CWE-269: Improper Privilege Management, page 52

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

What the weakness is: CWE-269 at MITRE

1. 7.5CVE-2022-39422EPSS 0.5%2022-10-18

   Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.38. Difficult to exploit vulnerability allows high privileged attacker with logon to the in…

2. 8.8CVE-2022-22239EPSS 0.2%2022-10-18

   An Execution with Unnecessary Privileges vulnerability in Management Daemon (mgd) of Juniper Networks Junos OS Evolved allows a locally authenticated attacker with low privileges to escalate their privileges on the device and potentially r…

3. 7.3CVE-2022-3421EPSS 0.1%2022-10-17

   An attacker can pre-create the `/Applications/Google\ Drive.app/Contents/MacOS` directory which is expected to be owned by root to be owned by a non-root user. When the Drive for Desktop installer is run for the first time, it will place a…

4. 6.7CVE-2022-2249EPSS 0.2%2022-10-12

   Privilege escalation related vulnerabilities were discovered in Avaya Aura Communication Manager that may allow local administrative users to escalate their privileges. This issue affects Communication Manager versions 8.0.0.0 through 8.1.…

5. 7.8CVE-2022-41032EPSS 1.3%2022-10-11

   NuGet Client Elevation of Privilege Vulnerability

6. 7.5CVE-2022-3422EPSS 1.0%2022-10-07

   Account Takeover :: when see the info i can see the hash pass i can creaked it ............... Account Takeover :: when see the info i can see the forgot_password_token the hacker can send the request and changed the pass

7. 6.7CVE-2022-2975EPSS 0.2%2022-10-06

   A vulnerability related to weak permissions was detected in Avaya Aura Application Enablement Services web application, allowing an administrative user to modify accounts leading to execution of arbitrary code as the root user. This issue …

8. 8.8CVE-2022-2637EPSS 0.6%2022-10-06

   Incorrect Privilege Assignment vulnerability in Hitachi Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation.This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.8.0 b…

9. 7.8CVE-2022-41975EPSS 0.2%2022-09-30

   RealVNC VNC Server before 6.11.0 and VNC Viewer before 6.22.826 on Windows allow local privilege escalation via MSI installer Repair mode.

10. 8.8CVE-2022-39032EPSS 0.9%2022-09-28

    Smart eVision has an improper privilege management vulnerability. A remote attacker with general user privilege can exploit this vulnerability to escalate to administrator privilege, and then perform arbitrary system command or disrupt ser…

11. 8.8CVE-2022-41604EPSS 0.6%2022-09-27

    Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. This occurs because of weak permissions for the %PROGRAMDATA%\CheckPoint\ZoneAlarm\Data\Updates directory, and a self-protection driver…

12. 7.8CVE-2022-32829EPSS 0.6%2022-09-23

    This issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to execute arbitrary code with kernel privileges.

13. 7.8CVE-2022-32826EPSS 0.3%2022-09-23

    An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macOS Monterey 12.5, Security Update 2022-005 Catalina. An app may be able …

14. 7.8CVE-2022-32819EPSS 0.4%2022-09-23

    A logic issue was addressed with improved state management. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macOS Monterey 12.5, Security Update 2022-005 Catalina. An app may be able to gain r…

15. 7.8CVE-2022-32801EPSS 0.9%2022-09-23

    This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5. An app may be able to gain root privileges.

16. 4.4CVE-2022-32782EPSS 0.3%2022-09-23

    This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.4. An app with root privileges may be able to access private information.

17. 4.4CVE-2022-32781EPSS 0.3%2022-09-23

    This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.4, iOS 15.5 and iPadOS 15.5, Security Update 2022-005 Catalina, macOS Big Sur 11.6.8. An app with root privileges may be able to access private…

18. 7.8CVE-2022-35257EPSS 0.2%2022-09-23

    A local privilege escalation vulnerability in UI Desktop for Windows (Version 0.55.1.2 and earlier) allows a malicious actor with local access to a Windows device with UI Desktop to run arbitrary commands as SYSTEM.

19. 6.7CVE-2022-30121EPSS 0.3%2022-09-23

    The “LANDesk(R) Management Agent” service exposes a socket and once connected, it is possible to launch commands only for signed executables. This is a security bug that allows a limited user to get escalated admin privileges on their syst…

20. 8.8CVE-2022-3068EPSS 0.5%2022-09-21

    Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3.

21. 7.5CVE-2022-3079EPSS 0.8%2022-09-20

    Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service.

22. 8.8CVE-2022-38351EPSS 1.1%2022-09-19

    A vulnerability in Suprema BioStar (aka Bio Star) 2 v2.8.16 allows attackers to escalate privileges to System Administrator via a crafted PUT request to the update profile page.

23. 7.8CVE-2022-40142EPSS 0.3%2022-09-19

    A security link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service agents could allow a local attacker to create a writable folder in an arbitrary location and escalate privileg…

24. 9.8CVE-2022-39007EPSS 0.7%2022-09-16

    The location module has a vulnerability of bypassing permission verification.Successful exploitation of this vulnerability may cause privilege escalation.

