CVE-2024-9180

HIGH Year: 2024
CVSS v3 Score
7.2
High
Weakness Type
CWE-266
View all →

Vulnerability Description

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16.

Related Vulnerabilities

CVE-2018-1101

HIGH
CVSS:7.2(High)

Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations ...

CWE-2662018

CVE-2022-3549

HIGH
CVSS:7.2(High)

A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /csms/admin/?page=user/m...

CWE-2662022

CVE-2024-9519

HIGH
CVSS:7.2(High)

The UserPlus plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'save_metabox_form' function in versions up to, and including, 2.0. This...

CWE-2662024

CVE-2025-31560

HIGH
CVSS:7.2(High)

Incorrect Privilege Assignment vulnerability in Dimitri Grassi Salon booking system allows Privilege Escalation. This issue affects Salon booking system: from n/a through 10.11.

CWE-2662025

CVE-2023-3518

HIGH
CVSS:7.3(High)

HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1.

CWE-2662023

CVE-2023-40109

HIGH
CVSS:7.3(High)

In createFromParcel of UsbConfiguration.java, there is a possible background activity launch (BAL) due to a permissions bypass. This could lead to local escalation of privilege with no additional exec...

CWE-2662023