CWE-269 · Improper Privilege Management (page 24)
Page 24 of 32 — CVEs classified under CWE-269, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-29951 | Medium | 6.5 | 2021-06-24 | The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop th… |
CVE-2021-23999 | High | 8.8 | 2021-06-24 | If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should… |
CVE-2021-25651 | High | 8.0 | 2021-06-24 | A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to escalate privileges. Affects all… |
CVE-2021-25650 | High | 7.7 | 2021-06-24 | A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to execute specially crafted scripts… |
CVE-2021-34810 | Critical | 9.9 | 2021-06-18 | Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbit… |
CVE-2021-27483 | High | 7.8 | 2021-06-16 | ZOLL Defibrillator Dashboard, v prior to 2.2,The affected products contain insecure filesystem permissions that could allow a lower privilege user to escalate… |
CVE-2021-25418 | High | 7.8 | 2021-06-11 | Improper component protection vulnerability in Samsung Internet prior to version 14.0.1.62 allows untrusted applications to execute arbitrary activity in speci… |
CVE-2021-28814 | High | 8.8 | 2021-06-11 | An improper access control vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows remote attackers to compromise the secur… |
CVE-2021-31839 | Medium | 4.8 | 2021-06-10 | Improper privilege management vulnerability in McAfee Agent for Windows prior to 5.7.3 allows a local user to modify event information in the MA event folder… |
CVE-2021-0052 | High | 7.8 | 2021-06-09 | Incorrect default privileges in the Intel(R) Computing Improvement Program before version 2.4.6522 may allow an authenticated user to potentially enable an esc… |
CVE-2021-33356 | High | 8.8 | 2021-06-09 | Multiple privilege escalation vulnerabilities in RaspAP 1.5 to 2.6.5 could allow an authenticated remote attacker to inject arbitrary commands to /installers/c… |
CVE-2021-31969 | High | 7.8 | 2021-06-08 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability |
CVE-2021-31954 | High | 7.8 | 2021-06-08 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2021-27657 | High | 8.8 | 2021-06-04 | Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them t… |
CVE-2013-4536 | High | 7.8 | 2021-05-28 | An user able to alter the savevm data (either on the disk or over the wire during migration) could use this flaw to to corrupt QEMU process memory on the (dest… |
CVE-2021-22118 | High | 7.8 | 2021-05-27 | In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)cr… |
CVE-2021-22733 | High | 7.8 | 2021-05-26 | Improper Privilege Management vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause shell access when unauthorized c… |
CVE-2021-22732 | High | 7.8 | 2021-05-26 | Improper Privilege Management vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause a code execution issue when an a… |
CVE-2018-16497 | High | 7.8 | 2021-05-26 | In Versa Analytics, the cron jobs are used for scheduling tasks by executing commands at specific dates and times on the server. If the job is run as the user… |
CVE-2020-28904 | Critical | 9.8 | 2021-05-24 | Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a malicious component co… |
CVE-2021-20713 | High | 7.8 | 2021-05-24 | Privilege escalation vulnerability in QND Advance/Premium/Standard Ver.11.0.4i and earlier allows an attacker who can log in to the PC where the product's Wind… |
CVE-2021-24289 | High | 8.8 | 2021-05-17 | There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta da… |
CVE-2021-23891 | High | 7.8 | 2021-05-12 | Privilege Escalation vulnerability in McAfee Total Protection (MTP) prior to 16.0.32 allows a local user to gain elevated privileges by impersonating a client… |
CVE-2021-31169 | High | 7.8 | 2021-05-11 | Windows Container Manager Service Elevation of Privilege Vulnerability |
CVE-2021-31168 | High | 7.8 | 2021-05-11 | Windows Container Manager Service Elevation of Privilege Vulnerability |
CVE-2021-21430 | Medium | 6.2 | 2021-05-10 | OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec… |
CVE-2021-21428 | Critical | 9.3 | 2021-05-10 | Openapi generator is a java tool which allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically… |
CVE-2021-1447 | Medium | 6.7 | 2021-05-06 | A vulnerability in the user account management system of Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an authenticated, loca… |
CVE-2021-1401 | High | 8.8 | 2021-05-06 | Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an a… |
CVE-2021-1400 | High | 8.8 | 2021-05-06 | Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an a… |
CVE-2020-28014 | Medium | 6.1 | 2021-05-06 | Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. The -oP option is available to the exim user, and allows a denial of service because root-ow… |
CVE-2020-28008 | High | 7.8 | 2021-05-06 | Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the spool directory (owned by a non-root user), an attacker… |
CVE-2020-23128 | Medium | 4.9 | 2021-05-06 | Chamilo LMS 1.11.10 does not properly manage privileges which could allow a user with Sessions administrator privilege to create a new user then use the edit u… |
CVE-2020-27518 | High | 7.8 | 2021-05-04 | All versions of Windscribe VPN for Mac and Windows <= v2.02.10 contain a local privilege escalation vulnerability in the WindscribeService component. A low pri… |
CVE-2020-27519 | High | 7.8 | 2021-04-30 | Pritunl Client v1.2.2550.20 contains a local privilege escalation vulnerability in the pritunl-service component. The attack vector is: malicious openvpn confi… |
CVE-2021-0256 | Medium | 5.5 | 2021-04-22 | A sensitive information disclosure vulnerability in the mosquitto message broker of Juniper Networks Junos OS may allow a locally authenticated user with shell… |
CVE-2021-0255 | Medium | 5.5 | 2021-04-22 | A local privilege escalation vulnerability in ethtraceroute of Juniper Networks Junos OS may allow a locally authenticated user with shell access to escalate p… |
CVE-2021-31523 | High | 7.8 | 2021-04-21 | The Debian xscreensaver 5.42+dfsg1-1 package for XScreenSaver has cap_net_raw enabled for the /usr/libexec/xscreensaver/sonar file, which allows local users to… |
CVE-2021-20208 | Medium | 6.1 | 2021-04-19 | A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of th… |
CVE-2021-21981 | High | 7.8 | 2021-04-19 | VMware NSX-T contains a privilege escalation vulnerability due to an issue with RBAC (Role based access control) role assignment. Successful exploitation of th… |
CVE-2021-29452 | High | 8.1 | 2021-04-16 | a12n-server is an npm package which aims to provide a simple authentication system. A new HAL-Form was added to allow editing users in version 0.18.0. This fea… |
CVE-2021-27394 | High | 8.8 | 2021-04-16 | A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.19), Mendix Applications using Mendix 8 (All versions < V8.17.0… |
CVE-2021-23887 | High | 7.8 | 2021-04-15 | Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.100 allows a local, low privileged, attacker to writ… |
CVE-2021-30479 | Medium | 5.3 | 2021-04-15 | An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the all_public_streams API feature resulted in guest users being able to rec… |
CVE-2021-30478 | Medium | 4.3 | 2021-04-15 | An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the can_forge_sender permission (previously is_api_super_user) resulted in u… |
CVE-2021-29449 | Medium | 6.3 | 2021-04-14 | Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Multiple privilege escalation vulnerabilities were discovered in vers… |
CVE-2021-28322 | High | 7.8 | 2021-04-13 | Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability |
CVE-2021-28313 | High | 7.8 | 2021-04-13 | Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability |
CVE-2020-15390 | Critical | 9.8 | 2021-04-12 | pyActivity in Pega Platform 8.4.0.237 has a security misconfiguration that leads to an improper access control vulnerability via =GetWebInfo. |
CVE-2021-25377 | Low | 3.3 | 2021-04-09 | Intent redirection in Samsung Experience Service versions 10.8.0.4 in Android P(9.0) below, and 12.2.0.5 in Android Q(10.0) above allows attacker to execute pr… |
CVE-2021-25365 | Medium | 5.9 | 2021-04-09 | An improper exception control in softsimd prior to SMR APR-2021 Release 1 allows unprivileged applications to access the API in softsimd. |
CVE-2021-25363 | Medium | 6.8 | 2021-04-09 | An improper access control in ActivityManagerService prior to SMR APR-2021 Release 1 allows untrusted applications to access running processesdelete some local… |
CVE-2021-25362 | Medium | 6.8 | 2021-04-09 | An improper permission management in CertInstaller prior to SMR APR-2021 Release 1 allows untrusted applications to delete certain local files. |
CVE-2021-20021 | Critical | 9.8 | 2021-04-09 | A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to th… |
CVE-2021-30152 | Medium | 4.3 | 2021-04-09 | An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. When using the MediaWiki API to "protect" a page, a user is curren… |
CVE-2021-26758 | High | 8.8 | 2021-04-07 | Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8 allows attackers to gain root terminal access and execute commands on the… |
CVE-2021-20334 | Medium | 4.8 | 2021-04-06 | A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the use… |
CVE-2021-24207 | Medium | 4.3 | 2021-04-05 | By default, the WP Page Builder WordPress plugin before 1.2.4 allows subscriber-level users to edit and make changes to any and all posts pages - user roles mu… |
CVE-2021-24158 | Medium | 6.5 | 2021-04-05 | Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As part of the registrati… |
CVE-2021-1802 | High | 7.8 | 2021-04-02 | A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-… |
CVE-2021-1787 | High | 7.8 | 2021-04-02 | Multiple issues were addressed with improved logic. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Moja… |
CVE-2021-1750 | High | 7.8 | 2021-04-02 | Multiple issues were addressed with improved logic. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Moja… |
CVE-2020-29620 | High | 7.8 | 2021-04-02 | This issue was addressed with improved entitlements. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Moj… |
CVE-2020-27938 | High | 7.8 | 2021-04-02 | A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-… |
