Improper Handling of Insufficient Permissions or Privileges

The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.

CVEs (154)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-22292 1Google 1Android Jun 17, 2026 Feb 11, 2022 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 Unprotected dynamic receiver in Telecom prior to SMR Feb-2022 Release 1 allows untrusted applications to launch arbitrary activity.
CVE-2022-21814 1Nvidia 6Geforce Gpu Display DriverNvs+3 more Jun 17, 2026 Feb 7, 2022 N/A· v4 6.1 MEDIUM· v3 3.6 LOW· v2 NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver package, where improper handling of insufficient permissions or privileges may allow an unprivileged local user limited write access to pr...Show more NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver package, where improper handling of insufficient permissions or privileges may allow an unprivileged local user limited write access to protected memory, which can lead to denial of service.Show less
CVE-2021-37175 1Siemens 10Ruggedcom Rox Mx5000 Firmware Ruggedcom Rox Rx1400 FirmwareRuggedcom Rox Rx1500 Firmware+7 more Jun 17, 2026 Sep 14, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All versions < V2.14.1), RUGGEDCOM ROX RX1501 (All versions < V2....Show more A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All versions < V2.14.1), RUGGEDCOM ROX RX1501 (All versions < V2.14.1), RUGGEDCOM ROX RX1510 (All versions < V2.14.1), RUGGEDCOM ROX RX1511 (All versions < V2.14.1), RUGGEDCOM ROX RX1512 (All versions < V2.14.1), RUGGEDCOM ROX RX1524 (All versions < V2.14.1), RUGGEDCOM ROX RX1536 (All versions < V2.14.1), RUGGEDCOM ROX RX5000 (All versions < V2.14.1). The affected devices do not properly handle permissions to traverse the file system. If exploited, an attacker could gain access to an overview of the complete file system on the affected devices.Show less
CVE-2021-38312 1Redux 1Gutenberg Template Library & Redux Framework Jun 17, 2026 Sep 2, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered under the “redux/v1/templates/” REST Route in “redux-templates/cl...Show more The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered under the “redux/v1/templates/” REST Route in “redux-templates/classes/class-api.php”. The `permissions_callback` used in this file only checked for the `edit_posts` capability which is granted to lower-privileged users such as contributors, allowing such users to install arbitrary plugins from the WordPress repository and edit arbitrary posts.Show less
CVE-2020-10072 1Zephyrproject 1Zephyr Jun 17, 2026 May 25, 2021 N/A· v4 5.3 MEDIUM· v3 4.6 MEDIUM· v2 Improper Handling of Insufficient Permissions or Privileges in zephyr. Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Insufficient Permissions or Privileges (CWE-280). For more information, see https:...Show more Improper Handling of Insufficient Permissions or Privileges in zephyr. Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Insufficient Permissions or Privileges (CWE-280). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-vf79-hqwm-w4xcShow less
CVE-2020-29031 1Secomea 4Gatemanager 4250 Firmware Gatemanager 4260 FirmwareGatemanager 8250 Firmware+1 more Jun 17, 2026 Feb 15, 2021 N/A· v4 8.1 HIGH· v3 5.5 MEDIUM· v2 An Insecure Direct Object Reference vulnerability exists in the web UI of the GateManager which allows an authenticated attacker to reset the password of any user in its domain or any sub-domain, via escalation of privil...Show more An Insecure Direct Object Reference vulnerability exists in the web UI of the GateManager which allows an authenticated attacker to reset the password of any user in its domain or any sub-domain, via escalation of privileges. This issue affects all GateManager versions prior to 9.2cShow less
CVE-2020-26195 1Dell 1Emc Powerscale Onefs Jun 17, 2026 Feb 9, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Dell EMC PowerScale OneFS versions 8.1.2 – 9.1.0 contain an issue where the OneFS SMB directory auto-create may erroneously create a directory for a user. A remote unauthenticated attacker may take advantage of this issu...Show more Dell EMC PowerScale OneFS versions 8.1.2 – 9.1.0 contain an issue where the OneFS SMB directory auto-create may erroneously create a directory for a user. A remote unauthenticated attacker may take advantage of this issue to slow down the system.Show less
CVE-2020-3427 1Cisco 1Duo Authentication For Windows Logon And Rdp Jun 17, 2026 Oct 14, 2020 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 The Windows Logon installer prior to 4.1.2 did not properly validate file installation paths. This allows an attacker with local user privileges to coerce the installer to write to arbitrary privileged directories. If su...Show more The Windows Logon installer prior to 4.1.2 did not properly validate file installation paths. This allows an attacker with local user privileges to coerce the installer to write to arbitrary privileged directories. If successful, an attacker can manipulate files used by Windows Logon, cause Denial of Service (DoS) by deleting file(s), or replace system files to potentially achieve elevation of privileges. Note that this can only exploitable during new installations while the installer is running and is not exploitable once installation is finished. Versions 4.1.2 of Windows Logon addresses this issue.Show less
CVE-2020-8219 2Ivanti Pulsesecure 4Connect Secure Policy SecurePulse Connect Secure+1 more Jun 17, 2026 Jul 30, 2020 N/A· v4 7.2 HIGH· v3 4.0 MEDIUM· v2 An insufficient permission check vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to change the password of a full administrator.
CVE-2020-8117 1Nextcloud 1Nextcloud Server Jun 17, 2026 Feb 4, 2020 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Improper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be leaked when sharing a non-public event.
CVE-2019-17437 1Paloaltonetworks 1Pan Os Jun 17, 2026 Dec 5, 2019 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 An improper authentication check in Palo Alto Networks PAN-OS may allow an authenticated low privileged non-superuser custom role user to elevate privileges and become superuser. This issue affects PAN-OS 7.1 versions pr...Show more An improper authentication check in Palo Alto Networks PAN-OS may allow an authenticated low privileged non-superuser custom role user to elevate privileges and become superuser. This issue affects PAN-OS 7.1 versions prior to 7.1.25; 8.0 versions prior to 8.0.20; 8.1 versions prior to 8.1.11; 9.0 versions prior to 9.0.5. PAN-OS version 7.0 and prior EOL versions have not been evaluated for this issue.Show less
CVE-2019-13415 1Search Guard 1Search Guard Jun 17, 2026 Aug 13, 2019 N/A· v4 6.5 MEDIUM· v3 3.5 LOW· v2 Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users can gain read access to data they are not authorized to see.
CVE-2019-6570 1Siemens 1Sinema Remote Connect Server Jun 17, 2026 Apr 17, 2019 N/A· v4 8.8 HIGH· v3 9.0 HIGH· v2 A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Due to insufficient checking of user permissions, an attacker may access URLs that require special authorization. An attacker mus...Show more A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Due to insufficient checking of user permissions, an attacker may access URLs that require special authorization. An attacker must have access to a low privileged account in order to exploit the vulnerability.Show less
CVE-2012-4550 1Redhat 1Jboss Enterprise Application Platform May 14, 2026 Jan 5, 2013 N/A· v4 5.3 MEDIUM· v3 6.4 MEDIUM· v2 A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans (EJB) access, the system does not correctly call the necessary authorization modules. This preven...Show more A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans (EJB) access, the system does not correctly call the necessary authorization modules. This prevents Java Authorization Contract for Containers (JACC) permissions from being applied, allowing remote attackers to gain unauthorized access to EJBs.Show less

Previous 1...4 5 6 78