cve.bz

CWE-280: Improper Handling of Insufficient Permissions or Privileges, page 3

Filter

The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.

What the weakness is: CWE-280 at MITRE

Ask an AI about CWE-280

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-280: Improper Handling of Insufficient Permissions or Privileges and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/280.html and https://cve.bz/cve/cwe/280?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 1.8CVE-2024-4692EPSS 0.3%

    Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels. Multiple missing permission checks - Service Virt…

  2. 1.8CVE-2024-4211EPSS 0.3%

    Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels. Multiple missing permission checks - ALM job conf…

  3. 4.3CVE-2024-47767EPSS 0.4%

    Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.113, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-5, users might see tracker names th…

  4. 4.9CVE-2024-47766EPSS 0.5%

    Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-5, administrators of a project can …

  5. 5.7CVE-2024-46988EPSS 0.4%

    Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.40, Tuleap Enterprise Edition 15.13-3, and Tuleap Enterprise Edition 15.12-6, users might receive email notific…

  6. 9.8CVE-2024-24116ExploitEPSS 28%

    An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the system/config_menu.htm.

  7. 7.5CVE-2024-8451EPSS 0.6%

    Certain switch models from PLANET Technology have an SSH service that improperly handles insufficiently authenticated connection requests, allowing unauthorized remote attackers to exploit this weakness to occupy connection slots and preve…

  8. 8.8CVE-2024-6660EPSS 0.6%

    The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the book…

  9. 8.8CVE-2024-36451EPSS 0.6%

    Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2.003. If this vulnerability is exploited, a console session may be hijacked by an unauthorized user. As a result, data …

  10. 4.3CVE-2024-39691EPSS 0.5%

    matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The fix for GHSA-wm4w-7h2q-3pf7 / CVE-2024-32000 included in matrix-appservice-irc 2.0.0 relied on the Matrix homeserver-provided timestamp to determine wheth…

  11. 5.5CVE-2024-6302EPSS 0.3%

    Lack of privilege checking when processing a redaction in Conduit versions v0.6.0 and lower, allowing a local user to redact any message from users on the same server, given that they are able to send redaction events.

  12. 9.8CVE-2024-5163EPSS 0.5%

    Improper permission settings for mobile applications (com.transsion.carlcare) may lead to user password and account security risks.

  13. 5.4CVE-2024-4468EPSS 0.4%

    The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions hooked into admin_init in all versions up to, and including, 9.9. This makes…

  14. 5.5CVE-2024-35228EPSS 0.3%

    Wagtail is an open source content management system built on Django. Due to an improperly applied permission check in the `wagtail.contrib.settings` module, a user with access to the Wagtail admin and knowledge of the URL of the edit view …

  15. 6.5CVE-2024-36112EPSS 0.4%

    Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records (`extras.view_dynamicgroup` permission) can use the Dynamic Group detail UI view (`/extras/dynamic-groups/<uuid>/`…

  16. 2.7CVE-2024-29852EPSS 0.5%

    Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs.

  17. 5.5CVE-2024-35301EPSS 0.3%

    In JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope of the GitHub App token

  18. 3.3CVE-2024-27837EPSS 0.2%

    A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.5. A local attacker may gain access to Keychain items.

  19. 7.8CVE-2024-23704EPSS 0.09%

    In onCreate of WifiDialogActivity.java, there is a possible way to bypass the DISALLOW_ADD_WIFI_CONFIG restriction due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges …

  20. 2.7CVE-2024-32882EPSS 0.5%

    Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing through the `wagtail.contrib.settings` module or `ModelViewSet`, and the `permission` argument on `Fie…

  21. 8.8CVE-2023-38298EPSS 0.5%

    Various software builds for the following TCL devices (30Z, A3X, 20XE, 10L) leak the device IMEI to a system property that can be accessed by any local app on the device without any permissions or special privileges. Google restricted thir…

  22. 7.8CVE-2024-32488EPSS 0.2%

    In Foxit PDF Reader and Editor before 2024.1, Local Privilege Escalation could occur during update checks because weak permissions on the update-service folder allow attackers to place crafted DLL files there.

  23. 4.3CVE-2024-32000EPSS 0.5%

    matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. matrix-appservice-irc before version 2.0.0 can be exploited to leak the truncated body of a message if a malicious user sends a Matrix reply to an event ID th…

  24. 7.5CVE-2023-52537EPSS 0.4%

    Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this vulnerability will affect availability.

  25. 7.5CVE-2024-30418EPSS 0.4%

    Vulnerability of insufficient permission verification in the app management module. Impact: Successful exploitation of this vulnerability will affect availability.

  26. 7.8CVE-2024-29748KEVEPSS 0.7%

    there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

  27. 7.8CVE-2023-42931EPSS 1.2%

    The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.2, macOS Monterey 12.7.2. A process may gain admin privileges without proper authentication.

  28. 7.8CVE-2023-41972EPSS 0.2%

    In some rare cases, there is a password type validation missing in Revert Password check and for some features it could be disabled. Fixed Version: Win ZApp 4.3.0.121 and later.

  29. 8.8CVE-2024-22078EPSS 0.6%

    An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Privilege escalation can occur via world writable files. The network configuration script has weak filesystem permissions. This results in write acce…

  30. 5.3CVE-2024-22077EPSS 0.5%

    An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. The SQLite database file has weak permissions.

  31. 7.5CVE-2024-25844EPSS 0.5%

    An issue was discovered in Common-Services "So Flexibilite" (soflexibilite) module for PrestaShop before version 4.1.26, allows remote attackers to escalate privileges and obtain sensitive information via debug file.

  32. 4.3CVE-2024-0560EPSS 0.5%

    A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the auth_type is use_3scale_oidc_issuer_endpoint, the Token Introspection policy discovers the Token Introspection endpoint from the token…

  33. 7.5CVE-2024-1608EPSS 0.5%

    In OPPO Usercenter Credit SDK, there's a possible escalation of privilege due to loose permission check, This could lead to application internal information leak w/o user interaction.

  34. 7.8CVE-2024-0015EPSS 0.4%

    In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. This could lead to local escalation of privilege with User execution privileges needed. User intera…

  35. 5.3CVE-2023-39249EPSS 0.3%

    Dell SupportAssist for Business PCs version 3.4.0 contains a local Authentication Bypass vulnerability that allows locally authenticated non-admin users to gain temporary privilege within the SupportAssist User Interface on their respectiv…

  36. 8.8CVE-2024-25108EPSS 0.7%

    Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to access far more functionality than users intended, including to the administrative a…

  37. 7.8CVE-2023-25543EPSS 0.2%

    Dell Power Manager, versions prior to 3.14, contain an Improper Authorization vulnerability in DPM service. A low privileged malicious user could potentially exploit this vulnerability in order to elevate privileges on the system.

  38. 5.3CVE-2023-6189EPSS 0.5%

    Missing access permissions checks in the M-Files server before 23.11.13156.0 allow attackers to perform data write and export jobs using the M-Files API methods.

  39. 7.8CVE-2023-43591EPSS 0.2%

    Improper privilege management in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local access.

  40. 6.5CVE-2023-43087EPSS 0.4%

    Dell PowerScale OneFS 8.2.x, 9.0.0.x-9.5.0.x contains an improper handling of insufficient permissions. A low privileged remote attacker could potentially exploit this vulnerability to cause information disclosure.

  41. 6.7CVE-2023-32489EPSS 0.2%

    Dell PowerScale OneFS 8.2x -9.5x contains a privilege escalation vulnerability. A local attacker with high privileges could potentially exploit this vulnerability, to bypass mode protections and gain elevated privileges.

  42. 7.8CVE-2023-2480EPSS 0.2%

    Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applications

  43. 4.3CVE-2023-2020EPSS 0.4%

    Insufficient permission checks in the REST API in Tribe29 Checkmk <= 2.1.0p27 and <= 2.2.0b4 (beta) allow unauthorized users to schedule downtimes for any host.

  44. 7.1CVE-2023-0181EPSS 0.2%

    NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a kernel mode layer handler, where memory permissions are not correctly checked, which may lead to denial of service and data tampering.

  45. 4.1CVE-2023-28114EPSS 0.2%

    `cilium-cli` is the command line interface to install, manage, and troubleshoot Kubernetes clusters running Cilium. Prior to version 0.13.2,`cilium-cli`, when used to configure cluster mesh functionality, can remove the enforcement of user…

  46. 7.5CVE-2023-27087EPSS 0.6%

    Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageList parameter.

  47. 7.8CVE-2023-21421EPSS 0.2%

    Improper Handling of Insufficient Permissions or Privileges vulnerability in KnoxCustomManagerService prior to SMR Jan-2023 Release 1 allows attacker to access device SIM PIN.

  48. 6.5CVE-2023-22737EPSS 0.7%

    wire-server provides back end services for Wire, a team communication and collaboration platform. Prior to version 2022-12-09, every member of a Conversation can remove a Bot from a Conversation due to a missing permissions check. Only Con…

  49. 6.5CVE-2022-4863EPSS 0.7%

    Improper Handling of Insufficient Permissions or Privileges in GitHub repository usememos/memos prior to 0.9.1.

  50. 3.3CVE-2022-39912EPSS 0.1%

    Improper handling of insufficient permissions vulnerability in setSecureFolderPolicy in PersonaManagerService prior to Android T(13) allows local attackers to set some setting value in Secure folder.