Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

CVEs (3,307)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2008-2271 1Site Documentation Project 1Site Documentation Apr 23, 2026 May 16, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The Site Documentation Drupal module 5.x before 5.x-1.8 and 6.x before 6.x-1.1 allows remote authenticated users to gain privileges of other users by leveraging the "access content" permission to list tables and obtain s...Show more The Site Documentation Drupal module 5.x before 5.x-1.8 and 6.x before 6.x-1.1 allows remote authenticated users to gain privileges of other users by leveraging the "access content" permission to list tables and obtain session IDs from the database.Show less
CVE-2007-2444 3Canonical DebianSamba 3Debian Linux SambaUbuntu Linux Apr 23, 2026 May 14, 2007 N/A· v4 N/A· v3 7.2 HIGH· v2 Logic error in the SID/Name translation functionality in smbd in Samba 3.0.23d through 3.0.25pre2 allows local users to gain temporary privileges and execute SMB/CIFS protocol operations via unspecified vectors that caus...Show more Logic error in the SID/Name translation functionality in smbd in Samba 3.0.23d through 3.0.25pre2 allows local users to gain temporary privileges and execute SMB/CIFS protocol operations via unspecified vectors that cause the daemon to transition to the root user.Show less
CVE-2004-1349 2Gnu Oracle 2Gzip Solaris Apr 16, 2026 Oct 4, 2004 N/A· v4 N/A· v3 2.1 LOW· v2 gzip before 1.3 in Solaris 8, when called with the -f or -force flags, will change the permissions of files that are hard linked to the target files, which allows local users to view or modify these files.
CVE-2002-0367 1Microsoft 2Windows 2000 Windows Nt Apr 16, 2026 Jun 25, 2002 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges by duplicating a han...Show more smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process, as demonstrated by DebPloit.Show less
CVE-2002-0080 2Redhat Samba 2Linux Rsync Apr 16, 2026 Mar 15, 2002 N/A· v4 N/A· v3 2.1 LOW· v2 rsync, when running in daemon mode, does not properly call setgroups before dropping privileges, which could provide supplemental group privileges to local users, who could then read certain files that would otherwise be...Show more rsync, when running in daemon mode, does not properly call setgroups before dropping privileges, which could provide supplemental group privileges to local users, who could then read certain files that would otherwise be disallowed.Show less
CVE-2002-0049 1Microsoft 1Exchange Server Apr 16, 2026 Mar 8, 2002 N/A· v4 N/A· v3 6.4 MEDIUM· v2 Microsoft Exchange Server 2000 System Attendant gives "Everyone" group privileges to the WinReg key, which could allow remote attackers to read or modify registry keys.
CVE-1999-0084 1Sun 1Nfs Apr 16, 2026 May 1, 1990 N/A· v4 8.4 HIGH· v3 7.2 HIGH· v2 Certain NFS servers allow users to use mknod to gain privileges by creating a writable kmem device and setting the UID to 0.

Previous 1...162 163 164 165166