25. 4.3CVE-2022-36075EPSS 0.6%2022-09-15

    Nextcloud files access control is a nextcloud app to manage access control for files. Users with limited access can see file names in certain cases where they do not have privilege to do so. This issue has been addressed and it is recommen…

26. 6.5CVE-2020-36603EPSS 0.6%2022-09-14

    The HoYoVerse (formerly miHoYo) Genshin Impact mhyprot2.sys 1.0.0.0 anti-cheat driver does not adequately restrict unprivileged function calls, allowing local, unprivileged users to execute arbitrary code with SYSTEM privileges on Microsof…

27. 6.5CVE-2022-22483EPSS 1.1%2022-09-13

    IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to an information disclosure in some scenarios due to unauthorized access caused by improper privilege management when CREATE OR REPLACE command is used. IBM…

28. 8.8CVE-2022-39203EPSS 0.9%2022-09-13

    matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. Attackers can specify a specific string of characters, which would confuse the bridge into combining an attacker-owned channel and an existing channel, allowing them to…

29. 6.3CVE-2022-39202EPSS 0.9%2022-09-13

    matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. The Internet Relay Chat (IRC) protocol allows you to specify multiple modes in a single mode command. Due to a bug in the underlying matrix-org/node-irc library, affect…

30. 5.3CVE-2022-36861EPSS 0.09%2022-09-09

    Custom permission misuse vulnerability in SystemUI prior to SMR Sep-2022 Release 1 allows attacker to use some protected functions with SystemUI privilege.

31. 7.8CVE-2022-40297EPSS 0.5%2022-09-09

    UBports Ubuntu Touch 16.04 allows the screen-unlock passcode to be used for a privileged shell via Sudo. This passcode is only four digits, far below typical length/complexity for a user account's password. NOTE: a third party states "The …

32. 5.5CVE-2022-36088EPSS 0.2%2022-09-07

    GoCD is a continuous delivery server. Windows installations via either the server or agent installers for GoCD prior to 22.2.0 do not adequately restrict permissions when installing outside of the default location. This could allow a malic…

33. 8.8CVE-2022-31166EPSS 1.5%2022-09-07

    XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Starting in versions 11.3.7, 11.0.3, and 12.0RC1, it is possible to exploit a bug in XWikiRights resolution of groups to obtain privilege escalation. Mo…

34. 7.8CVE-2022-30298EPSS 0.2%2022-09-06

    An improper privilege management vulnerability [CWE-269] in Fortinet FortiSOAR before 7.2.1 allows a GUI user who has already found a way to modify system files (via another, unrelated and hypothetical exploit) to execute arbitrary Python …

35. 6.5CVE-2021-43076EPSS 0.5%2022-09-06

    An improper privilege management vulnerability [CWE-269] in FortiADC versions 6.2.1 and below, 6.1.5 and below, 6.0.4 and below, 5.4.5 and below and 5.3.7 and below may allow a remote authenticated attacker with restricted user profile to …

36. 7.8CVE-2021-25657EPSS 0.3%2022-09-02

    A privilege escalation vulnerability was discovered in Avaya IP Office Admin Lite and USB Creator that may potentially allow a local user to escalate privileges. This issue affects Admin Lite and USB Creator 11.1 Feature Pack 2 Service Pac…

37. 8.8CVE-2021-3020EPSS 1.3%2022-08-26

    An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the binary hawk_invoke (built from tools/hawk_invoke.c), intended to be used as a setuid program. This allows the hacluster user to invoke certain …

38. 7.8CVE-2022-32840EPSS 0.6%2022-08-24

    This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5, watchOS 8.7, iOS 15.6 and iPadOS 15.6. An app may be able to execute arbitrary code with kernel privileges.

39. 7.5CVE-2021-0891EPSS 0.3%2022-08-24

    An unprivileged app can trigger PowerVR driver to return an uninitialized heap memory causing information disclosure.Product: AndroidVersions: Android SoCAndroid ID: A-236849490

40. 7.8CVE-2022-31676EPSS 0.5%2022-08-23

    VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine.

41. 8.8CVE-2022-36157EPSS 1.5%2022-08-19

    XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low Privilege account.

42. 5.3CVE-2022-1901EPSS 0.5%2022-08-19

    In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview.

43. 6.5CVE-2022-2568EPSS 1.0%2022-08-18

    A privilege escalation flaw was found in the Ansible Automation Platform. This flaw allows a remote authenticated user with 'change user' permissions to modify the account settings of the superuser account and also remove the superuser pri…

44. 7.8CVE-2022-37025EPSS 0.2%2022-08-18

    An improper privilege management vulnerability in McAfee Security Scan Plus (MSS+) before 4.1.262.1 could allow a local user to modify a configuration file and perform a LOLBin (Living off the land) attack. This could result in the user ga…

45. 7.8CVE-2020-10728EPSS 0.2%2022-08-16

    A flaw was found in automationbroker/apb container in versions up to and including 2.0.4-1. This container grants all users sudoer permissions allowing an unauthorized user with access to the running container the ability to escalate their…

46. 9.8CVE-2022-37002EPSS 0.5%2022-08-10

    The SystemUI module has a privilege escalation vulnerability. Successful exploitation of this vulnerability can cause malicious applications to pop up windows or run in the background.

47. 7.2CVE-2022-31672EPSS 0.7%2022-08-10

    VMware vRealize Operations contains a privilege escalation vulnerability. A malicious actor with administrative network access can escalate privileges to root.

48. 9.8CVE-2022-20361EPSS 1.2%2022-08-10

    In btif_dm_auth_cmpl_evt of btif_dm.cc, there is a possible vulnerability in Cross-Transport Key Derivation due to Weakness in Bluetooth Standard. This could lead to remote escalation of privilege with no additional execution privileges ne…

49. 7.8CVE-2022-20360EPSS 0.2%2022-08-10

    In setChecked of SecureNfcPreferenceController.java, there is a missing permission check. This could lead to local escalation of privilege from the guest user with no additional execution privileges needed. User interaction is not needed f…

50. 7.8CVE-2022-20356EPSS 0.1%2022-08-10

    In shouldAllowFgsWhileInUsePermissionLocked of ActiveServices.java, there is a possible way to start foreground service from background due to improper input validation. This could lead to local escalation of privilege with no additional e…