CWE-269: Improper Privilege Management, page 58

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

What the weakness is: CWE-269 at MITRE

1. 7.8CVE-2021-3576EPSS 0.9%2021-10-28

   Execution with Unnecessary Privileges vulnerability in Bitdefender Endpoint Security Tools, Total Security allows a local attacker to elevate to 'NT AUTHORITY\System. Impersonation enables the server thread to perform actions on behalf of …

2. 7.8CVE-2021-23877EPSS 0.4%2021-10-26

   Privilege escalation vulnerability in the Windows trial installer of McAfee Total Protection (MTP) prior to 16.0.34_x may allow a local user to run arbitrary code as the admin user by replacing a specific temporary file created during the …

3. 7.8CVE-2021-42108EPSS 0.4%2021-10-21

   Unnecessary privilege vulnerabilities in the Web Console of Trend Micro Apex One, Apex One as a Service and Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected installations. Please note: a…

4. 7.8CVE-2021-42107EPSS 0.4%2021-10-21

   Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services could allow a local attacker to escalate privileges on affected installat…

5. 7.8CVE-2021-42106EPSS 0.4%2021-10-21

   Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services could allow a local attacker to escalate privileges on affected installat…

6. 7.8CVE-2021-42105EPSS 0.4%2021-10-21

   Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services could allow a local attacker to escalate privileges on affected installat…

7. 7.8CVE-2021-42104EPSS 0.4%2021-10-21

   Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services could allow a local attacker to escalate privileges on affected installat…

8. 7.1CVE-2021-31360EPSS 0.2%2021-10-19

   An improper privilege management vulnerability in the Juniper Networks Junos OS and Junos OS Evolved command-line interpreter (CLI) allows a low-privileged user to overwrite local files as root, possibly leading to a system integrity issue…

9. 7.8CVE-2021-31359EPSS 0.2%2021-10-19

   A local privilege escalation vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged user to cause the Juniper DHCP daemon (jdhcpd) process to crash, resulting in a Denial of Service (DoS), or execute…

10. 8.8CVE-2021-31350EPSS 0.9%2021-10-19

    An Improper Privilege Management vulnerability in the gRPC framework, used by the Juniper Extension Toolkit (JET) API on Juniper Networks Junos OS and Junos OS Evolved, allows a network-based, low-privileged authenticated attacker to perfo…

11. 7.8CVE-2021-40854EPSS 0.2%2021-10-14

    AnyDesk before 6.2.6 and 6.3.x before 6.3.3 allows a local user to obtain administrator privileges by using the Open Chat Log feature to launch a privileged Notepad process that can launch other applications.

12. 8.0CVE-2021-41348EPSS 0.6%2021-10-13

    Microsoft Exchange Server Elevation of Privilege Vulnerability

13. 7.8CVE-2021-41347EPSS 0.7%2021-10-13

    Windows AppX Deployment Service Elevation of Privilege Vulnerability

14. 7.8CVE-2021-41345EPSS 0.8%2021-10-13

    Storage Spaces Controller Elevation of Privilege Vulnerability

15. 4.7CVE-2021-41339EPSS 0.5%2021-10-13

    Microsoft DWM Core Library Elevation of Privilege Vulnerability

16. 7.8CVE-2021-41335EPSS 1.4%2021-10-13

    Windows Kernel Elevation of Privilege Vulnerability

17. 7.0CVE-2021-41334EPSS 0.4%2021-10-13

    Windows Desktop Bridge Elevation of Privilege Vulnerability

18. 7.8CVE-2021-40489EPSS 0.8%2021-10-13

    Storage Spaces Controller Elevation of Privilege Vulnerability

19. 7.8CVE-2021-40488EPSS 1.0%2021-10-13

    Storage Spaces Controller Elevation of Privilege Vulnerability

20. 7.8CVE-2021-40478EPSS 0.8%2021-10-13

    Storage Spaces Controller Elevation of Privilege Vulnerability

21. 7.8CVE-2021-40477EPSS 0.6%2021-10-13

    Windows Event Tracing Elevation of Privilege Vulnerability

22. 7.8CVE-2021-40470EPSS 0.7%2021-10-13

    DirectX Graphics Kernel Elevation of Privilege Vulnerability

23. 7.8CVE-2021-40467EPSS 0.5%2021-10-13

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

24. 7.8CVE-2021-40466EPSS 0.7%2021-10-13

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

25. 8.0CVE-2021-40464EPSS 0.6%2021-10-13

    Windows Nearby Sharing Elevation of Privilege Vulnerability

26. 7.8CVE-2021-40443EPSS 0.7%2021-10-13

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

27. 7.8CVE-2021-26441EPSS 0.9%2021-10-13

    Storage Spaces Controller Elevation of Privilege Vulnerability

28. 6.5CVE-2021-22263EPSS 1.1%2021-10-11

    An issue has been discovered in GitLab affecting all versions starting from 13.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. A user account with 'external' status which is gr…

