CWE-269— Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.— MITRE CWE catalog

4,720 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-269page 5 of 95

CVE-2017-20002HIGHCVSS 7.8EG 7.8
2021-03-17
The Debian shadow package before 1:4.5-1 for Shadow incorrectly lists pts/0 and pts/1 as physical terminals in /etc/securetty. This allows local users to login as password-less users even if they are connected by non-physical means such as…
CVE-2017-20021CRITICALCVSS 6.5EG 9.8
2022-06-09
A vulnerability, which was classified as critical, was found in Solare Solar-Log 2.8.4-56/3.5.2-85. This affects an unknown part of the component File Upload. The manipulation leads to privilege escalation. It is possible to initiate the a…
CVE-2017-20023CRITICALCVSS 6.3EG 9.8
2022-06-09
A vulnerability was found in Solare Solar-Log 2.8.4-56/3.5.2-85 and classified as critical. This issue affects some unknown processing of the component Network Config. The manipulation leads to privilege escalation. The attack may be initi…
CVE-2017-20025CRITICALCVSS 7.3EG 9.8
2022-06-09
A vulnerability was found in Solare Solar-Log 2.8.4-56/3.5.2-85. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Flash Memory. The manipulation leads to privilege escalation. Th…
CVE-2017-20028CRITICALCVSS 5.6EG 9.8
2022-06-09
A vulnerability was found in HumHub 0.20.1/1.0.0-beta.3. It has been classified as critical. This affects an unknown part. The manipulation leads to privilege escalation. It is possible to initiate the attack remotely. Upgrading to version…
CVE-2017-20037HIGHCVSS 6.3EG 8.8
2022-06-11
A vulnerability has been found in SICUNET Access Controller 0.32-05z and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument c leads to privilege escalation. The attack can b…
CVE-2017-20038HIGHCVSS 6.3EG 8.8
2022-06-11
A vulnerability was found in SICUNET Access Controller 0.32-05z and classified as critical. Affected by this issue is some unknown functionality of the file card_scan_decoder.php. The manipulation of the argument No/door leads to privilege…
CVE-2017-20049CRITICALCVSS 9.8EG 9.8
2022-06-15
A vulnerability, was found in legacy Axis devices such as P3225 and M3005. This affects an unknown part of the component CGI Script. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely.
CVE-2017-20063MEDIUMCVSS 6.3EG 6.3
2022-06-20
A vulnerability was found in Elefant CMS 1.3.12-RC. It has been classified as critical. Affected is an unknown function of the file /filemanager/upload/drop of the component File Upload. The manipulation leads to improper privilege managem…
CVE-2017-20068HIGHCVSS 6.3EG 8.8
2022-06-21
A vulnerability was found in Hindu Matrimonial Script. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/usermanagement.php. The manipulation leads to improper privilege management. The …
CVE-2017-20069HIGHCVSS 6.3EG 8.8
2022-06-21
A vulnerability classified as critical has been found in Hindu Matrimonial Script. This affects an unknown part of the file /admin/countrymanagement.php. The manipulation leads to improper privilege management. It is possible to initiate t…
CVE-2017-20070HIGHCVSS 6.3EG 8.8
2022-06-21
A vulnerability classified as critical was found in Hindu Matrimonial Script. This vulnerability affects unknown code of the file /admin/communitymanagement.php. The manipulation leads to improper privilege management. The attack can be in…
CVE-2017-20071HIGHCVSS 6.3EG 8.8
2022-06-21
A vulnerability, which was classified as critical, has been found in Hindu Matrimonial Script. This issue affects some unknown processing of the file /admin/renewaldue.php. The manipulation leads to improper privilege management. The attac…
CVE-2017-20072HIGHCVSS 6.3EG 8.8
2022-06-21
A vulnerability, which was classified as critical, was found in Hindu Matrimonial Script. Affected is an unknown function of the file /admin/generalsettings.php. The manipulation leads to improper privilege management. It is possible to la…
CVE-2017-20073HIGHCVSS 6.3EG 8.8
2022-06-21
A vulnerability has been found in Hindu Matrimonial Script and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/cms.php. The manipulation leads to improper privilege management. The atta…
CVE-2017-20074HIGHCVSS 6.3EG 8.8
2022-06-21
A vulnerability was found in Hindu Matrimonial Script and classified as critical. Affected by this issue is some unknown functionality of the file /admin/newsletter1.php. The manipulation leads to improper privilege management. The attack …
