CWE-269: Improper Privilege Management, page 57

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

What the weakness is: CWE-269 at MITRE

1. 9.1CVE-2021-39982EPSS 0.7%2022-01-03

   Phone Manager application has a Improper Privilege Management vulnerability.Successful exploitation of this vulnerability may read and write arbitrary files by tampering with Phone Manager notifications.

2. 8.8CVE-2021-43858EPSS 35%2021-12-27

   MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The p…

3. 7.8CVE-2021-21750EPSS 0.3%2021-12-27

   ZTE BigVideo Analysis product has a privilege escalation vulnerability. Due to improper management of the timed task modification privilege, an attacker with ordinary user permissions could exploit this vulnerability to gain unauthorized a…

4. 6.8CVE-2018-4478EPSS 0.3%2021-12-23

   A validation issue was addressed with improved logic. This issue is fixed in macOS High Sierra 10.13.5, Security Update 2018-003 Sierra, Security Update 2018-003 El Capitan. An attacker with physical access to a device may be able to eleva…

5. 7.8CVE-2021-21911EPSS 0.3%2021-12-22

   A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM au…

6. 7.8CVE-2021-27445EPSS 0.2%2021-12-21

   Mesa Labs AmegaView Versions 3.0 and prior has insecure file permissions that could be exploited to escalate privileges on the device.

7. 7.2CVE-2021-36316EPSS 0.8%2021-12-21

   Dell EMC Avamar Server versions 18.2, 19.1, 19.2, 19.3, and 19.4 contain an improper privilege management vulnerability in AUI. A malicious user with high privileges could potentially exploit this vulnerability, leading to the disclosure o…

8. 7.2CVE-2021-43835EPSS 1.2%2021-12-15

   Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions Sulu users who have access to any subset of the admin UI are able to elevate their privilege. Over the API it was possible for them t…

9. 7.5CVE-2021-43828EPSS 1.4%2021-12-14

   PatrOwl is a free and open-source solution for orchestrating Security Operations. In versions prior to 1.77 an improper privilege management (IDOR) has been found in PatrowlManager. All imports findings file is placed under /media/imports/…

10. 7.1CVE-2021-39944EPSS 0.9%2021-12-13

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A permissions validation flaw allowed group…

11. 8.8CVE-2021-39937EPSS 0.8%2021-12-13

    A collision in access memoization logic in all versions of GitLab CE/EE before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, leads to potential elevated privileges in groups and proje…

12. 6.5CVE-2021-43528EPSS 1.3%2021-12-08

    Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to this area and did not receive chrome-level privileges, but could be used as a stepping stone to further an attack with oth…

13. 7.8CVE-2021-37941EPSS 0.2%2021-12-08

    A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an application running with the APM Java agent. Using this vector, a malicious or compromised user account co…

14. 3.3CVE-2021-25515EPSS 0.1%2021-12-08

    An improper usage of implicit intent in SemRewardManager prior to SMR Dec-2021 Release 1 allows attackers to access BSSID.

15. 2.4CVE-2021-25513EPSS 0.1%2021-12-08

    An improper privilege management vulnerability in Apps Edge application prior to SMR Dec-2021 Release 1 allows unauthorized access to some device data on the lockscreen.

16. 7.8CVE-2021-44021EPSS 0.4%2021-12-03

    An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute lo…

17. 7.8CVE-2021-44020EPSS 0.4%2021-12-03

    An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute lo…

18. 7.8CVE-2021-44019EPSS 0.4%2021-12-03

    An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute lo…

19. 4.3CVE-2021-43793EPSS 0.8%2021-12-01

    Discourse is an open source discussion platform. In affected versions a vulnerability in the Polls feature allowed users to vote multiple times in a single-option poll. The problem is patched in the latest tests-passed, beta and stable ver…

20. 5.5CVE-2021-43211EPSS 0.9%2021-11-24

    Windows 10 Update Assistant Elevation of Privilege Vulnerability

21. 7.8CVE-2021-35052EPSS 0.3%2021-11-23

    A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High.

22. 8.8CVE-2021-28710EPSS 0.3%2021-11-21

    certain VT-d IOMMUs may not work in shared page table mode For efficiency reasons, address translation control structures (page tables) may (and, on suitable hardware, by default will) be shared between CPUs, for second-level translation (…

23. 8.8CVE-2021-36307EPSS 0.9%2021-11-20

    Networking OS10, versions prior to October 2021 with RESTCONF API enabled, contains a privilege escalation vulnerability. A malicious low privileged user with specific access to the API could potentially exploit this vulnerability to gain …

24. 6.5CVE-2021-23193EPSS 0.7%2021-11-18

    Improper privilege validation vulnerability in COM Interface of Gallagher Command Centre Server allows authenticated unprivileged operators to retrieve sensitive information from the Command Centre Server. This issue affects: Gallagher Com…

25. 7.2CVE-2021-35534EPSS 1.8%2021-11-18

    Insufficient security control vulnerability in internal database access mechanism of Hitachi Energy Relion 670/650/SAM600-IO, Relion 650, GMS600, PWC600 allows attacker who successfully exploited this vulnerability, of which the product do…

26. 4.3CVE-2021-37938EPSS 0.7%2021-11-18

    It was discovered that on Windows operating systems specifically, Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily traverse the Kibana host to load internal fi…

27. 8.8CVE-2021-42956EPSS 0.7%2021-11-17

    Zoho Remote Access Plus Server Windows Desktop Binary fixed in 10.1.2132.6 is affected by a sensitive information disclosure vulnerability. Due to improper privilege management, the process launches as the logged in user, so memory dump ca…

28. 7.8CVE-2021-42322EPSS 0.5%2021-11-10

    Visual Studio Code Elevation of Privilege Vulnerability

29. 4.7CVE-2021-42319EPSS 0.6%2021-11-10

    Visual Studio Elevation of Privilege Vulnerability

30. 6.6CVE-2021-42304EPSS 0.7%2021-11-10

    Azure RTOS Elevation of Privilege Vulnerability

31. 6.6CVE-2021-42303EPSS 0.9%2021-11-10

    Azure RTOS Elevation of Privilege Vulnerability

32. 6.6CVE-2021-42302EPSS 0.7%2021-11-10

    Azure RTOS Elevation of Privilege Vulnerability

33. 7.5CVE-2021-42291EPSS 4.2%2021-11-10

    Active Directory Domain Services Elevation of Privilege Vulnerability

34. 7.8CVE-2021-42286EPSS 0.5%2021-11-10

    Windows Core Shell SI Host Extension Framework for Composable Shell Elevation of Privilege Vulnerability

35. 7.8CVE-2021-42285EPSS 0.6%2021-11-10

    Windows Kernel Elevation of Privilege Vulnerability

36. 8.8CVE-2021-42283EPSS 0.5%2021-11-10

    NTFS Elevation of Privilege Vulnerability

37. 7.5CVE-2021-42282EPSS 4.1%2021-11-10

    Active Directory Domain Services Elevation of Privilege Vulnerability

38. 5.5CVE-2021-42280EPSS 1.0%2021-11-10

    Windows Feedback Hub Elevation of Privilege Vulnerability

39. 5.5CVE-2021-42277EPSS 0.9%2021-11-10

    Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability

40. 7.8CVE-2021-41377EPSS 0.5%2021-11-10

    Windows Fast FAT File System Driver Elevation of Privilege Vulnerability

41. 7.8CVE-2021-41370EPSS 0.5%2021-11-10

    NTFS Elevation of Privilege Vulnerability

42. 7.8CVE-2021-41367EPSS 0.5%2021-11-10

    NTFS Elevation of Privilege Vulnerability

43. 7.8CVE-2021-41366EPSS 0.5%2021-11-10

    Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege Vulnerability

44. 7.8CVE-2021-36957EPSS 0.5%2021-11-10

    Windows Desktop Bridge Elevation of Privilege Vulnerability

45. 7.8CVE-2019-18916EPSS 0.2%2021-11-09

    A potential security vulnerability has been identified for HP LaserJet Solution Software (for certain HP LaserJet Printers) which may lead to unauthorized elevation of privilege on the client.

46. 9.8CVE-2021-25508EPSS 0.8%2021-11-05

    Improper privilege management vulnerability in API Key used in SmartThings prior to 1.7.73.22 allows an attacker to abuse the API key without limitation.

47. 5.5CVE-2021-25502EPSS 0.07%2021-11-05

    A vulnerability of storing sensitive information insecurely in Property Settings prior to SMR Nov-2021 Release 1 allows attackers to read ESN value without priviledge.

48. 7.8CVE-2021-40124EPSS 0.2%2021-11-04

    A vulnerability in the Network Access Manager (NAM) module of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to escalate privileges on an affected device. This vulnerability is due to incor…

49. 7.8CVE-2021-41022EPSS 0.2%2021-11-02

    A improper privilege management in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows attacker to execute privileged code or commands via powershell scripts

50. 7.8CVE-2021-1118EPSS 0.4%2021-10-29

    NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where there is the potential to execute privileged operations by the guest OS, which may lead to information disclosure, data tampering, escalation of …