CWE-269: Improper Privilege Management, page 50

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

What the weakness is: CWE-269 at MITRE

1. 7.8CVE-2022-3990EPSS 0.2%2023-02-01

   HPSFViewer might allow Escalation of Privilege. This potential vulnerability was remediated on July 29th, 2022. Customers who opted for automatic updates should have already received the remediation.

2. 7.8CVE-2022-23455EPSS 0.2%2023-02-01

   Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, allowed communication with untrusted clients, and unauthorized modification of fi…

3. 7.8CVE-2021-3809EPSS 0.2%2023-02-01

   Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary code execution. HP is releasing firmware updates to mitigate these potential vulnerabilities.

4. 7.8CVE-2021-3808EPSS 0.2%2023-02-01

   Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary code execution. HP is releasing firmware updates to mitigate these potential vulnerabilities.

5. 7.8CVE-2021-3439EPSS 0.2%2023-02-01

   HP has identified a potential vulnerability in BIOS firmware of some Workstation products. Firmware updates are being released to mitigate these potential vulnerabilities.

6. 9.8CVE-2022-45101EPSS 0.8%2023-02-01

   Dell PowerScale OneFS 9.0.0.x - 9.4.0.x, contains an Improper Handling of Insufficient Privileges vulnerability in NFS. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure and r…

7. 8.8CVE-2023-0524EPSS 0.6%2023-02-01

   As part of our Security Development Lifecycle, a potential privilege escalation issue was identified internally. This could allow a malicious actor with sufficient permissions to modify environment variables and abuse an impacted plugin in…

8. 8.8CVE-2022-4441EPSS 0.6%2023-01-31

   Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation. This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.9.0 before 0…

9. 8.8CVE-2022-4041EPSS 0.6%2023-01-31

   Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation. This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.8.0 before 0…

10. 8.8CVE-2022-46359EPSS 0.2%2023-01-30

    Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclosure.

11. 8.8CVE-2022-46358EPSS 0.2%2023-01-30

    Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclosure.

12. 8.8CVE-2022-46357EPSS 0.2%2023-01-30

    Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclosure.

13. 8.8CVE-2022-46356EPSS 0.2%2023-01-30

    Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclosure.

14. 6.3CVE-2023-23629EPSS 0.4%2023-01-28

    Metabase is an open source data analytics platform. Affected versions are subject to Improper Privilege Management. As intended, recipients of dashboards subscriptions can view the data as seen by the creator of that subscription. This all…

15. 6.5CVE-2023-23610EPSS 0.7%2023-01-26

    GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having access to the standard interface can export data of almost any GLPI item type, ev…

16. 7.8CVE-2022-43997EPSS 0.3%2023-01-26

    Incorrect access control in Aternity agent in Riverbed Aternity before 12.1.4.27 allows for local privilege escalation. There is an insufficiently protected handle to the A180AG.exe SYSTEM process with PROCESS_ALL_ACCESS rights.

17. 7.8CVE-2022-38775EPSS 0.3%2023-01-26

    An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate their privileges to those of the LocalSystem account.

18. 7.8CVE-2022-38774EPSS 0.2%2023-01-26

    An issue was discovered in the quarantine feature of Elastic Endpoint Security and Elastic Endgame for Windows, which could allow unprivileged users to elevate their privileges to those of the LocalSystem account.

19. 8.8CVE-2023-0101EPSS 0.8%2023-01-20

    A privilege escalation vulnerability was identified in Nessus versions 8.10.1 through 8.15.8 and 10.0.0 through 10.4.1. An authenticated attacker could potentially execute a specially crafted file to obtain root or NT AUTHORITY / SYSTEM pr…

20. 7.8CVE-2022-25631EPSS 0.2%2023-01-20

    Symantec Endpoint Protection, prior to 14.3 RU6 (14.3.9210.6000), may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated

21. 7.5CVE-2023-22331EPSS 1.1%2023-01-20

    Use of default credentials vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenticated attacker to alter user credentials information.

22. 8.8CVE-2023-0242EPSS 0.6%2023-01-18

    Rapid7 Velociraptor allows users to be created with different privileges on the server. Administrators are generally allowed to run any command on the server including writing arbitrary files. However, lower privilege users are generally f…

23. 7.8CVE-2023-22809ExploitEPSS 55%2023-01-18

    In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of fil…

24. 5.3CVE-2021-4314EPSS 0.5%2023-01-18

    It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only in the situation when zOSMF doesn’t have the APAR PH12143 applied. This issue a…

25. 8.8CVE-2023-21848EPSS 0.6%2023-01-18

    Vulnerability in the Oracle Communications Convergence product of Oracle Communications Applications (component: Admin Configuration). The supported version that is affected is 3.0.3.1.0. Easily exploitable vulnerability allows low privi…

26. 4.4CVE-2023-0221EPSS 0.2%2023-01-13

    Product security bypass vulnerability in ACC prior to version 8.3.4 allows a locally logged-in attacker with administrator privileges to bypass the execution controls provided by ACC using the utilman program.

