CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Related To CWE-269

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-17184 269 +Priv 2019-10-04 2019-10-10
7.5
None Remote Low Not required Partial Partial Partial
Xerox AtlaLink B8045/B8055/B8065/B8075/B8090 C8030/C8035/C8045/C8055/C8070 printers with software before 101.00x.089.22600 allow an attacker to gain privileges.
2 CVE-2019-16913 269 2019-10-07 2019-10-11
7.2
None Local Low Not required Complete Complete Complete
PC Protect Antivirus v4.14.31 installs by default to %PROGRAMFILES(X86)%\PCProtect with very weak folder permissions, granting any user full permission "Everyone: (F)" to the contents of the directory and its subfolders. In addition, the program installs a service called SecurityService that runs as LocalSystem. This allows any user to escalate privileges to "NT AUTHORITY\SYSTEM" by substituting the service's binary with a Trojan horse.
3 CVE-2019-16729 269 2019-09-24 2019-09-24
7.2
None Local Low Not required Complete Complete Complete
pam-python before 1.0.7-1 has an issue in regard to the default environment variable handling of Python, which could allow for local root escalation in certain PAM setups.
4 CVE-2019-16650 269 2019-09-20 2019-09-23
7.5
None Remote Low Not required Partial Partial Partial
On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic circumstances, an attacker can simply connect to the virtual media service, and then connect virtual USB devices to the server managed by the BMC.
5 CVE-2019-16257 269 Exec Code 2019-09-12 2019-09-16
7.5
None Remote Low Not required Partial Partial Partial
Some Motorola devices include the SIMalliance Toolbox Browser (aka [email protected] Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker.
6 CVE-2019-16256 269 Exec Code 2019-09-12 2019-09-16
7.5
None Remote Low Not required Partial Partial Partial
Some Samsung devices include the SIMalliance Toolbox Browser (aka [email protected] Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker.
7 CVE-2019-16253 269 2019-09-25 2019-10-01
7.2
None Local Low Not required Complete Complete Complete
The Text-to-speech Engine (aka SamsungTTS) application before 3.0.02.7 and 3.0.00.101 for Android allows a local attacker to escalate privileges, e.g., to system privileges. The Samsung case ID is 101755.
8 CVE-2019-16202 269 2019-09-10 2019-09-11
4.0
None Remote Low Single system Partial None None
MISP before 2.4.115 allows privilege escalation in certain situations. After updating to 2.4.115, escalation attempts are blocked by the __checkLoggedActions function with a "This could be an indication of an attempted privilege escalation on older vulnerable versions of MISP (<2.4.115)" message.
9 CVE-2019-16192 269 Exec Code 2019-09-09 2019-09-11
7.5
None Remote Low Not required Partial Partial Partial
upload_model() in /admini/controllers/system/managemodel.php in DocCms 2016.5.17 allow remote attackers to execute arbitrary PHP code through module management files, as demonstrated by a .php file in a ZIP archive.
10 CVE-2019-16124 269 2019-09-08 2019-09-09
7.5
None Remote Low Not required Partial Partial Partial
In YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to everyone being able to edit the configuration file, and insert malicious PHP code.
11 CVE-2019-16098 269 Exec Code Bypass 2019-09-11 2019-09-13
7.2
None Local Low Not required Complete Complete Complete
The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user to read and write to arbitrary memory, I/O ports, and MSRs. This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.
12 CVE-2019-15896 269 XSS 2019-09-10 2019-09-11
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. The upload_import function in the class.llms.admin.import.php script is prone to an unauthenticated options import vulnerability that could lead to privilege escalation (administrator account creation), website redirection, and stored XSS.
13 CVE-2019-15747 269 2019-10-07 2019-10-08
6.5
None Remote Low Single system Partial Partial Partial
SITOS six Build v6.2.1 allows a user with the user role of Seminar Coordinator to escalate their permission to the Systemadministrator role due to insufficient checks on the server side.
14 CVE-2019-15741 269 2019-09-16 2019-10-04
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. An unsafe interaction with logrotate could result in a privilege escalation
15 CVE-2019-15051 269 2019-10-10 2019-10-15
9.0
None Remote Low Single system Complete Complete Complete
An issue was discovered in Softing uaGate (SI, MB, 840D) firmware through 1.71.00.1225. A CGI script is vulnerable to command injection via a maliciously crafted form parameter.
