Filtered by CWE-250
Filtered by vendor Subscriptions
Total 340 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-4662 1 Adobe 1 Connect 2025-09-24 9.8 Critical
Execution with Unnecessary Privileges vulnerability in Saphira Saphira Connect allows Remote Code Inclusion.This issue affects Saphira Connect: before 9.
CVE-2025-55077 3 Microsoft, Tyler Technologies, Tylertech 3 Windows, Erp Pro 9 Saas, Erp Pro 9 2025-09-23 7.4 High
Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote Microsoft Windows environment with the privileges of the authenticated user. Tyler Technologies deployed hardened remote Windows environment settings to all ERP Pro 9 SaaS customer environments as of 2025-08-01.
CVE-2025-58432 2 Icewhaletech, Zimaspace 2 Zimaos, Zimaos 2025-09-22 7.8 High
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and all prior versions, the /v2_1/files/file/uploadV2 endpoint allows file upload from ANY USER who has access to localhost. File uploads are performed AS ROOT.
CVE-2025-58431 2 Icewhaletech, Zimaspace 2 Zimaos, Zimaos 2025-09-22 6.2 Medium
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and earlier, the /v2_1/files/file/download endpoint allows file read from ANY USER who has access to localhost. File reads are performed AS ROOT.
CVE-2025-57119 1 Phpgurukul 1 Online Library Management System 2025-09-18 9.8 Critical
An issue in Online Library Management System v.3.0 allows an attacker to escalate privileges via the adminlogin.php component and the Login function
CVE-2025-37128 2 Arubanetworks, Hp 2 Edgeconnect Enterprise, Arubaos 2025-09-17 6.8 Medium
A vulnerability in the web API of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to terminate arbitrary running processes. Successful exploitation could allow an attacker to disrupt system operations, potentially resulting in an unstable system state.
CVE-2025-49581 1 Xwiki 2 Xwiki, Xwiki-platform 2025-09-03 8.8 High
XWiki is a generic wiki platform. Any user with edit right on a page (could be the user's profile) can execute code (Groovy, Python, Velocity) with programming right by defining a wiki macro. This allows full access to the whole XWiki installation. The main problem is that if a wiki macro parameter allows wiki syntax, its default value is executed with the rights of the author of the document where it is used. This can be exploited by overriding a macro like the children macro that is used in a page that has programming right like the page XWiki.ChildrenMacro and thus allows arbitrary script macros. This vulnerability has been patched in XWiki 16.4.7, 16.10.3 and 17.0.0 by executing wiki parameters with the rights of the wiki macro's author when the parameter's value is the default value.
CVE-2025-0078 1 Google 1 Android 2025-09-02 8.8 High
In main of main.cpp, there is a possible way to bypass SELinux due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-0080 1 Google 1 Android 2025-09-02 7.8 High
In multiple locations, there is a possible way to overlay the installation confirmation dialog due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-0079 1 Google 1 Android 2025-09-02 7.8 High
In multiple locations, there is a possible way that avdtp and avctp channels could be unencrypted due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
CVE-2022-38694 2025-09-02 7.8 High
In BootRom, there is a possible unchecked write address. This could lead to local escalation of privilege with no additional execution privileges needed.
CVE-2022-38695 2025-09-02 7.8 High
In BootRom, there's a possible unchecked command index. This could lead to local escalation of privilege with no additional execution privileges needed.
CVE-2022-38691 1 Unisoc 4 Sc9863a, T310, T610 and 1 more 2025-09-02 7.8 High
In BootROM, there is a possible missing validation for Certificate Type 0. This could lead to local escalation of privilege with no additional execution privileges needed.
CVE-2025-50753 1 Mitrastar 1 Gpt-2741gnac-n2 2025-08-29 8.4 High
Mitrastar GPT-2741GNAC-N2 devices are provided with access through ssh into a restricted default shell.The command "deviceinfo show file" is supposed to be used from restricted shell to show files and directories. By providing " /bin/sh" (quotes included) to the argument of this command will drop a root shell.
CVE-2024-2240 2 Broadcom, Brocade 2 Brocade Sannav, Sannav 2025-08-26 7.2 High
Docker daemon in Brocade SANnav before SANnav 2.3.1b runs without auditing. The vulnerability could allow a remote authenticated attacker to execute various attacks.
CVE-2025-33108 1 Ibm 1 I 2025-08-24 8.5 High
IBM Backup, Recovery and Media Services for i 7.4 and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges due to a library unqualified call made by a BRMS program. A malicious actor could cause user-controlled code to run with component access to the host operating system.
CVE-2025-36048 7 Apple, Ibm, Linux and 4 more 7 Macos, Webmethods Integration, Linux Kernel and 4 more 2025-08-24 7.2 High
IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 could allow a privileged user to escalate their privileges when handling external entities due to execution with unnecessary privileges.
CVE-2025-21110 1 Dell 1 Data Lakehouse 2025-08-18 6.7 Medium
Dell Data Lakehouse, versions prior to 1.5.0.0, contains an Execution with Unnecessary Privileges vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.
CVE-2025-40767 1 Siemens 1 Sinec Traffic Analyzer 2025-08-15 7.8 High
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application runs docker containers without adequate security controls to enforce isolation. This could allow an attacker to gain elevated access, potentially accessing sensitive host system resources.
CVE-2025-8907 2025-08-13 7 High
A vulnerability was found in H3C M2 NAS V100R006. Affected by this vulnerability is an unknown functionality of the component Webserver Configuration. The manipulation leads to execution with unnecessary privileges. An attack has to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor explains: "[T]he device only has configuration files and does not actually have boa functionality. It is impossible to access or upload files anonymously to the device through boa services". This vulnerability only affects products that are no longer supported by the maintainer.