27. 8.8CVE-2022-39182EPSS 0.4%2023-01-12

    H C Mingham-Smith Ltd - Tardis 2000 Privilege escalation.Version 1.6 is vulnerable to privilege escalation which may allow a malicious actor to gain system privileges.

28. 7.8CVE-2023-21774EPSS 0.7%2023-01-10

    Windows Kernel Elevation of Privilege Vulnerability

29. 7.8CVE-2023-21773EPSS 0.7%2023-01-10

    Windows Kernel Elevation of Privilege Vulnerability

30. 7.8CVE-2023-21772EPSS 0.7%2023-01-10

    Windows Kernel Elevation of Privilege Vulnerability

31. 7.8CVE-2023-21755EPSS 0.5%2023-01-10

    Windows Kernel Elevation of Privilege Vulnerability

32. 7.8CVE-2023-21730EPSS 0.5%2023-01-10

    Microsoft Cryptographic Services Elevation of Privilege Vulnerability

33. 7.8CVE-2023-21561EPSS 0.4%2023-01-10

    Microsoft Cryptographic Services Elevation of Privilege Vulnerability

34. 7.8CVE-2023-21552EPSS 3.5%2023-01-10

    Windows GDI Elevation of Privilege Vulnerability

35. 7.8CVE-2023-21551EPSS 0.4%2023-01-10

    Microsoft Cryptographic Services Elevation of Privilege Vulnerability

36. 8.8CVE-2023-21549EPSS 1.5%2023-01-10

    Windows SMB Witness Service Elevation of Privilege Vulnerability

37. 7.0CVE-2023-21542EPSS 0.3%2023-01-10

    Windows Installer Elevation of Privilege Vulnerability

38. 7.0CVE-2023-21531EPSS 0.6%2023-01-10

    Azure Service Fabric Container Elevation of Privilege Vulnerability

39. 7.8CVE-2022-4294EPSS 0.2%2023-01-10

    Norton, Avira, Avast and AVG Antivirus for Windows may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resou…

40. 9.8CVE-2022-0668EPSS 0.6%2023-01-08

    JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted request is sent by an unauthenticated user.

41. 7.8CVE-2022-43535EPSS 0.2%2023-01-05

    A vulnerability in the ClearPass OnGuard Windows agent could allow malicious users on a Windows instance to elevate their user privileges. A successful exploit could allow these users to execute arbitrary code with NT AUTHORITY\SYSTEM leve…

42. 7.8CVE-2022-43534EPSS 0.2%2023-01-05

    A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges. A successful exploit could allow these users to execute arbitrary code with root level privileges on the…

43. 7.8CVE-2022-43533EPSS 0.2%2023-01-05

    A vulnerability in the ClearPass OnGuard macOS agent could allow malicious users on a macOS instance to elevate their user privileges. A successful exploit could allow these users to execute arbitrary code with root level privileges on the…

44. 8.8CVE-2022-4808EPSS 0.4%2022-12-28

    Improper Privilege Management in GitHub repository usememos/memos prior to 0.9.1.

45. 6.4CVE-2022-46172EPSS 0.6%2022-12-28

    authentik is an open-source Identity provider focused on flexibility and versatility. In versions prior to 2022.10.4, and 2022.11.4, any authenticated user can create an arbitrary number of accounts through the default flows. This would ci…

46. 9.8CVE-2022-45963EPSS 0.7%2022-12-27

    h3c firewall <= 3.10 ESS6703 has a privilege bypass vulnerability.

47. 7.8CVE-2022-37706ExploitEPSS 6.0%2022-12-25

    enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring.

48. 8.4CVE-2022-41290EPSS 0.2%2022-12-23

    IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the rm_rlcache_file command to obtain root privileges. IBM X-Force ID: 236690.

49. 7.2CVE-2022-38757EPSS 0.9%2022-12-23

    A vulnerability has been identified in Micro Focus ZENworks 2020 Update 3a and prior versions. This vulnerability allows administrators with rights to perform actions (e.g., install a bundle) on a set of managed devices, to be able to exer…

50. 8.1CVE-2022-4687EPSS 0.7%2022-12-23

    Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0.