CVE-2020-7467 | High | 7.6 | 2021-03-26 | In FreeBSD 12.2-STABLE before r365767, 11.4-STABLE before r365769, 12.1-RELEASE before p10, 11.4-RELEASE before p4 and 11.3-RELEASE before p14 a number of AMD… |
CVE-2021-28250 | High | 7.8 | 2021-03-26 | CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a setuid (and/or setgid) file. When a component is run as an argument o… |
CVE-2021-27454 | High | 7.8 | 2021-03-25 | The software performs an operation at a privilege level higher than the minimum level required, which creates new weaknesses or amplifies the consequences of o… |
CVE-2021-27448 | High | 7.8 | 2021-03-25 | A miscommunication in the file system allows adversaries with access to the MU320E to escalate privileges on the MU320E (all firmware versions prior to v04A00… |
CVE-2021-27192 | High | 7.8 | 2021-03-25 | Local privilege escalation vulnerability in Windows clients of Netop Vision Pro up to and including 9.7.1 allows a local user to gain administrator privileges… |
CVE-2021-1371 | Medium | 6.6 | 2021-03-24 | A vulnerability in the role-based access control of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker with read-only privileges to obta… |
CVE-2019-19354 | High | 7.8 | 2021-03-24 | An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/hadoop as shipped in Red Hat Openshift 4. An attacker with a… |
CVE-2017-20002 | High | 7.8 | 2021-03-17 | The Debian shadow package before 1:4.5-1 for Shadow incorrectly lists pts/0 and pts/1 as physical terminals in /etc/securetty. This allows local users to login… |
CVE-2020-4184 | High | 7.3 | 2021-03-15 | IBM Security Guardium 11.2 performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies… |
CVE-2021-27077 | High | 7.8 | 2021-03-11 | Windows Win32k Elevation of Privilege Vulnerability |
CVE-2021-26863 | High | 7.0 | 2021-03-11 | Windows Win32k Elevation of Privilege Vulnerability |
CVE-2021-24095 | High | 7.0 | 2021-03-11 | DirectX Elevation of Privilege Vulnerability |
CVE-2021-24090 | High | 7.8 | 2021-03-11 | Windows Error Reporting Elevation of Privilege Vulnerability |
CVE-2021-1729 | High | 7.1 | 2021-03-11 | Windows Update Stack Setup Elevation of Privilege Vulnerability |
CVE-2021-1640 | High | 7.8 | 2021-03-11 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2021-25337 | Medium | 4.4 | 2021-03-04 | Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain l… |
CVE-2021-25336 | Low | 2.8 | 2021-03-04 | Improper access control in NotificationManagerService in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to acquire notifi… |
CVE-2020-12528 | Medium | 6.5 | 2021-03-02 | An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. Improper use of access validation allows a lo… |
CVE-2020-12527 | Medium | 6.5 | 2021-03-02 | An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. Improper access… |
CVE-2021-24102 | High | 7.8 | 2021-02-25 | Windows Event Tracing Elevation of Privilege Vulnerability |
CVE-2021-24096 | High | 7.8 | 2021-02-25 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2021-24092 | High | 7.8 | 2021-02-25 | Microsoft Defender Elevation of Privilege Vulnerability |
CVE-2021-24087 | High | 7.0 | 2021-02-25 | Azure IoT CLI extension Elevation of Privilege Vulnerability |
CVE-2021-1733 | High | 7.8 | 2021-02-25 | Sysinternals PsExec Elevation of Privilege Vulnerability |
CVE-2021-1728 | High | 8.8 | 2021-02-25 | System Center Operations Manager Elevation of Privilege Vulnerability |
CVE-2021-1727 | High | 7.8 | 2021-02-25 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2021-1698 | High | 7.8 | 2021-02-25 | Windows Win32k Elevation of Privilege Vulnerability |
CVE-2021-1388 | Critical | 10.0 | 2021-02-24 | A vulnerability in an API endpoint of Cisco ACI Multi-Site Orchestrator (MSO) installed on the Application Services Engine could allow an unauthenticated, remo… |
CVE-2021-26594 | High | 8.8 | 2021-02-23 | In Directus 8.x through 8.8.1, an attacker can switch to the administrator role (via the PATCH method) without any control by the back end. NOTE: This vulnerab… |
CVE-2021-25630 | High | 7.8 | 2021-02-23 | "loolforkit" is a privileged program that is supposed to be run by a special, non-privileged "lool" user. Before doing anything else "loolforkit" checks, if it… |
CVE-2021-1416 | Medium | 6.5 | 2021-02-17 | Multiple vulnerabilities in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive informat… |
CVE-2021-26697 | Medium | 5.3 | 2021-02-17 | The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that en… |
CVE-2021-23885 | Critical | 9.0 | 2021-02-17 | Privilege escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.8 allows an authenticated user to gain elevated privileges through the User Interfa… |
CVE-2021-20075 | High | 7.8 | 2021-02-16 | Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows for privilege escalation via configd. |
CVE-2020-35557 | Medium | 6.5 | 2021-02-16 | An issue in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 allows a logged in user to see… |
CVE-2020-29031 | High | 7.1 | 2021-02-15 | An Insecure Direct Object Reference vulnerability exists in the web UI of the GateManager which allows an authenticated attacker to reset the password of any u… |