16 CVE-2019-14454 269 2019-10-02 2019-10-04
7.5
None Remote Low Not required Partial Partial Partial
SuiteCRM 7.11.x and 7.10.x before 7.11.8 and 7.10.20 is vulnerable to vertical privilege escalation.
17 CVE-2019-13356 269 2019-09-24 2019-09-24
4.6
None Local Low Not required Partial Partial Partial
In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\bd\TDUpdate2\ used by AMRT.exe allows local attackers to hijack bdcore.dll, which leads to privilege escalation when the AMRT service loads the DLL.
18 CVE-2019-13355 269 2019-09-24 2019-09-24
4.6
None Local Low Not required Partial Partial Partial
In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\ used by ccschedulersvc.exe allows local attackers to hijack dotnetproxy.exe, which leads to privilege escalation when the ccSchedulerSVC service runs the executable.
19 CVE-2019-12942 269 2019-09-10 2019-09-12
3.3
None Local Network Low Not required None Partial None
TTLock devices do not properly block guest access in certain situations where the network connection to the cloud is unavailable.
20 CVE-2019-12617 269 2019-09-26 2019-09-27
4.0
None Remote Low Single system None Partial None
In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution.
21 CVE-2019-12449 269 2019-05-29 2019-09-20
3.5
None Remote Medium Single system Partial None None
An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles a file's user and group ownership during move (and copy with G_FILE_COPY_ALL_METADATA) operations from admin:// to file:// URIs, because root privileges are unavailable.
22 CVE-2019-12447 269 2019-05-29 2019-09-20
4.9
None Remote Medium Single system Partial Partial None
An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid is not used.
23 CVE-2019-12204 269 2019-09-25 2019-09-26
7.5
None Remote Low Not required Partial Partial Partial
In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access.
24 CVE-2019-11660 269 2019-09-13 2019-09-16
7.2
None Local Low Not required Complete Complete Complete
Privileges manipulation in Micro Focus Data Protector, versions 10.00, 10.01, 10.02, 10.03, 10.04, 10.10, 10.20, 10.30, 10.40. This vulnerability could be exploited by a low-privileged user to execute a custom binary with higher privileges.
25 CVE-2019-11326 269 +Priv 2019-09-20 2019-09-23
6.5
None Remote Low Single system Partial Partial Partial
An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product is protected by a login. A guest is allowed to login. Once logged in as a guest, an attacker can browse a URL to read the password of the administrative user. The same procedure allows a regular user to gain administrative privileges. The guest login is possible in the default configuration.
26 CVE-2019-11280 269 +Priv 2019-09-20 2019-10-09
6.5
None Remote Low Single system Partial Partial Partial
Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.18, 2.4.x prior to 2.4.14, 2.5.x prior to 2.5.10, and 2.6.x prior to 2.6.5, contains an invitations microservice which allows users to invite others to their organizations. A remote authenticated user can gain additional privileges by inviting themselves to spaces that they should not have access to.
27 CVE-2019-11279 269 2019-09-26 2019-10-09
6.5
None Remote Low Single system Partial Partial Partial
CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user can escalate their own privileges to any scope, allowing them to take control of UAA and the resources it controls.
28 CVE-2019-11166 269 2019-09-16 2019-09-17
4.6
None Local Low Not required Partial Partial Partial
Improper file permissions in the installer for Intel(R) Easy Streaming Wizard before version 2.1.0731 may allow an authenticated user to potentially enable escalation of privilege via local attack.
29 CVE-2019-10418 269 Bypass 2019-09-25 2019-10-09
6.5
None Remote Low Single system Partial Partial Partial
Jenkins Kubernetes :: Pipeline :: Arquillian Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.
30 CVE-2019-10417 269 Bypass 2019-09-25 2019-10-09
6.5
None Remote Low Single system Partial Partial Partial
Jenkins Kubernetes :: Pipeline :: Kubernetes Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.
31 CVE-2019-9463 269 Bypass 2019-09-27 2019-10-03
4.4
None Local Medium Not required Partial Partial Partial
In Platform, there is a possible bypass of user interaction requirements due to background app interception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-113584607
32 CVE-2019-6960 269 2019-09-09 2019-09-10
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Access to the internal wiki is permitted when an external wiki service is enabled.
33 CVE-2019-6005 269 Bypass 2019-09-12 2019-09-17
7.5
None Remote Low Not required Partial Partial Partial
Smart TV Box firmware version prior to 1300 allows remote attackers to bypass access restriction to conduct arbitrary operations on the device without user's intent, such as installing arbitrary software or changing the device settings via Android Debug Bridge port 5555/TCP.
34 CVE-2019-3689 269 2019-09-19 2019-10-15
10.0
None Remote Low Not required Complete Complete Complete
The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If statd is compromised, it can therefore trick processes running with root privileges into creating/overwriting files anywhere on the system.
35 CVE-2019-1378 269 2019-10-10 2019-10-15
7.2
None Local Low Not required Complete Complete Complete
An elevation of privilege vulnerability exists in Windows 10 Update Assistant in the way it handles permissions.A locally authenticated attacker could run arbitrary code with elevated system privileges, aka 'Windows 10 Update Assistant Elevation of Privilege Vulnerability'.
36 CVE-2019-1341 269 2019-10-10 2019-10-15
7.2
None Local Low Not required Complete Complete Complete
An elevation of privilege vulnerability exists when umpo.dll of the Power Service, improperly handles a Registry Restore Key function, aka 'Windows Power Service Elevation of Privilege Vulnerability'.
37 CVE-2019-1340 269 2019-10-10 2019-10-15
7.2
None Local Low Not required Complete Complete Complete
An elevation of privilege vulnerability exists in Windows AppX Deployment Server that allows file creation in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Microsoft Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1320, CVE-2019-1322.
38 CVE-2019-1339 269 2019-10-10 2019-10-15
7.2
None Local Low Not required Complete Complete Complete
An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting Manager Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1315, CVE-2019-1342.
39 CVE-2019-1336 269 2019-10-10 2019-10-11
7.2
None Local Low Not required Complete Complete Complete
An elevation of privilege vulnerability exists in the Microsoft Windows Update Client when it does not properly handle privileges, aka 'Microsoft Windows Update Client Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1323.
40 CVE-2019-1330 269 2019-10-10 2019-10-11
4.0
None Remote Low Single system None Partial None
An elevation of privilege vulnerability exists in Microsoft SharePoint, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1329.
41 CVE-2019-1323 269 2019-10-10 2019-10-11
7.2
None Local Low Not required Complete Complete Complete
An elevation of privilege vulnerability exists in the Microsoft Windows Update Client when it does not properly handle privileges, aka 'Microsoft Windows Update Client Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1336.
42 CVE-2019-1321 269 2019-10-10 2019-10-15
7.2
None Local Low Not required Complete Complete Complete
An elevation of privilege vulnerability exists when Windows CloudStore improperly handles file Discretionary Access Control List (DACL), aka 'Microsoft Windows CloudStore Elevation of Privilege Vulnerability'.
43 CVE-2019-1319 269 2019-10-10 2019-10-11
7.2
None Local Low Not required Complete Complete Complete
An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'.
44 CVE-2019-1316 269 2019-10-10 2019-10-11
7.2
None Local Low Not required Complete Complete Complete
An elevation of privilege vulnerability exists in Microsoft Windows Setup when it does not properly handle privileges, aka 'Microsoft Windows Setup Elevation of Privilege Vulnerability'.
45 CVE-2019-1315 269 2019-10-10 2019-10-11
7.2
None Local Low Not required Complete Complete Complete
An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting Manager Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1339, CVE-2019-1342.
46 CVE-2019-1303 269 +Priv 2019-09-11 2019-09-13
7.2
None Local Low Not required Complete Complete Complete
An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1215, CVE-2019-1253, CVE-2019-1278.
47 CVE-2019-1289 269 2019-09-11 2019-09-12
3.6
None Local Low Not required None Partial Partial
An elevation of privilege vulnerability exists when the Windows Update Delivery Optimization does not properly enforce file share permissions, aka 'Windows Update Delivery Optimization Elevation of Privilege Vulnerability'.
48 CVE-2019-1285 269 2019-09-11 2019-09-12
7.2
None Local Low Not required Complete Complete Complete
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1256.
49 CVE-2019-1278 269 2019-09-11 2019-09-12
4.6
None Local Low Not required Partial Partial Partial
An elevation of privilege vulnerability exists in the way that the unistore.dll handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1215, CVE-2019-1253, CVE-2019-1303.
50 CVE-2019-1277 269 2019-09-11 2019-09-12
4.6
None Local Low Not required Partial Partial Partial
An elevation of privilege vulnerability exists in Windows Audio Service when a malformed parameter is processed, aka 'Windows Audio Service Elevation of Privilege Vulnerability'.
Total number of vulnerabilities : 305   Page : 1 (This Page)2 3 4 5 6 7
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.