CVE-2017-20075HIGHCVSS 6.3EG 8.8
2022-06-21
A vulnerability was found in Hindu Matrimonial Script. It has been classified as critical. This affects an unknown part of the file /admin/payment.php. The manipulation leads to improper privilege management. It is possible to initiate the…
CVE-2017-20076HIGHCVSS 6.3EG 8.8
2022-06-21
A vulnerability was found in Hindu Matrimonial Script. It has been declared as critical. This vulnerability affects unknown code of the file /admin/searchview.php. The manipulation leads to improper privilege management. The attack can be …
CVE-2017-20077HIGHCVSS 6.3EG 8.8
2022-06-21
A vulnerability was found in Hindu Matrimonial Script. It has been rated as critical. This issue affects some unknown processing of the file /admin/success_story.php. The manipulation leads to improper privilege management. The attack may …
CVE-2017-20078HIGHCVSS 6.3EG 8.8
2022-06-21
A vulnerability classified as critical has been found in Hindu Matrimonial Script. Affected is an unknown function of the file /admin/featured.php. The manipulation leads to improper privilege management. It is possible to launch the attac…
CVE-2017-20079HIGHCVSS 6.3EG 8.8
2022-06-21
A vulnerability classified as critical was found in Hindu Matrimonial Script. Affected by this vulnerability is an unknown functionality of the file /admin/photo.php. The manipulation leads to improper privilege management. The attack can …
CVE-2017-20080HIGHCVSS 6.3EG 8.8
2022-06-21
A vulnerability, which was classified as critical, has been found in Hindu Matrimonial Script. Affected by this issue is some unknown functionality of the file /admin/googleads.php. The manipulation leads to improper privilege management. …
CVE-2017-20081HIGHCVSS 6.3EG 8.8
2022-06-21
A vulnerability, which was classified as critical, was found in Hindu Matrimonial Script. This affects an unknown part of the file /admin/reports.php. The manipulation leads to improper privilege management. It is possible to initiate the …
CVE-2017-20107HIGHCVSS 5.3EG 7.8
2022-06-28
A vulnerability, which was classified as problematic, was found in ShadeYouVPN.com Client 2.0.1.11. Affected is an unknown function. The manipulation leads to improper privilege management. Local access is required to approach this attack.…
CVE-2017-20111CRITICALCVSS 7.3EG 9.8
2022-06-29
A vulnerability, which was classified as critical, was found in Teleopti WFM 7.1.0. This affects an unknown part of the component Administration. The manipulation leads to improper privilege management. It is possible to initiate the attac…
CVE-2017-20112HIGHCVSS 7.8EG 7.8
2022-06-29
A vulnerability has been found in IVPN Client 2.6.6120.33863 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument --up cmd leads to improper privilege management. The atta…
CVE-2017-20121HIGHCVSS 7.8EG 7.8
2022-06-30
A vulnerability was found in Teradici Management Console 2.2.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Database Management. The manipulation leads to improper privilege…
CVE-2017-2094MEDIUMCVSS 4.3EG 4.3
2017-04-28
Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Workflow and the "MultiReport" function to alter or delete information via unspecified vectors.
CVE-2017-2662MEDIUMCVSS 4.3EG 4.3
2018-08-22
A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter (filter set on the Product Name), the filter is not respected when the actions are done via hamme…
CVE-2017-2672HIGHCVSS 6.5EG 8.8
2018-06-21
A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with access to the foreman log file would be able to view passwords for provisioned systems in the log file, allowing them to acce…
CVE-2017-3257MEDIUMCVSS 6.5EG 6.5
2017-01-27
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB). Supported versions that are affected are 5.6.34 and earlier5.7.16 and earlier. Easily exploitable vulnerability allows low privileged attacker with…
CVE-2017-4973HIGHCVSS 8.8EG 8.8
2017-06-13
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions prior to v3.9.10, and other versions prior to v3.15.0; and U…
CVE-2017-4982CRITICALCVSS 9.8EG 9.8
2017-05-08
EMC Mainframe Enablers ResourcePak Base versions 7.6.0, 8.0.0, and 8.1.0 contains a fix for a privilege management vulnerability that could potentially be exploited by malicious users to compromise the affected system.
