CWE-269

Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the run_as functionality. This bug

In Open Ticket Request System (OTRS) 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an attacker with

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to

Inteno routers have a JUCI ACL misconfiguration that allows the "user" account to read files, write to files, and add ro

Incorrect Access Control vulnerability in Hashtopussy 0.4.0 allows remote authenticated users to execute actions that sh

The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 th

An error was found in the permission model used by X-Pack Alerting 5.0.0 to 5.6.0 whereby users mapped to certain built-

OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design ga

ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job.

Perspective ICM Investigation & Case 5.1.1.16 allows remote authenticated users to modify access level permissions and c

In version 3.5 and prior of Cambium Networks ePMP firmware, the non-administrative users 'installer' and 'home' have the

A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker wit

The application OpenEMR version 5.0.0, 5.0.1-dev and prior is affected by vertical privilege escalation vulnerability. T

TeamPass before 2.1.27.9 does not properly enforce item access control when requesting items.queries.php. It is then pos

An issue was discovered in Veritas NetBackup before 8.0 and NetBackup Appliance before 3.0. Local arbitrary command exec

Firejail before 0.9.44.4, when running a bandwidth command, allows local users to gain root privileges via the --shell a

A vulnerability in a script file that is installed as part of the Cisco Policy Suite (CPS) Software distribution for the

Nagios Core through 4.3.4 initially executes /usr/sbin/nagios as root but supports configuration options in which this f

In all Qualcomm products with Android releases from CAF using the Linux kernel, user-level permissions can be used to ga

An Improper Privilege Management issue was discovered in SpiderControl SCADA Web Server Version 2.02.0007 and prior. Aut

The Amazon Web Services (AWS) CloudFormation bootstrap tools package (aka aws-cfn-bootstrap) before 1.4-19.10 allows loc

An Improper Access Control issue was discovered in Trihedral VTScada 11.3.03 and prior. A local, non-administrator user

Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Hospitality Applications (subcompone

An Improper Privilege Management issue was discovered in Cambium Networks ePMP. The privileges for SNMP community string

In Avast Antivirus before v17, an unprivileged user (and thus malware or a virus) can mark an arbitrary process as Trust

Incorrect policy enforcement in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions

Inedo BuildMaster before 5.8.2 does not properly restrict creation of RequireManageAllPrivileges event listeners.

Vulnerability in the Java Advanced Management Console component of Oracle Java SE (subcomponent: Server). The supported

The Gentoo sci-mathematics/gimps package before 28.10-r1 for Great Internet Mersenne Prime Search (GIMPS) allows local u

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v260; UAA release 2.x versions prior to

A vulnerability in Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attack

sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which

A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary co

An Improper Access Control issue was discovered in Cambium Networks ePMP. After a valid user has used SNMP configuration

A vulnerability in the installation procedure for Cisco Prime Network Software could allow an authenticated, local attac

Extreme EXOS 16.x, 21.x, and 22.x allows administrators to obtain a root shell via vectors involving an exsh debug shell

Extreme EXOS 16.x, 21.x, and 22.x allows administrators to obtain a root shell via vectors involving a privileged proces

In EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1.1, 8.0.0.0 - 8.0.0.4, 7.2.1.0 - 7.2.1.5, 7.2.0.x, and 7.1.1.x, a malicious

An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices. The attacker can change the bootmode of th

In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x versions prior to v3.6

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB). Supported versions that are

An issue was discovered in Linux Foundation xapi in Citrix XenServer through 7.0. An authenticated read-only administrat

All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where improper access

Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 before CP 1746 mismanages certain key and certificate d

PostgreSQL PL/Java before 1.5.0 allows remote authenticated users with USAGE permission on the public schema to alter th

PostgreSQL PL/Java before 1.5.0 allows remote authenticated users to alter type mappings for types they do not own.

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to 250 and CAPI-release versions prior to

In Moodle 3.x, course creators are able to change system default settings for courses.

A Permissions, Privileges, and Access Controls issue was discovered in ABB VSN300 WiFi Logger Card versions 1.8.15 and p

Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: