Filtered by CWE-269
Filtered by vendor Subscriptions
Total 2686 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-34487 1 Microsoft 10 Windows 10, Windows 10 1607, Windows 10 1809 and 7 more 2025-12-16 7 High
Windows Event Tracing Elevation of Privilege Vulnerability
CVE-2024-21888 1 Ivanti 2 Connect Secure, Policy Secure 2025-12-16 8.8 High
A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an administrator.
CVE-2025-59693 1 Entrust 11 Nshield 5c, Nshield 5c Firmware, Nshield Connect Xc and 8 more 2025-12-15 9.8 Critical
The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allows a physically proximate attacker to obtain debug access and escalate privileges by bypassing the tamper label and opening the chassis without leaving evidence, and accessing the JTAG connector. This is called F02.
CVE-2024-0353 1 Eset 11 Endpoint Antivirus, Endpoint Security, File Security and 8 more 2025-12-10 7.8 High
Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET’s file operations to delete files without having proper permission.
CVE-2024-38089 1 Microsoft 1 Defender For Iot 2025-12-10 9.1 Critical
Microsoft Defender for IoT Elevation of Privilege Vulnerability
CVE-2025-66324 1 Huawei 1 Harmonyos 2025-12-09 8.4 High
Input verification vulnerability in the compression and decompression module. Impact: Successful exploitation of this vulnerability may affect app data integrity.
CVE-2025-59705 1 Entrust 11 Nshield 5c, Nshield 5c Firmware, Nshield Connect Xc and 8 more 2025-12-08 6.8 Medium
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a Physically Proximate Attacker to Escalate Privileges by enabling the USB interface through chassis probe insertion during system boot, aka "Unauthorized Reactivation of the USB interface" or F01.
CVE-2025-59697 1 Entrust 11 Nshield 5c, Nshield 5c Firmware, Nshield Connect Xc and 8 more 2025-12-08 7.2 High
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker to escalate privileges by editing the Legacy GRUB bootloader configuration to start a root shell upon boot of the host OS. This is called F06.
CVE-2025-64336 2 Clip-bucket, Oxygenz 2 Clipbucket, Clipbucket 2025-12-05 5.4 Medium
ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage Photos feature is vulnerable to stored Cross-site Scripting (XSS). An authenticated regular user can upload a photo with a malicious Photo Title containing HTML/JavaScript code. While the payload does not execute in the user-facing photo gallery or detail pages, it is rendered unsafely in the Admin → Manage Photos section, resulting in JavaScript execution in the administrator’s browser. This issue is fixed in version 5.5.2-#147.
CVE-2018-1000141 1 Scilico 1 I\, Librarian 2025-12-05 9.1 Critical
I, Librarian version 4.9 and earlier contains an Incorrect Access Control vulnerability in ajaxdiscussion.php that can result in any users gaining unauthorized access (read, write and delete) to project discussions.
CVE-2024-27301 1 Root3 1 Support App 2025-12-05 7.3 High
Support App is an opensource application specialized in managing Apple devices. It's possible to abuse a vulnerability inside the postinstall installer script to make the installer execute arbitrary code as root. The cause of the vulnerability is the fact that the shebang `#!/bin/zsh` is being used. When the installer is executed it asks for the users password to be executed as root. However, it'll still be using the $HOME of the user and therefore loading the file `$HOME/.zshenv` when the `postinstall` script is executed. An attacker could add malicious code to `$HOME/.zshenv` and it will be executed when the app is installed. An attacker may leverage this vulnerability to escalate privilege on the system. This issue has been addressed in version 2.5.1 Rev 2. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2025-65621 1 Snipeitapp 1 Snipe-it 2025-12-04 5.4 Medium
Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enabling privilege escalation.
CVE-2025-59790 1 Apache 1 Kvrocks 2025-12-04 5.4 Medium
Improper Privilege Management vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from v2.9.0 through v2.13.0. Users are recommended to upgrade to version 2.14.0, which fixes the issue.
CVE-2025-13787 2 Easycorp, Zentao 2 Zentao, Zentao 2025-12-04 5.4 Medium
A flaw has been found in ZenTao up to 21.7.6-8564. The affected element is the function file::delete of the file module/file/control.php of the component File Handler. Executing manipulation of the argument fileID can lead to improper privilege management. It is possible to launch the attack remotely. Upgrading to version 21.7.7 is sufficient to fix this issue. You should upgrade the affected component.
CVE-2017-0358 2 Debian, Tuxera 2 Debian Linux, Ntfs-3g 2025-12-04 7.8 High
Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.
CVE-2025-33188 1 Nvidia 3 Dgx, Dgx Os, Dgx Spark 2025-12-02 8 High
NVIDIA DGX Spark GB10 contains a vulnerability in hardware resources where an attacker could tamper with hardware controls. A successful exploit of this vulnerability might lead to information disclosure, data tampering, or denial of service.
CVE-2025-24863 1 Intel 2 Cip Software, Computing Improvement Program 2025-11-26 6.5 Medium
Improper privilege management for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an information disclosure. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable data exposure. This result may potentially occur via network access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
CVE-2017-7782 2 Microsoft, Mozilla 3 Windows, Firefox, Thunderbird 2025-11-25 N/A
An error in the "WindowsDllDetourPatcher" where a RWX ("Read/Write/Execute") 4k block is allocated but never protected, violating DEP protections. Note: This attack only affects Windows operating systems. Other operating systems are not affected. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
CVE-2014-1511 6 Canonical, Debian, Mozilla and 3 more 17 Ubuntu Linux, Debian Linux, Firefox and 14 more 2025-11-25 9.8 Critical
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified vectors.
CVE-2014-1496 2 Mozilla, Suse 6 Firefox, Seamonkey, Thunderbird and 3 more 2025-11-25 5.5 Medium
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 might allow local users to gain privileges by modifying the extracted Mar contents during an update.