CVE-2023-43664: Improper Privilege Management

PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list all modules without any access rights: method ajaxProcessGetPossibleHookingListForModule doesn't check access rights. This issue has been addressed in commit 15bd281c which is...

PT-2023-28191

Name of the Vulnerable Software and Affected Versions Simple Membership versions through 4.3.4 Description The issue is related to Improper Privilege Management, allowing Privilege Escalation in Simple Membership. Recommendations For versions through 4.3.4, update to a version later than 4.3.4 to...

CVE-2023-41309: Improper Privilege Management

Permission control vulnerability in the MediaPlaybackController module. Successful exploitation of this vulnerability may affect availability...

CVE-2023-41324: Improper Privilege Management

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. An API user that have read access on users resource can steal accounts of other users. Users are advised t...

CVE-2023-41326: Improper Privilege Management

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A logged user from any profile can hijack the Kanban feature to alter any user field, and end-up with...

CVE-2023-41312: Improper Privilege Management

Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause several apps to be activated automatically...

Razer Synapse Race Condition / DLL Hijacking

Advisory ID: SYSS-2023-002 Product: Razer Synapse Manufacturer: Razer Inc. Affected Versions: Versions before 3.8.0428.042117 20230601 Tested Versions: 3.8.0228.022313 20230315 under Windows 10 Pro 10.0.19044 under Windows 11 Home 10.0.22621 Vulnerability Type: Improper Privilege Management CWE-2...

CVE-2022-47631

Razer Synapse through 3.7.1209.121307 allows privilege escalation due to an unsafe installation path and improper privilege management. Attackers can place DLLs into %PROGRAMDATA%\Razer\Synapse3\Service\bin if they do so before the service is installed and if they deny write access for the SYSTEM...

CVE-2022-47631

CVE-2022-47631 affects Razer Synapse up to version 3.7.1209.121307 (and earlier). The issue is a time‑of‑check/time‑of‑use race involving an unsafe installation path and improper privilege management that allows local users to escalate to administrator by replacing a legitimate DLL in %PROGRAMDAT...

CVE-2022-47631

Razer Synapse through 3.7.1209.121307 allows privilege escalation due to an unsafe installation path and improper privilege management. Attackers can place DLLs into %PROGRAMDATA%\Razer\Synapse3\Service\bin if they do so before the service is installed and if they deny write access for the SYSTEM...

CVE-2023-42468: Improper Privilege Management

The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of improper export of the com.cutestudio.dialer.activities.DialerActivity component. A third-party application without any permissions can craft an...

Apache Airflow 安全漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow versions prior to 2.7.1 have an authorization issue vulnerability th...

CVE-2023-20194: Privilege Chaining

A vulnerability in the ERS API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device. To exploit this vulnerability, an attacker must have valid Administrator-level privileges on the affected device. This...

CVE-2023-30713

The CVE-2023-30713 entry describes an improper privilege management vulnerability in Samsung One UI Home’s FolderLockNotifier. Affected component: FolderLockNotifier (One UI Home) prior to SMR Sep-2023 Release 1. Root cause: insufficient privilege controls allow local attackers to modify some fol...

CVE-2023-30713: Improper Privilege Management

Improper privilege management vulnerability in FolderLockNotifier in One UI Home prior to SMR Sep-2023 Release 1 allows local attackers to change some settings of the folder lock...

CVE-2023-41053: Improper Privilege Management

Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by SORTRO and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been...

usememos/memos vulnerable to privilege escalation

Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2...

CVE-2023-4697

CVE-2023-4697 affects the open-source project memos (GitHub: usememos/memos) prior to version 0.13.2. The root cause is improper privilege management within the application, leading to likely privilege escalation. The CVSS base metrics indicate HIGH impact to confidentiality, integrity, and avail...

CVE-2023-4697: Improper Privilege Management

Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2...

CVE-2023-32457

Dell PowerScale OneFS, versions 8.2.2.x-9.5.0.x, contains an improper privilege management vulnerability. A remote attacker with low privileges could potentially exploit this vulnerability, leading to escalation of privileges...