CVE-2019-0301: Improper Privilege Management

Under certain conditions, it is possible to request the modification of role or privilege assignments through SAP Identity Management REST Interface Version 2, which would otherwise be restricted only for viewing...

CVE-2019-11888: Improper Privilege Management

Go through 1.12.5 on Windows mishandles process creation with a nil environment in conjunction with a non-nil token, which allows attackers to obtain sensitive information or gain privileges...

CVE-2019-6617: Improper Privilege Management

On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, a user with the Resource Administrator role is able to overwrite sensitive low-level files such as /etc/passwd using SFTP to modify user permissions, without Advanced Shell access. This is contrary to o...

CVE-2019-11632: Improper Privilege Management

In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUnscoped or VariableEditUnscoped permission scoped to a specific project could view or edit unscoped variables from a different project. These permissions are only used in custom...

CVE-2019-4047: Improper Privilege Management

IBM Jazz Reporting Service JRS 6.0.6 could allow an authenticated user to access the execution log files as a guest user, and obtain the information of the server execution. IBM X-Force ID: 156243...

CVE-2019-4222: Improper Privilege Management

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 could allow an authenticated user to view process definition of a business process without permission. IBM X-Force ID: 159231...

CVE-2019-3789: Improper Privilege Management

Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platform. A user with space developer permissions can create a private domain that shadows the external domain of the route service, and map that...

CVE-2019-3786: Improper Privilege Management

Cloud Foundry BOSH Backup and Restore CLI, all versions prior to 1.5.0, does not check the authenticity of backup scripts in BOSH. A remote authenticated malicious user can modify the metadata file of a Bosh Backup and Restore job to request extra backup files from different jobs upon restore. Th...

CVE-2019-10239: Improper Privilege Management

Robotronic RunAsSpc 3.7.0.0 protects stored credentials insufficiently, which allows locally authenticated attackers under the same user context to obtain cleartext credentials of the stored account...

The vulnerability of the Outlook Web Access email server component of the Microsoft Exchange Server allows a attacker to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Outlook Web Access OWA component of the Microsoft Exchange Server email server is related to insecure management of privileges. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of protected information through a...

CVE-2019-11320

In Motorola CX2 1.01 and M2 1.01, users can access the router's /privmgt.html web page to launch telnetd, as demonstrated by the 192.168.51.1 address...

CVE-2019-6287: Improper Privilege Management

In Rancher 2.0.0 through 2.1.5, project members have continued access to create, update, read, and delete namespaces in a project after they have been removed from it...

CVE-2019-0735: Improper Privilege Management

An elevation of privilege vulnerability exists when the Windows Client Server Run-Time Subsystem CSRSS fails to properly handle objects in memory, aka 'Windows CSRSS Elevation of Privilege Vulnerability'...

CVE-2018-14894: Improper Privilege Management

CyberArk Endpoint Privilege Manager 10.2.1.603 and earlier allows an attacker who is able to edit permissions of a file to bypass intended access restrictions and execute blocked applications...

The vulnerability of the DefineResource method in the Ghostscript file conversion program allows a attacker to escalate their privileges.

The vulnerability of the DefineResource method in the Ghostscript file conversion program is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor, operating remotely, to increase their privileges...

CVE-2018-4310: Improper Privilege Management

An access issue was addressed with additional sandbox restrictions. This issue affected versions prior to iOS 12, macOS Mojave 10.14...

CVE-2018-19648: Improper Privilege Management

An issue was discovered in ADTRAN PMAA 1.6.2-1, 1.6.3, and 1.6.4. NETCONF Access Management NACM allows unprivileged users to create privileged users and execute arbitrary commands via the use of the diagnostic-profile over RESTCONF...

The vulnerability of the Microsoft XML Core Services MSXML on the Windows operating system allows a hacker to execute malicious code and gain control over the system.

The vulnerability of the Microsoft XML Core Services MSXML in the Windows operating system is related to insecure management of privileges. Exploiting this vulnerability allows a malicious actor to execute malicious code remotely and gain control over the system...

The vulnerability of the Internet Explorer browser, related to insecure management of privileges, allows attackers to partially compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Internet Explorer browser is related to insecure management of privileges. Exploiting this vulnerability allows a malicious actor to partially compromise the confidentiality, integrity, and accessibility of protected information through a specially created URL address...

The vulnerability of browsers Internet Explorer and Microsoft Edge, related to insecure management of privileges, allows attackers to disclose protected information.

The vulnerability of Internet Explorer and Microsoft Edge relates to the insecure management of privileges. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose sensitive information through a specially created web page...