CWE-266 Incorrect Privilege Assignment
baseA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (3802)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-48172US | critical9.8OT kritisch | KEV | ||
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of gre… | ||||
| CVE-2023-50224US | —OT kritisch | KEV | ||
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information o… | ||||
| CVE-2023-42916US | medium6.5OT kritisch | KEV | ||
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content… | ||||
| CVE-2012-3152US | critical9.1OT kritisch | KEV | ||
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality a… | ||||
| CVE-2010-4452US | high10.0 | Exploit | ||
Unspecified vulnerability in the Deployment component in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier allows remote untrusted Java… | ||||
| CVE-2010-3563US | high10.0 | Exploit | ||
Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availabi… | ||||
| CVE-2023-3460US | critical9.8 | Exploit | ||
The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create admini… | ||||
| CVE-2024-28000US | critical9.8 | Exploit | ||
Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 6.3.0.1. | ||||
| CVE-2013-2460US | high9.3 | Exploit | ||
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentialit… | ||||
| CVE-2012-0500US | high10.0 | Exploit | ||
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and JavaFX 2.0.2 and earlier allows rem… | ||||
| CVE-2005-0771US | high10.0 | Exploit | ||
VERITAS Backup Exec Server (beserver.exe) 9.0 through 10.0 for Windows allows remote unauthenticated attackers to modify the registry by calling methods to the RPC interface on TCP… | ||||
| CVE-2021-33393US | high8.8OT hoch | Exploit | ||
lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. It might be owned by an unprivileged account, which could pote… | ||||
| CVE-2002-0721US | high10.0 | Exploit | ||
Microsoft SQL Server 7.0 and 2000 installs with weak permissions for extended stored procedures that are associated with helper functions, which could allow unprivileged users, and… | ||||
| CVE-2015-7007US | high7.5 | Exploit | ||
Script Editor in Apple OS X before 10.11.1 allows remote attackers to bypass an intended user-confirmation requirement for AppleScript execution via unspecified vectors. | ||||
| CVE-2018-2791US | high8.2 | Exploit | ||
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supported versions that are affected are 11.1.1.8.0, 12.2.1.2.0 and 1… | ||||
| CVE-2025-41115US | critical9.8 | Exploit | ||
SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifec… | ||||
| CVE-2013-10048US | critical9.8 | Exploit | ||
An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600 (firmware ≤ 2.13 and ≤ 2.14b01, respectively)—due to improper inpu… | ||||
| CVE-2000-0245US | high10.0 | Exploit | ||
Vulnerability in SGI IRIX objectserver daemon allows remote attackers to create user accounts. | ||||
| CVE-2000-0515US | high10.0OT hoch | Exploit | ||
The snmpd.conf configuration file for the SNMP daemon (snmpd) in HP-UX 11.0 is world writable, which allows local users to modify SNMP configuration or gain privileges. | ||||
| CVE-2017-14473US | critical9.8 | — | ||
An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before.… | ||||
04
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan