CVE-2025-67793: Improper Privilege Management

An issue was discovered in DriveLock 24.1 through 24.1., 24.2 through 24.2., and 25.1 before 25.1.6. Users with the "Manage roles and permissions" privilege can promote themselves or other DOC users to the Supervisor role through an API call. This privilege is included by default in the...

CVE-2025-67792: Improper Privilege Management

An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Local unprivileged users can manipulate a DriveLock process to execute arbitrary commands on Windows computers...

CVE-2025-13292: Improper Privilege Management

A vulnerability in Apigee-X allowed an attacker to gain unauthorized read and write access to Apigee Analytics AX data and access logs belonging to other Apigee customer organizations. Apigee-X was found to be vulnerable. This vulnerability was patched in version 1-16-0-apigee-3. No user action i...

Dell PowerScale OneFS 8.2.2 <= 9.7.0.3 / 9.8.0.0 < 9.8.0.1 Improper Privilege Management (DSA-2024-255)

The Dell PowerScale OneFS on the remote device is missing a security patch and is, therefore, affected by improper privilege management vulnerability. - Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local high privileged attacker...

CVE-2025-13787: Improper Privilege Management

A flaw has been found in ZenTao up to 21.7.6-8564. The affected element is the function file::delete of the file module/file/control.php of the component File Handler. Executing manipulation of the argument fileID can lead to improper privilege management. It is possible to launch the attack...

CVE-2025-59790

Apache Kvrocks (v2.9.0 through v2.13.0) contains an improper privilege management vulnerability within the RESET command . An attacker can exploit this flaw to gain administrator privileges on the system. To mitigate this risk, users are recommended to upgrade to version 2.14.0 , which contains t...

CVE-2025-59790: Improper Privilege Management

Improper Privilege Management vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from v2.9.0 through v2.13.0. Users are recommended to upgrade to version 2.14.0, which fixes the issue...

PT-2025-48339

Name of the Vulnerable Software and Affected Versions Apache Kvrocks versions 2.9.0 through 2.13.0 Description An improper privilege management issue exists in Apache Kvrocks. Upgrade to version 2.14.0 to resolve the issue. Recommendations Upgrade to version 2.14.0...

CVE-2025-66314: Improper Privilege Management

Improper Privilege Management vulnerability in ZTE ElasticNet UME R32 on Linux allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ElasticNet UME R32: ElasticNetUMER32V16.23.20.04...

PT-2025-48215

Improper Privilege Management vulnerability in ZTE ElasticNet UME R32 on Linux allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ElasticNet UME R32: ElasticNet UME R32 V16.23.20.04...

CVE-2025-66265: Improper Privilege Management

CMService.exe creates the C:\usr directory and subdirectories with insecure permissions, granting write access to all authenticated users. This allows attackers to replace configuration files such as snmp.conf or hijack DLLs to escalate privileges...

CVE-2025-33188: Improper Privilege Management

NVIDIA DGX Spark GB10 contains a vulnerability in hardware resources where an attacker could tamper with hardware controls. A successful exploit of this vulnerability might lead to information disclosure, data tampering, or denial of service...

CVE-2025-54821

CVE-2025-54821 affects Fortinet FortiOS (versions 6.4 and 7.0–7.6.3), FortiPAM (1.0–1.6.0), and FortiProxy (7.0–7.6.3). The root cause is improper privilege management (CWE-269) that may allow an authenticated administrator to bypass the trusted-host policy via crafted CLI commands. Public source...

CVE-2025-40548: Improper Privilege Management

A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under...

CVE-2025-54821: Improper Privilege Management

An Improper Privilege Management vulnerability CWE-269 vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.11, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM...

Intel CIP Elevation of Privilege Vulnerability

Intel CIP is an optional program from Intel designed to improve products by collecting performance data from users' computers. Intel CIP suffers from an elevation of privilege vulnerability that stems from improper privilege management and can be exploited by an attacker to cause elevation of...

CVE-2025-20346: Improper Privilege Management

A vulnerability in Cisco Catalyst Center could allow an authenticated, remote attacker to execute operations that should require Administrator privileges. The attacker would need valid read-only user credentials. This vulnerability is due to improper role-based access control RBAC. An attacker...

Siemens SIMATIC S7-1500 Improper Check for Dropped Privileges (CVE-2019-18276)

An issue was discovered in disableprivmode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems th...

CVE-2025-24838

Improper privilege management for some IntelR CIP software before version WINDCA2.4.0.11001 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege...

CVE-2025-24863: Improper Privilege Management

Improper privilege management for some IntelR CIP software before version WINDCA2.4.0.11001 within Ring 3: User Applications may allow an information disclosure. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable data exposure. This result...