Vulnerabilities > Improper Privilege Management

DATE CVE VULNERABILITY TITLE RISK
2023-12-21 CVE-2023-46647 Improper Privilege Management vulnerability in Github Enterprise Server
Improper privilege management in all versions of GitHub Enterprise Server allows users with authorized access to the management console with an editor role to escalate their privileges by making requests to the endpoint used for bootstrapping the instance. This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.12, 3.9.6, 3.10.3, and 3.11.0.
network
low complexity
github CWE-269
8.8
2023-12-21 CVE-2023-6804 Improper Privilege Management vulnerability in Github Enterprise Server
Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped PAT.
local
low complexity
github CWE-269
5.5
2023-12-19 CVE-2023-47267 Improper Privilege Management vulnerability in Thegreenbow products
An issue discovered in TheGreenBow Windows Enterprise Certified VPN Client 6.52, Windows Standard VPN Client 6.87, and Windows Enterprise VPN Client 6.87 allows attackers to gain escalated privileges via crafted changes to memory mapped file.
network
low complexity
thegreenbow CWE-269
critical
9.8
2023-12-13 CVE-2023-6793 Improper Privilege Management vulnerability in Paloaltonetworks Pan-Os
An improper privilege management vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to revoke active XML API keys from the firewall and disrupt XML API usage.
network
low complexity
paloaltonetworks CWE-269
2.7
2023-12-12 CVE-2023-41119 Improper Privilege Management vulnerability in Enterprisedb Postgres Advanced Server
An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0.
network
low complexity
enterprisedb CWE-269
8.8
2023-12-05 CVE-2023-45083 Improper Privilege Management vulnerability in Softiron Hypercloud
An Improper Privilege Management vulnerability exists in HyperCloud that will impact the ability for a user to authenticate against the management plane. An authenticated admin-level user may be able to delete the "admin" or "serveradmin" users, which prevents authentication from subsequently succeeding. This issue affects HyperCloud versions 1.0 to any release before 2.1.
local
low complexity
softiron CWE-269
4.4
2023-12-01 CVE-2023-45253 Improper Privilege Management vulnerability in Huddly Huddlycameraservices
An issue was discovered in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, allows attackers to manipulate files and escalate privileges via RollingFileAppender.DeleteFile method performed by the log4net library.
local
low complexity
huddly CWE-269
7.8
2023-11-29 CVE-2023-6218 Improper Privilege Management vulnerability in Progress Moveit Transfer
In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path associated with group administrators has been identified.  It is possible for a group administrator to elevate a group members permissions to the role of an organization administrator.
network
low complexity
progress CWE-269
7.2
2023-11-28 CVE-2023-29066 Improper Privilege Management vulnerability in BD Facschorus
The FACSChorus software does not properly assign data access privileges for operating system user accounts.
low complexity
bd CWE-269
3.5
2023-11-28 CVE-2023-5797 Improper Privilege Management vulnerability in Zyxel products
An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, VPN series firmware versions 4.30 through 5.37, NWA50AX firmware version 6.29(ABYW.2), WAC500 firmware version 6.65(ABVS.1), WAX300H firmware version 6.60(ACHF.1), and WBE660S firmware version 6.65(ACGG.1), could allow an authenticated local attacker to access the administrator’s logs on an affected device.
local
low complexity
zyxel CWE-269
5.5