2963 matches found
CVE-2021-22801
A CWE-269: Improper Privilege Management vulnerability exists that could cause an arbitrary command execution when the software is configured with specially crafted event actions. Affected Product: ConneXium Network Manager Software All Versions...
Improper Privilege Management in snipe/snipe-it
Description It was found that if a user is not having access to supplier module, he can access and view the supplier content. Proof of Concept 1. Create two users, one admin and one normal user 2. A normal user is not having access to the supplier module. 3. But by enumeration the normal user vie...
CVE-2021-22801: Improper Privilege Management
A CWE-269: Improper Privilege Management vulnerability exists that could cause an arbitrary command execution when the software is configured with specially crafted event actions. Affected Product: ConneXium Network Manager Software All Versions...
CVE-2022-24927: Improper Privilege Management
Improper privilege management vulnerability in Samsung Video Player prior to version 7.3.15.30 allows attackers to execute video files without permission...
Improper Privilege Management in snipe/snipe-it
Description Unprivilege user can create maintainance for asset Proof of Concept 1. Create regular user and set DENY to all permissions in asset models.\ 2. Login as the user and sent bellow request to create maintainance for asset await fetch"https://demo.snipeitapp.com/hardware/maintenances",...
CVE-2022-20680: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to improper enforcement of Administrator privilege levels for low-value sensitive dat...
GHSA-F8VC-WFC8-HXQH Improper Privilege Management in Apache Hadoop
In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification...
CVE-2021-3813
Improper Privilege Management in GitHub repository chatwoot/chatwoot prior to v2.2...
CVE-2021-3813: Improper Privilege Management
Improper Privilege Management in GitHub repository chatwoot/chatwoot prior to v2.2...
CVE-2021-37852: Improper Privilege Management
ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the context of NT AUTHORITY\SYSTEM...
Siemens SIMATIC S7-1200 Improper Privilege Management (CVE-2016-2846)
Siemens SIMATIC S7-1200 CPU devices before 4.0 allow remote attackers to bypass a user program block protection mechanism via unspecified vectors. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 70300 C Tenable...
CVE-2022-22509: Improper Privilege Management
In Phoenix Contact FL SWITCH Series 2xxx in version 3.00 an incorrect privilege assignment allows an low privileged user to enable full access to the device configuration...
Improper Privilege Management in liangliangyy/djangoblog
Description Hi there, I would like to report an improper privilege management vulnerability in djangoblog source code. This would allow an attacker to create comment on behalf of anyone. Proof of Concept 1. Install a local instance of djangoblog, login as admin and create an article 2. Create a n...
PYSEC-2022-14
Improper Privilege Management in Conda loguru prior to 0.5.3...
Improper Privilege Management in liukuo362573/yishaadmin
Description Hi there, there is another improper privilege management in /admin/OrganizationManage/Position/GetFormJson Proof of Concept 1. Access the link http://106.14.124.170:80/admin/OrganizationManage/Position/GetFormJson?id=16508640061130139 2. See that the page return with position data...
Improper Privilege Management in liukuo362573/yishaadmin
Description Hi there yishaadmin maintainer team, I would like to report an improper privilege management in yishaadmin source code. The link /admin/ToolManage/Server/GetServerJson requires no authentication and accessible for everyone, which returns server info like RAM, CPU usage. Proof of Conce...
Improper Privilege Management in heroiclabs/nakama
Description A predefined View Only user has access to the User Management function at the :7351//users endpoint. By default this is a predefined system administrator function, and no other users should be able to access this function. Proof of Concept - Create a View-only user with the...
The vulnerability of the systemd service initialization and management subsystem, related to improper privilege assignment, allows a malicious actor to gain access to confidential data, compromise its integrity, and cause service failures.
The vulnerability of the systemd service initialization and management subsystem is related to the improper assignment of privileges. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...
CVE-2022-0090: Improper Privilege Management
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab is configured in a way that it doesn't ignore replacement references with git sub-commands, allowing a malicious user to spoof the contents of their commits in...
CVE-2021-42562: Improper Privilege Management
An issue was discovered in CALDERA 2.8.1. It does not properly segregate user privileges, resulting in non-admin users having access to read and modify configuration or other components that should only be accessible by admin users...