CWE:

	Topic	Date	Author
Low	Gantt-Chart For Jira 5.5.3 Missing Privilege Check	04.08.2020	Sebastian Auwaerter
Med.	Cellebrite UFED 7.5.0.845 Desktop Escape / Privilege Escalation	17.05.2020	Matthew Bergin
Med.	Ultimate Member 2.39 Unauthorized profile modification	18.06.2019	Clément Cruchet
Med.	WordPress Plugin WooCommerce GloBee (cryptocurrency) Payment Gateway 1.1.1 Payment Bypass / Unauthorized Order Status Spoofing	27.02.2019	GeekHack
Med.	Goozmo™ Systems v.1.0 Improper Privilege Management	29.01.2019	KingSkrupellos
Med.	TP-Link EAP Controller CSRF / Hard-Coded Key / XSS	04.05.2018	Core
Med.	SpiderControl SCADA Web Server 2.02.0007 Improper Privilege Management	01.11.2017	Karn Ganeshen
Med.	Solarwinds LEM 6.3.1 Sudo Script Abuse Privilege Escalation	25.04.2017	Hank Leininger and Mat...
Med.	Trendmicro InterScan 6.5-SP2_Build_Linux_1548 Privilege Escalation	18.02.2017	Matt Bergin
Med.	phpMyAdmin 3.5.x/4.0.x privilege escalation	30.07.2013	SecuriTeam Secure Disc...
High	Smartfren Connex EC 1261-2 UI OUC Local Privilege Escalation Vulnerability	27.09.2012	X-Cisadane

---

CVEMAP Search Results

CVE

Details

Description

2023-03-27

	CVE-2020-36666	Updating...	The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through TODO, photographer-directory WordPress plugin before 1.0.9, real-estate-pro WordPress plugin before 1.7.1, institutions-directory WordPress plugin before 1.3.1, lawyer-directory WordPress plugin before 1.2.9, doctor-listing WordPress plugin before 1.3.6, Hotel Listing WordPress plugin before 1.3.7, fitness-trainer WordPress plugin before 1.4.1, wp-membership WordPress plugin before 1.5.7, sold by the same developer (e-plugins), do not implementing any security measures in some AJAX calls. For example in the file plugin.php, the function iv_directories_update_profile_setting() uses update_user_meta with any data provided by the ajax call, which can be used to give the logged in user admin capabilities. Since the plugins allow user registration via a custom form (even if the blog does not allow users to register) it makes any site using it vulnerable.
	CVE-2023-28640	Updating...	Apiman is a flexible and open source API Management platform. Due to a missing permissions check, an attacker with an authenticated Apiman Manager account may be able to gain access to API keys they do not have permission for if they correctly guess the URL, which includes Organisation ID, Client ID, and Client Version of the targeted non-permitted resource. While not trivial to exploit, it could be achieved by brute-forcing or guessing common names. Access to the non-permitted API Keys could allow use of other users' resources without their permission (depending on the specifics of configuration, such as whether an API key is the only form of security). Apiman 3.1.0.Final resolved this issue. Users are advised to upgrade. The only known workaround is to restrict account access.

2023-03-23

CVE-2023-28436

Updating...

Tailscale is software for using Wireguard and multi-factor authentication (MFA). A vulnerability identified in the implementation of Tailscale SSH starting in version 1.34.0 and prior to prior to 1.38.2 in FreeBSD allows commands to be run with a higher privilege group ID than that specified in Tailscale SSH access rules. A difference in the behavior of the FreeBSD `setgroups` system call from POSIX meant that the Tailscale client running on a FreeBSD-based operating system did not appropriately restrict groups on the host when using Tailscale SSH. When accessing a FreeBSD host over Tailscale SSH, the egid of the tailscaled process was used instead of that of the user specified in Tailscale SSH access rules. Tailscale SSH commands may have been run with a higher privilege group ID than that specified in Tailscale SSH access rules if they met all of the following criteria: the destination node was a FreeBSD device with Tailscale SSH enabled; Tailscale SSH access rules permitted access for non-root users; and a non-interactive SSH session was used. Affected users should upgrade to version 1.38.2 to remediate the issue.

2023-03-22

CVE-2023-28434

Updating...

Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.

2023-03-14

CVE-2023-27589

Updating...

Minio is a Multi-Cloud Object Storage framework. Starting with RELEASE.2020-12-23T02-24-12Z and prior to RELEASE.2023-03-13T19-46-17Z, a user with `consoleAdmin` permissions can potentially create a user that matches the root credential `accessKey`. Once this user is created successfully, the root credential ceases to work appropriately. The issue is patched in RELEASE.2023-03-13T19-46-17Z. There are ways to work around this via adding higher privileges to the disabled root user via `mc admin policy set`.

2023-02-15

CVE-2022-42735

Updating...

Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu. ShenYu Admin allows low-privilege low-level administrators create users with higher privileges than their own. This issue affects Apache ShenYu: 2.5.0. Upgrade to Apache ShenYu 2.5.1 or apply patch https://github.com/apache/shenyu/pull/3958 https://github.com/apache/shenyu/pull/3958 .

2023-02-07

CVE-2022-43759

Updating...

A Improper Privilege Management vulnerability in SUSE Rancher, allows users with access to the escalate verb on PRTBs to escalate permissions for any -promoted resource in any cluster. This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10.

2023-01-26

CVE-2023-23610

Updating...

GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having access to the standard interface can export data of almost any GLPI item type, even those on which user is not allowed to access (including assets, tickets, users, ...). This issue is patched in 10.0.6.

2023-01-23

CVE-2022-4305

Updating...

The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.

2022-12-28

CVE-2022-4808

Updating...

Improper Privilege Management in GitHub repository usememos/memos prior to 0.9.1.

 

---

Copyright 2023, cxsecurity.com