CWE-269 · Improper Privilege Management (page 22)
Page 22 of 32 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-22509 | High | 8.8 | 2022-02-02 | In Phoenix Contact FL SWITCH Series 2xxx in version 3.00 an incorrect privilege assignment allows an low privileged user to enable full access to the device co… |
CVE-2021-45729 | Medium | 5.4 | 2022-01-25 | The Privilege Escalation vulnerability discovered in the WP Google Map WordPress plugin (versions <= 1.8.0) allows authenticated low-role users to create, edit… |
CVE-2021-45222 | High | 8.8 | 2022-01-24 | An issue was discovered in COINS Construction Cloud 11.12. Due to logical flaws in the human ressources interface, it is vulnerable to privilege escalation by… |
CVE-2022-21699 | High | 8.2 | 2022-01-19 | IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming la… |
CVE-2022-0090 | Medium | 6.5 | 2022-01-18 | An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab is configured in a way… |
CVE-2021-34998 | High | 7.8 | 2022-01-13 | This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Free Antivirus 20.2.0.0. An attacker must first ob… |
CVE-2021-43860 | High | 8.2 | 2022-01-12 | Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissio… |
CVE-2021-42562 | High | 8.1 | 2022-01-12 | An issue was discovered in CALDERA 2.8.1. It does not properly segregate user privileges, resulting in non-admin users having access to read and modify configu… |
CVE-2022-21970 | Medium | 6.1 | 2022-01-11 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2022-21902 | High | 7.8 | 2022-01-11 | Windows DWM Core Library Elevation of Privilege Vulnerability |
CVE-2022-0144 | High | 7.1 | 2022-01-11 | shelljs is vulnerable to Improper Privilege Management |
CVE-2022-22266 | Medium | 4.0 | 2022-01-10 | (Applicable to China models only) Unprotected WifiEvaluationService in TencentWifiSecurity application prior to SMR Jan-2022 Release 1 allows untrusted applica… |
CVE-2022-22263 | Medium | 4.0 | 2022-01-10 | Unprotected dynamic receiver in SecSettings prior to SMR Jan-2022 Release 1 allows untrusted applications to launch arbitrary activity. |
CVE-2021-45440 | High | 7.8 | 2022-01-10 | A unnecessary privilege vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security 10.0 SP1 (on-prem versions only) could allow a local… |
CVE-2021-41388 | High | 7.8 | 2022-01-04 | Netskope client prior to 89.x on macOS is impacted by a local privilege escalation vulnerability. The XPC implementation of nsAuxiliarySvc process does not per… |
CVE-2021-31833 | High | 7.1 | 2022-01-04 | Potential product security bypass vulnerability in McAfee Application and Change Control (MACC) prior to version 8.3.4 allows a locally logged in attacker to c… |
CVE-2021-39982 | Critical | 9.1 | 2022-01-03 | Phone Manager application has a Improper Privilege Management vulnerability.Successful exploitation of this vulnerability may read and write arbitrary files by… |
CVE-2021-43858 | High | 8.8 | 2021-12-27 | MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call… |
CVE-2021-21750 | High | 7.8 | 2021-12-27 | ZTE BigVideo Analysis product has a privilege escalation vulnerability. Due to improper management of the timed task modification privilege, an attacker with o… |
CVE-2018-4478 | Medium | 6.8 | 2021-12-23 | A validation issue was addressed with improved logic. This issue is fixed in macOS High Sierra 10.13.5, Security Update 2018-003 Sierra, Security Update 2018-0… |
CVE-2021-21911 | High | 7.8 | 2021-12-22 | A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-c… |
CVE-2021-27445 | High | 7.8 | 2021-12-21 | Mesa Labs AmegaView Versions 3.0 and prior has insecure file permissions that could be exploited to escalate privileges on the device. |
CVE-2021-36316 | Medium | 6.7 | 2021-12-21 | Dell EMC Avamar Server versions 18.2, 19.1, 19.2, 19.3, and 19.4 contain an improper privilege management vulnerability in AUI. A malicious user with high priv… |
CVE-2021-43835 | High | 7.2 | 2021-12-15 | Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions Sulu users who have access to any subset of the admin… |
CVE-2021-43828 | High | 7.5 | 2021-12-14 | PatrOwl is a free and open-source solution for orchestrating Security Operations. In versions prior to 1.77 an improper privilege management (IDOR) has been fo… |
CVE-2021-39944 | High | 7.1 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-39937 | Medium | 5.9 | 2021-12-13 | A collision in access memoization logic in all versions of GitLab CE/EE before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting fro… |
CVE-2021-43528 | Medium | 6.5 | 2021-12-08 | Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to this area and did not receive chrome-level… |
CVE-2021-37941 | High | 7.8 | 2021-12-08 | A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an application running with t… |
CVE-2021-25515 | Medium | 4.0 | 2021-12-08 | An improper usage of implicit intent in SemRewardManager prior to SMR Dec-2021 Release 1 allows attackers to access BSSID. |
CVE-2021-25513 | Low | 2.4 | 2021-12-08 | An improper privilege management vulnerability in Apps Edge application prior to SMR Dec-2021 Release 1 allows unauthorized access to some device data on the l… |
CVE-2021-44021 | High | 7.8 | 2021-12-03 | An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected ins… |
CVE-2021-44020 | High | 7.8 | 2021-12-03 | An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected ins… |
CVE-2021-44019 | High | 7.8 | 2021-12-03 | An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected ins… |
CVE-2021-43793 | Medium | 4.3 | 2021-12-01 | Discourse is an open source discussion platform. In affected versions a vulnerability in the Polls feature allowed users to vote multiple times in a single-opt… |
CVE-2021-43211 | Medium | 5.5 | 2021-11-24 | Windows 10 Update Assistant Elevation of Privilege Vulnerability |
CVE-2021-35052 | High | 7.8 | 2021-11-23 | A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High. |
CVE-2021-28710 | High | 8.8 | 2021-11-21 | certain VT-d IOMMUs may not work in shared page table mode For efficiency reasons, address translation control structures (page tables) may (and, on suitable h… |
CVE-2021-36307 | High | 8.8 | 2021-11-20 | Networking OS10, versions prior to October 2021 with RESTCONF API enabled, contains a privilege escalation vulnerability. A malicious low privileged user with… |
CVE-2021-23193 | High | 8.1 | 2021-11-18 | Improper privilege validation vulnerability in COM Interface of Gallagher Command Centre Server allows authenticated unprivileged operators to retrieve sensiti… |
CVE-2021-35534 | High | 7.2 | 2021-11-18 | Insufficient security control vulnerability in internal database access mechanism of Hitachi Energy Relion 670/650/SAM600-IO, Relion 650, GMS600, PWC600 allows… |
CVE-2021-37938 | Medium | 4.3 | 2021-11-18 | It was discovered that on Windows operating systems specifically, Kibana was not validating a user supplied path, which would load .pbf files. Because of this… |
CVE-2021-42956 | High | 7.8 | 2021-11-17 | Zoho Remote Access Plus Server Windows Desktop Binary fixed in 10.1.2132.6 is affected by a sensitive information disclosure vulnerability. Due to improper pri… |
CVE-2021-42322 | High | 7.8 | 2021-11-10 | Visual Studio Code Elevation of Privilege Vulnerability |
CVE-2021-42319 | Medium | 4.7 | 2021-11-10 | Visual Studio Elevation of Privilege Vulnerability |
CVE-2021-42304 | Medium | 6.6 | 2021-11-10 | Azure RTOS Elevation of Privilege Vulnerability |
CVE-2021-42303 | Medium | 6.6 | 2021-11-10 | Azure RTOS Elevation of Privilege Vulnerability |
CVE-2021-42302 | Medium | 6.6 | 2021-11-10 | Azure RTOS Elevation of Privilege Vulnerability |
CVE-2021-42291 | High | 7.5 | 2021-11-10 | Active Directory Domain Services Elevation of Privilege Vulnerability |
CVE-2021-42286 | High | 7.8 | 2021-11-10 | Windows Core Shell SI Host Extension Framework for Composable Shell Elevation of Privilege Vulnerability |
CVE-2021-42285 | High | 7.8 | 2021-11-10 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2021-42283 | High | 8.8 | 2021-11-10 | NTFS Elevation of Privilege Vulnerability |
CVE-2021-42282 | High | 7.5 | 2021-11-10 | Active Directory Domain Services Elevation of Privilege Vulnerability |
CVE-2021-42280 | Medium | 5.5 | 2021-11-10 | Windows Feedback Hub Elevation of Privilege Vulnerability |
CVE-2021-42277 | Medium | 5.5 | 2021-11-10 | Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability |
CVE-2021-41377 | High | 7.8 | 2021-11-10 | Windows Fast FAT File System Driver Elevation of Privilege Vulnerability |
CVE-2021-41370 | High | 7.8 | 2021-11-10 | NTFS Elevation of Privilege Vulnerability |
CVE-2021-41367 | High | 7.8 | 2021-11-10 | NTFS Elevation of Privilege Vulnerability |
CVE-2021-41366 | High | 7.8 | 2021-11-10 | Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege Vulnerability |
CVE-2021-36957 | High | 7.8 | 2021-11-10 | Windows Desktop Bridge Elevation of Privilege Vulnerability |
CVE-2019-18916 | High | 7.8 | 2021-11-09 | A potential security vulnerability has been identified for HP LaserJet Solution Software (for certain HP LaserJet Printers) which may lead to unauthorized elev… |
CVE-2021-25508 | Medium | 5.3 | 2021-11-05 | Improper privilege management vulnerability in API Key used in SmartThings prior to 1.7.73.22 allows an attacker to abuse the API key without limitation. |
CVE-2021-25502 | High | 7.9 | 2021-11-05 | A vulnerability of storing sensitive information insecurely in Property Settings prior to SMR Nov-2021 Release 1 allows attackers to read ESN value without pri… |
CVE-2021-40124 | Medium | 6.7 | 2021-11-04 | A vulnerability in the Network Access Manager (NAM) module of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker… |
CVE-2021-41022 | High | 7.8 | 2021-11-02 | A improper privilege management in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows attacker to execute privileged code or commands via powershe… |
CVE-2021-1118 | High | 7.8 | 2021-10-29 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where there is the potential to execute privileged operations by the gu… |
CVE-2021-3576 | High | 7.8 | 2021-10-28 | Execution with Unnecessary Privileges vulnerability in Bitdefender Endpoint Security Tools, Total Security allows a local attacker to elevate to 'NT AUTHORITY\… |
CVE-2021-23877 | Medium | 6.7 | 2021-10-26 | Privilege escalation vulnerability in the Windows trial installer of McAfee Total Protection (MTP) prior to 16.0.34_x may allow a local user to run arbitrary c… |
CVE-2021-42108 | High | 7.8 | 2021-10-21 | Unnecessary privilege vulnerabilities in the Web Console of Trend Micro Apex One, Apex One as a Service and Worry-Free Business Security 10.0 SP1 could allow a… |
CVE-2021-42107 | High | 7.8 | 2021-10-21 | Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Se… |
CVE-2021-42106 | High | 7.8 | 2021-10-21 | Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Se… |
CVE-2021-42105 | High | 7.8 | 2021-10-21 | Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Se… |
CVE-2021-42104 | High | 7.8 | 2021-10-21 | Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Se… |
CVE-2021-31360 | High | 7.1 | 2021-10-19 | An improper privilege management vulnerability in the Juniper Networks Junos OS and Junos OS Evolved command-line interpreter (CLI) allows a low-privileged use… |
CVE-2021-31359 | High | 7.8 | 2021-10-19 | A local privilege escalation vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged user to cause the Juniper DHCP daem… |
CVE-2021-31350 | High | 7.5 | 2021-10-19 | An Improper Privilege Management vulnerability in the gRPC framework, used by the Juniper Extension Toolkit (JET) API on Juniper Networks Junos OS and Junos OS… |
CVE-2021-40854 | High | 7.8 | 2021-10-14 | AnyDesk before 6.2.6 and 6.3.x before 6.3.3 allows a local user to obtain administrator privileges by using the Open Chat Log feature to launch a privileged No… |
CVE-2021-41348 | High | 8.0 | 2021-10-13 | Microsoft Exchange Server Elevation of Privilege Vulnerability |
CVE-2021-41347 | High | 7.8 | 2021-10-13 | Windows AppX Deployment Service Elevation of Privilege Vulnerability |
CVE-2021-41345 | High | 7.8 | 2021-10-13 | Storage Spaces Controller Elevation of Privilege Vulnerability |
CVE-2021-41339 | Medium | 4.7 | 2021-10-13 | Microsoft DWM Core Library Elevation of Privilege Vulnerability |
CVE-2021-41335 | High | 7.8 | 2021-10-13 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2021-41334 | High | 7.0 | 2021-10-13 | Windows Desktop Bridge Elevation of Privilege Vulnerability |
CVE-2021-40489 | High | 7.8 | 2021-10-13 | Storage Spaces Controller Elevation of Privilege Vulnerability |
CVE-2021-40488 | High | 7.8 | 2021-10-13 | Storage Spaces Controller Elevation of Privilege Vulnerability |
CVE-2021-40478 | High | 7.8 | 2021-10-13 | Storage Spaces Controller Elevation of Privilege Vulnerability |
CVE-2021-40477 | High | 7.8 | 2021-10-13 | Windows Event Tracing Elevation of Privilege Vulnerability |
CVE-2021-40470 | High | 7.8 | 2021-10-13 | DirectX Graphics Kernel Elevation of Privilege Vulnerability |
CVE-2021-40467 | High | 7.8 | 2021-10-13 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2021-40466 | High | 7.8 | 2021-10-13 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2021-40464 | High | 8.0 | 2021-10-13 | Windows Nearby Sharing Elevation of Privilege Vulnerability |
CVE-2021-40443 | High | 7.8 | 2021-10-13 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2021-26441 | High | 7.8 | 2021-10-13 | Storage Spaces Controller Elevation of Privilege Vulnerability |
CVE-2021-22263 | Medium | 5.5 | 2021-10-11 | An issue has been discovered in GitLab affecting all versions starting from 13.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions sta… |
CVE-2021-27664 | Critical | 9.8 | 2021-10-11 | Under certain configurations an unauthenticated remote user could be given access to credentials stored in the exacqVision Server. |
CVE-2021-42135 | High | 8.1 | 2021-10-11 | HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine… |
CVE-2021-34766 | Medium | 5.4 | 2021-10-06 | A vulnerability in the web UI of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges and cre… |
CVE-2021-0691 | Medium | 6.7 | 2021-10-06 | In the SELinux policy configured in system_app.te, there is a possible way for system_app to gain code execution in other processes due to an overly-permissive… |
CVE-2021-28702 | High | 7.6 | 2021-10-06 | PCI devices with RMRRs not deassigned correctly Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region… |
CVE-2021-23893 | High | 8.8 | 2021-10-01 | Privilege Escalation vulnerability in a Windows system driver of McAfee Drive Encryption (DE) prior to 7.3.0 could allow a local non-admin user to gain elevate… |