CWE-269 · Improper Privilege Management (page 23)
Page 23 of 32 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-34412 | High | 7.8 | 2021-09-27 | During the installation process for all versions of the Zoom Client for Meetings for Windows before 5.4.0, it is possible to launch Internet Explorer. If the i… |
CVE-2021-34411 | High | 7.8 | 2021-09-27 | During the installation process forZoom Rooms for Conference Room for Windows before version 5.3.0 it is possible to launch Internet Explorer with elevated pri… |
CVE-2021-31847 | High | 8.2 | 2021-09-22 | Improper access control vulnerability in the repair process for McAfee Agent for Windows prior to 5.7.4 could allow a local attacker to perform a DLL preloadin… |
CVE-2021-31836 | Medium | 5.6 | 2021-09-22 | Improper privilege management vulnerability in maconfig for McAfee Agent for Windows prior to 5.7.4 allows a local user to gain access to sensitive information… |
CVE-2021-33697 | Medium | 6.1 | 2021-09-15 | Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions - 420, 430, can allow an unauthenticated attacker to redirect u… |
CVE-2021-40447 | High | 7.8 | 2021-09-15 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2021-38671 | High | 7.8 | 2021-09-15 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2021-38667 | High | 7.8 | 2021-09-15 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2021-38639 | High | 7.8 | 2021-09-15 | Win32k Elevation of Privilege Vulnerability |
CVE-2021-38638 | High | 7.8 | 2021-09-15 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
CVE-2021-38634 | High | 7.1 | 2021-09-15 | Microsoft Windows Update Client Elevation of Privilege Vulnerability |
CVE-2021-38633 | High | 7.8 | 2021-09-15 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2021-38630 | High | 7.8 | 2021-09-15 | Windows Event Tracing Elevation of Privilege Vulnerability |
CVE-2021-38628 | High | 7.8 | 2021-09-15 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
CVE-2021-38626 | High | 7.8 | 2021-09-15 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2021-38625 | High | 7.8 | 2021-09-15 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2021-36975 | High | 7.8 | 2021-09-15 | Win32k Elevation of Privilege Vulnerability |
CVE-2021-36974 | High | 7.8 | 2021-09-15 | Windows SMB Elevation of Privilege Vulnerability |
CVE-2021-36973 | High | 7.8 | 2021-09-15 | Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability |
CVE-2021-36968 | High | 7.8 | 2021-09-15 | Windows DNS Elevation of Privilege Vulnerability |
CVE-2021-36967 | High | 8.0 | 2021-09-15 | Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability |
CVE-2021-36966 | High | 7.8 | 2021-09-15 | Windows Subsystem for Linux Elevation of Privilege Vulnerability |
CVE-2021-36964 | High | 7.8 | 2021-09-15 | Windows Event Tracing Elevation of Privilege Vulnerability |
CVE-2021-36963 | High | 7.8 | 2021-09-15 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2021-36954 | High | 8.8 | 2021-09-15 | Windows Bind Filter Driver Elevation of Privilege Vulnerability |
CVE-2021-40354 | High | 7.1 | 2021-09-14 | A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions… |
CVE-2021-37173 | High | 8.8 | 2021-09-14 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All… |
CVE-2021-38540 | Critical | 9.8 | 2021-09-09 | The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/mod… |
CVE-2021-1868 | High | 7.8 | 2021-09-08 | A logic issue was addressed with improved state management. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iOS 14.5… |
CVE-2021-1853 | High | 7.8 | 2021-09-08 | A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3. A local attacker may be able to elevate their privileges. |
CVE-2021-1851 | High | 8.8 | 2021-09-08 | A logic issue was addressed with improved state management. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iOS 14.5… |
CVE-2021-1839 | High | 7.8 | 2021-09-08 | The issue was addressed with improved permissions logic. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina, Security Update 2021-003… |
CVE-2021-1836 | Medium | 5.5 | 2021-09-08 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 14.5 and iPadOS 14.5, tvOS 14.5. A local user may be able to create or modif… |
CVE-2021-1813 | High | 7.8 | 2021-09-08 | A validation issue was addressed with improved logic. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iOS 14.5 and i… |
CVE-2021-35946 | Critical | 9.8 | 2021-09-07 | A receiver of a federated share with access to the database with ownCloud version before 10.8 could update the permissions and therefore elevate their own perm… |
CVE-2021-39192 | Medium | 6.5 | 2021-09-03 | Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.0 and 4.9.4 allows all authenticated us… |