CVE-2017-4991HIGHCVSS 7.2EG 7.2
2017-06-13
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v260; UAA release 2.x versions prior to v2.7.4.16, 3.6.x versions prior to v3.6.10, 3.9.x versions prior to v3.9.12, and other versions prior to v3.17.0; and …
CVE-2017-4992CRITICALCVSS 9.8EG 9.8
2017-06-13
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v261; UAA release 2.x versions prior to v2.7.4.17, 3.6.x versions prior to v3.6.11, 3.9.x versions prior to v3.9.13, and other versions prior to v4.2.0; and U…
CVE-2017-5084LOWCVSS 3.3EG 3.3
2017-10-27
Inappropriate implementation in image-burner in Google Chrome OS prior to 59.0.3071.92 allowed a local attacker to read local files via dbus-send commands to a BurnImage D-Bus endpoint.
CVE-2017-5142CRITICALCVSS 9.1EG 9.1
2017-02-13
An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. A user with low privileges is able to open and change the parameters by accessing a specific URL bec…
CVE-2017-5207HIGHCVSS 7.8EG 7.8
2017-03-23
Firejail before 0.9.44.4, when running a bandwidth command, allows local users to gain root privileges via the --shell argument.
CVE-2017-5254HIGHCVSS 8.8EG 8.9
2017-12-20
In version 3.5 and prior of Cambium Networks ePMP firmware, the non-administrative users 'installer' and 'home' have the capability of changing passwords for other accounts, including admin, after disabling a client-side protection mechani…
CVE-2017-5409MEDIUMCVSS 5.5EG 5.5
2018-06-11
The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a special path to the callback parameter through the Mozilla Maintenance Service, which has privileged access. Note: This attac…
CVE-2017-5572MEDIUMCVSS 6.5EG 6.5
2017-01-30
An issue was discovered in Linux Foundation xapi in Citrix XenServer through 7.0. An authenticated read-only administrator can corrupt the host database.
CVE-2017-5623MEDIUMCVSS 6.6EG 6.6
2017-03-19
An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices. The attacker can change the bootmode of the device by issuing the 'fastboot oem boot_mode {rf/wlan/ftm/normal} command' in contradiction to the threat model of A…
CVE-2017-5624CRITICALCVSS 9.8EG 9.8
2017-03-12
An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T. The attacker can persistently make the (locked) bootloader start the platform with dm-verity disabled, by issuing the 'fastboot oem disable_dm_verity' command. Having d…
CVE-2017-5671HIGHCVSS 8.8EG 8.8
2017-03-29
Honeywell Intermec PM23, PM42, PM43, PC23, PC43, PD43, and PC42 industrial printers before 10.11.013310 and 10.12.x before 10.12.013309 have /usr/bin/lua installed setuid to the itadmin account, which allows local users to conduct a BusyBo…
CVE-2017-5689CRITICALCVSS 9.8EG 9.8⚠ KEV
2017-05-02
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageab…
CVE-2017-5703MEDIUMCVSS 6.0EG 6.0
2018-04-03
Configuration of SPI Flash in platforms based on multiple Intel platforms allow a local attacker to alter the behavior of the SPI flash potentially leading to a Denial of Service.
CVE-2017-5722HIGHCVSS 7.5EG 7.5
2017-10-11
Incorrect policy enforcement in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows attackers with local or physical access to bypass enforcement of integrity protections via man…
CVE-2017-5736HIGHCVSS 8.8EG 8.8
2018-03-20
An elevation of privilege in Intel Software Guard Extensions Platform Software Component before 1.9.105.42329 allows a local attacker to execute arbitrary code as administrator.
CVE-2017-5940HIGHCVSS 8.8EG 8.8
2017-02-09
Firejail before 0.9.44.6 and 0.9.38.x LTS before 0.9.38.10 LTS does not comprehensively address dotfile cases during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attac…
CVE-2017-6152MEDIUMCVSS 6.7EG 6.7
2018-03-08
A local user on F5 BIG-IQ Centralized Management 5.1.0-5.2.0 with the Access Manager role has privileges to change the passwords of other users on the system, including the local admin account password.

Map vulnerabilities like CWE-269 to your infrastructure

EchelonGraph correlates every CVE — across CWE-269 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →