CVE-2023-6119

CVE-2023-6119 describes an Improper Privilege Management in Trellix GetSusp prior to 5.0.0.27. A local, low-privilege attacker can access files that normally require higher privileges because GetSusp does not correctly protect a directory it creates, allowing takeover of file handles. The flaw ex...

CVE-2023-6099

A vulnerability classified as critical has been found in Shenzhen Youkate Industrial Facial Love Cloud Payment System up to 1.0.55.0.0.1. This affects an unknown part of the file /SystemMng.ashx of the component Account Handler. The manipulation of the argument operatorRole with the input 00 lead...

CVE-2023-35140

The improper privilege management vulnerability in the Zyxel GS1900-24EP switch firmware version V2.70ABTO.5 could allow an authenticated local user with read-only access to modify system settings on a vulnerable device...

Improper Privilege Management

Github.com/grafana/grafana is vulnerable to Improper Privilege Management. The vulnerability impacts Grafana instances with several organizations, which allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organizatio...

CVE-2023-41715

SonicOS post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunnel allows users to elevate their privileges inside the tunnel...

CVE-2023-20598

An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOCTL request to gain I/O control over arbitrary hardware ports or physical addresses resulting in a potential arbitrary code execution...

Adobe Commerce 授权问题漏洞

Adobe Commerce is the United States of America Odobie Adobe company's a kind of merchants and brands for the world's leading digital commerce solutions. An authorization issue vulnerability previously existed in Adobe Commerce version 2.4.7, which stemmed from improper privilege management in the...

GitHub: GHES Management console EoP (editor to site admin)

Improper privilege management in GitHub Enterprise Server allowed editor role users to escalate privileges by making requests to the bootstrapping endpoint...

CVE-2023-5402

A CWE-269: Improper Privilege Management vulnerability exists that could cause a remote code execution when the transfer command is used over the network...

CVE-2023-5402

A CWE-269: Improper Privilege Management vulnerability exists that could cause a remote code execution when the transfer command is used over the network...

CVE-2023-5402

A CWE-269: Improper Privilege Management vulnerability exists that could cause a remote code execution when the transfer command is used over the network...

CVE-2023-5402

Schneider Electric SpaceLogic C-Bus Toolkit is affected by CVE-2023-5402 (CWE-269: Improper Privilege Management). The vulnerability exists in the TransferCommand flow over the network and could enable remote code execution. Reported in multiple sources, the issue is exploitable remotely with low...

Improper Privilege Management

prestashop/prestashop is vulnerable to Improper Privilege Management. The vulnerability is caused by a missing authorization/access rights check in the ajaxProcessGetPossibleHookingListForModule method while returning the possible hooks for a module. This can lead to an attacker listing all modul...

ZZZCMS Authorization Issues Vulnerabilities

ZZZCMS zzzphp is a content management system CMS. An authorization issue vulnerability exists in ZZZCMS version 2.1.7, which stems from improper privilege management...

Razer Synapse Race Condition / DLL Hijacking

Advisory ID: SYSS-2023-002 Product: Razer Synapse Manufacturer: Razer Inc. Affected Versions: Versions before 3.8.0428.042117 20230601 Tested Versions: 3.8.0228.022313 20230315 under Windows 10 Pro 10.0.19044 under Windows 11 Home 10.0.22621 Vulnerability Type: Improper Privilege Management CWE-2...

CVE-2022-47631

Razer Synapse through 3.7.1209.121307 allows privilege escalation due to an unsafe installation path and improper privilege management. Attackers can place DLLs into %PROGRAMDATA%\Razer\Synapse3\Service\bin if they do so before the service is installed and if they deny write access for the SYSTEM...

CVE-2022-47631

CVE-2022-47631 affects Razer Synapse up to version 3.7.1209.121307 (and earlier). The issue is a time‑of‑check/time‑of‑use race involving an unsafe installation path and improper privilege management that allows local users to escalate to administrator by replacing a legitimate DLL in %PROGRAMDAT...

CVE-2022-47631

Razer Synapse through 3.7.1209.121307 allows privilege escalation due to an unsafe installation path and improper privilege management. Attackers can place DLLs into %PROGRAMDATA%\Razer\Synapse3\Service\bin if they do so before the service is installed and if they deny write access for the SYSTEM...

Apache Airflow 安全漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow versions prior to 2.7.1 have an authorization issue vulnerability th...

CVE-2023-30713

The CVE-2023-30713 entry describes an improper privilege management vulnerability in Samsung One UI Home’s FolderLockNotifier. Affected component: FolderLockNotifier (One UI Home) prior to SMR Sep-2023 Release 1. Root cause: insufficient privilege controls allow local attackers to modify some fol...