CVE-2021-36930 | Medium | 5.3 | 2021-09-02 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2021-30355 | High | 8.6 | 2021-09-01 | Amazon Kindle e-reader prior to and including version 5.13.4 improperly manages privileges, allowing the framework user to elevate privileges to root. |
CVE-2021-37911 | High | 8.8 | 2021-08-30 | The management interface of BenQ smart wireless conference projector does not properly control user's privilege. Attackers can access any system directory of t… |
CVE-2021-39168 | Critical | 10.0 | 2021-08-27 | OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to… |
CVE-2021-39167 | Critical | 10.0 | 2021-08-27 | OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to… |
CVE-2021-36931 | Medium | 4.4 | 2021-08-26 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2021-1579 | High | 8.1 | 2021-08-25 | A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (C… |
CVE-2021-29802 | High | 7.5 | 2021-08-23 | IBM Security SOAR performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the cons… |
CVE-2021-24602 | High | 8.8 | 2021-08-23 | The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile… |
CVE-2021-24038 | High | 7.8 | 2021-08-19 | Due to a bug with management of handles in OVRServiceLauncher.exe, an attacker could expose a privileged process handle to an unprivileged process, leading to… |
CVE-2021-34745 | High | 7.8 | 2021-08-18 | A vulnerability in the AppDynamics .NET Agent for Windows could allow an attacker to leverage an authenticated, local user account to gain SYSTEM privileges. T… |
CVE-2021-37345 | High | 7.8 | 2021-08-13 | Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because xi-sys.cfg is being imported from the var directory for some scripts with el… |
CVE-2021-36945 | High | 7.3 | 2021-08-12 | Windows 10 Update Assistant Elevation of Privilege Vulnerability |
CVE-2021-36943 | Medium | 4.0 | 2021-08-12 | Azure CycleCloud Elevation of Privilege Vulnerability |
CVE-2021-36927 | High | 7.8 | 2021-08-12 | Windows Digital TV Tuner device registration application Elevation of Privilege Vulnerability |
CVE-2021-34537 | High | 7.8 | 2021-08-12 | Windows Bluetooth Driver Elevation of Privilege Vulnerability |
CVE-2021-34487 | High | 7.0 | 2021-08-12 | Windows Event Tracing Elevation of Privilege Vulnerability |
CVE-2021-34483 | High | 7.8 | 2021-08-12 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2021-34471 | High | 7.8 | 2021-08-12 | Microsoft Defender Elevation of Privilege Vulnerability |
CVE-2020-24576 | High | 8.8 | 2021-08-12 | Netskope Client through 77 allows low-privileged users to elevate their privileges to NT AUTHORITY\SYSTEM. |
CVE-2021-37627 | High | 8.0 | 2021-08-11 | Contao is an open source CMS that allows creation of websites and scalable web applications. In affected versions it is possible to gain privileged rights in t… |
CVE-2021-21567 | High | 7.8 | 2021-08-10 | Dell PowerScale OneFS 9.1.0.x contains an improper privilege management vulnerability. It may allow an authenticated user with ISI_PRIV_LOGIN_SSH and/or ISI_PR… |
CVE-2021-38140 | Critical | 9.8 | 2021-08-10 | The set_user extension module before 2.0.1 for PostgreSQL allows a potential privilege escalation using RESET SESSION AUTHORIZATION after set_user(). |
CVE-2021-1572 | High | 7.8 | 2021-08-04 | A vulnerability in ConfD could allow an authenticated, local attacker to execute arbitrary commands at the level of the account under which ConfD is running, w… |
CVE-2021-22421 | High | 7.8 | 2021-08-03 | A component of the HarmonyOS has a Improper Privilege Management vulnerability. Local attackers may exploit this vulnerability to cause further Elevation of Pr… |
CVE-2019-14453 | High | 8.8 | 2021-08-03 | An issue was discovered in Comelit "App lejos de casa (web)" 2.8.0. It allows privilege escalation via modified domus and logged fields, related to js/bridge.m… |
CVE-2021-22396 | High | 7.8 | 2021-08-02 | There is a privilege escalation vulnerability in some Huawei products. Due to improper privilege management, a local attacker with common privilege may access… |
CVE-2021-37167 | Critical | 9.8 | 2021-08-02 | An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus So… |
CVE-2021-33526 | High | 7.8 | 2021-08-02 | In MB connect line mbDIALUP versions <= 3.9R0.0 a low privileged local attacker can send a command to the service running with NT AUTHORITY\SYSTEM instructing… |
CVE-2021-34802 | High | 8.8 | 2021-07-30 | A failure in resetting the security context in some transaction actions in Neo4j Graph Database 4.2 and 4.3 could allow authenticated users to execute commands… |
CVE-2020-18171 | High | 8.8 | 2021-07-26 | TechSmith Snagit 19.1.0.2653 uses Object Linking and Embedding (OLE) which can allow attackers to obfuscate and embed crafted files used to escalate privileges… |
CVE-2020-18169 | High | 7.8 | 2021-07-26 | A vulnerability in the Windows installer XML (WiX) toolset of TechSmith Snagit 19.1.1.2860 allows attackers to escalate privileges. NOTE: Exploit of the Snagit… |
CVE-2020-14032 | Critical | 9.8 | 2021-07-23 | ASRock 4x4 BOX-R1000 before BIOS P1.40 allows privilege escalation via code execution in the SMM. |
CVE-2021-31581 | High | 7.9 | 2021-07-22 | The restricted shell provided by Akkadian Provisioning Manager Engine (PME) can be escaped by abusing the 'Edit MySQL Configuration' command. This command laun… |
CVE-2021-34481 | High | 8.8 | 2021-07-16 | A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfull… |
CVE-2021-34461 | High | 7.8 | 2021-07-16 | Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability |
CVE-2021-34460 | High | 7.8 | 2021-07-16 | Windows Storage Spaces Controller Elevation of Privilege Vulnerability |
CVE-2021-34459 | High | 7.8 | 2021-07-16 | Windows AppContainer Elevation Of Privilege Vulnerability |
CVE-2021-34456 | High | 7.8 | 2021-07-16 | Windows Remote Access Connection Manager Elevation of Privilege Vulnerability |
CVE-2021-34455 | High | 7.8 | 2021-07-16 | Windows File History Service Elevation of Privilege Vulnerability |
CVE-2021-32739 | High | 8.8 | 2021-07-15 | Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From… |
CVE-2021-33505 | High | 7.8 | 2021-07-15 | A local malicious user can circumvent the Falco detection engine through 0.28.1 by running a program that alters arguments of system calls being executed. Issu… |
CVE-2021-34514 | High | 7.8 | 2021-07-14 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2021-34511 | High | 7.8 | 2021-07-14 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2021-34493 | Medium | 6.7 | 2021-07-14 | Windows Partition Management Driver Elevation of Privilege Vulnerability |
CVE-2021-34488 | High | 7.8 | 2021-07-14 | Windows Console Driver Elevation of Privilege Vulnerability |
CVE-2021-34477 | High | 7.8 | 2021-07-14 | Visual Studio Code .NET Runtime Elevation of Privilege Vulnerability |
CVE-2021-33751 | High | 7.0 | 2021-07-14 | Windows Storage Spaces Controller Elevation of Privilege Vulnerability |
CVE-2021-31961 | Medium | 6.1 | 2021-07-14 | Windows InstallService Elevation of Privilege Vulnerability |
CVE-2021-29792 | High | 7.2 | 2021-07-12 | IBM Event Streams 10.0, 10.1, 10.2, and 10.3 could allow a user the CA private key to create their own certificates and deploy them in the cluster and gain pri… |
CVE-2021-35064 | Critical | 9.8 | 2021-07-12 | KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo. Sudoers permits running of multiple dangerous commands, inc… |
CVE-2021-25442 | High | 7.5 | 2021-07-08 | Improper MDM policy management vulnerability in KME module prior to KCS version 1.39 allows MDM users to bypass Knox Manage authentication. |
CVE-2021-25429 | Medium | 4.3 | 2021-07-08 | Improper privilege management vulnerability in Bluetooth application prior to SMR July-2021 Release 1 allows untrusted application to access the Bluetooth info… |
CVE-2021-25428 | High | 7.8 | 2021-07-08 | Improper validation check vulnerability in PackageManager prior to SMR July-2021 Release 1 allows untrusted applications to get dangerous level permission with… |
CVE-2021-21786 | High | 7.8 | 2021-07-07 | A privilege escalation vulnerability exists in the IOCTL 0x9c406144 handling of IOBit Advanced SystemCare Ultimate 14.2.0.220. A specially crafted I/O request… |
CVE-2021-34622 | Critical | 9.8 | 2021-07-07 | A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible… |
CVE-2021-34621 | Critical | 9.8 | 2021-07-07 | A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible f… |
CVE-2021-27661 | High | 8.8 | 2021-07-01 | Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user an unintended level… |
CVE-2021-22376 | High | 8.4 | 2021-06-30 | A component of the HarmonyOS has a Improper Privilege Management vulnerability. Local attackers may exploit this vulnerability to bypass user restrictions. |
CVE-2021-22326 | High | 7.1 | 2021-06-30 | A component of the HarmonyOS has a Privilege Dropping / Lowering Errors vulnerability. Local attackers may exploit this vulnerability to obtain Kernel space re… |
CVE-2021-28692 | High | 7.1 | 2021-06-30 | inappropriate x86 IOMMU timeout detection / handling IOMMUs process commands issued to them in parallel with the operation of the CPU(s) issuing such commands… |
CVE-2021-35523 | High | 7.8 | 2021-06-28 | Securepoint SSL VPN Client v2 before 2.0.32 on Windows has unsafe configuration handling that enables local privilege escalation to NT AUTHORITY\SYSTEM. A non-… |
CVE-2021-33538 | High | 8.8 | 2021-06-25 | In Weidmueller Industrial WLAN devices in multiple versions an exploitable improper access control vulnerability exists in the iw_webs account settings functio… |
CVE-2021-35448 | High | 7.8 | 2021-06-24 | Emote Interactive Remote Mouse 3.008 on Windows allows attackers to execute arbitrary programs as Administrator by using the Image Transfer Folder feature to n… |