-27654EPSS 1.1%

    An issue found in WHOv.1.0.28, v.1.0.30, v.1.0.32 allows an attacker to cause a escalation of privileges via the TTMultiProvider component.

  37. 8.8CVE-2023-29018EPSS 0.7%

    The OpenFeature Operator allows users to expose feature flags to applications. Assuming the pre-existence of a vulnerability that allows for arbitrary code execution, an attacker could leverage the lax permissions configured on `open-featu…

  38. 7.8CVE-2023-27651EPSS 0.4%

    An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges via the update_info field of the _default_.xml file.

  39. 7.8CVE-2023-1326EPSS 0.9%

    A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unprivileged users to run sudo apport-cli, less is configured as the pager, and the t…

  40. 7.8CVE-2023-24509EPSS 0.2%

    On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root use…

  41. 9.0CVE-2023-27830EPSS 1.1%

    TightVNC before v2.8.75 allows attackers to escalate privileges on the host operating system via replacing legitimate files with crafted files when executing a file transfer. This is due to the fact that TightVNC runs in the backend as a h…

  42. 8.8CVE-2022-27487EPSS 1.0%

    A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptor version 4.1.0, 4.0.0 through 4.0.2 and before 3.3.3 allows a remote authenticated attacker to perf…

  43. 9.8CVE-2023-27645EPSS 1.5%

    An issue found in POWERAMP audioplayer build 925 bundle play and build 954 allows a remote attacker to gain privileges via the reverb and EQ preset parameters.

  44. 6.7CVE-2023-20680EPSS 0.09%

    In adsp, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS076…

  45. 7.8CVE-2023-20655EPSS 0.09%

    In mmsdk, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS0…

  46. 6.5CVE-2023-0959EPSS 0.7%

    Bhima version 1.27.0 allows a remote attacker to update the privileges of any account registered in the application via a malicious link sent to an administrator. This is possible because the application is vulnerable to CSRF.

  47. 6.5CVE-2023-28855EPSS 0.6%

    Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows any authenticated user to write data to any fields container, including those to w…

  48. 8.1CVE-2023-28632EPSS 0.7%

    GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, an authenticated user can modify emails of any user, and can therefore takeover another user account through the "fo…

  49. 7.8CVE-2022-48227EPSS 0.2%

    An issue was discovered in Acuant AsureID Sentinel before 5.2.149. It allows elevation of privileges because it opens Notepad after the installation of AssureID, Identify x64, and Identify x86, aka CORE-7361.

  50. 7.8CVE-2022-48226EPSS 0.2%

    An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. During installation, an EXE gets executed out of C:\Windows\Temp. A standard user can create the path file ahead of time and obtain elevated code execution. Permissions need…