29. 9.8CVE-2021-27664EPSS 1.6%2021-10-11

    Under certain configurations an unauthenticated remote user could be given access to credentials stored in the exacqVision Server.

30. 8.1CVE-2021-42135EPSS 0.8%2021-10-11

    HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have more privileges than intended, e.g., a user …

31. 8.8CVE-2021-34766EPSS 1.0%2021-10-06

    A vulnerability in the web UI of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges and create, read, update, or delete records and settings in multiple functions. This vu…

32. 6.7CVE-2021-0691EPSS 0.1%2021-10-06

    In the SELinux policy configured in system_app.te, there is a possible way for system_app to gain code execution in other processes due to an overly-permissive SELinux policy. This could lead to local escalation of privilege with System ex…

33. 7.6CVE-2021-28702EPSS 0.4%2021-10-06

    PCI devices with RMRRs not deassigned correctly Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR"). These are typically used for platform tasks such as legacy …

34. 7.8CVE-2021-23893EPSS 0.1%2021-10-01

    Privilege Escalation vulnerability in a Windows system driver of McAfee Drive Encryption (DE) prior to 7.3.0 could allow a local non-admin user to gain elevated system privileges via exploiting an unutilized memory buffer.

35. 7.8CVE-2021-34412EPSS 0.4%2021-09-27

    During the installation process for all versions of the Zoom Client for Meetings for Windows before 5.4.0, it is possible to launch Internet Explorer. If the installer was launched with elevated privileges such as by SCCM this can result i…

36. 7.8CVE-2021-34411EPSS 0.2%2021-09-27

    During the installation process forZoom Rooms for Conference Room for Windows before version 5.3.0 it is possible to launch Internet Explorer with elevated privileges. If the installer was launched with elevated privileges such as by SCCM …

37. 7.8CVE-2021-31847EPSS 0.4%2021-09-22

    Improper access control vulnerability in the repair process for McAfee Agent for Windows prior to 5.7.4 could allow a local attacker to perform a DLL preloading attack using unsigned DLLs. This would result in elevation of privileges and t…

38. 7.1CVE-2021-31836EPSS 0.2%2021-09-22

    Improper privilege management vulnerability in maconfig for McAfee Agent for Windows prior to 5.7.4 allows a local user to gain access to sensitive information. The utility was able to be run from any location on the file system and by a l…

39. 6.1CVE-2021-33697EPSS 0.6%2021-09-15

    Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions - 420, 430, can allow an unauthenticated attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities.

40. 7.8CVE-2021-40447EPSS 0.7%2021-09-15

    Windows Print Spooler Elevation of Privilege Vulnerability

41. 7.8CVE-2021-38671EPSS 0.6%2021-09-15

    Windows Print Spooler Elevation of Privilege Vulnerability

42. 7.8CVE-2021-38667EPSS 0.6%2021-09-15

    Windows Print Spooler Elevation of Privilege Vulnerability

43. 7.8CVE-2021-38639EPSS 1.4%2021-09-15

    Win32k Elevation of Privilege Vulnerability

44. 7.8CVE-2021-38638EPSS 0.5%2021-09-15

    Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

45. 7.1CVE-2021-38634EPSS 0.9%2021-09-15

    Microsoft Windows Update Client Elevation of Privilege Vulnerability

46. 7.8CVE-2021-38633EPSS 1.0%2021-09-15

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

47. 7.8CVE-2021-38630EPSS 0.5%2021-09-15

    Windows Event Tracing Elevation of Privilege Vulnerability

48. 7.8CVE-2021-38628EPSS 0.5%2021-09-15

    Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

49. 7.8CVE-2021-38626EPSS 0.5%2021-09-15

    Windows Kernel Elevation of Privilege Vulnerability

50. 7.8CVE-2021-38625EPSS 0.5%2021-09-15

    Windows Kernel Elevation of Privilege Vulnerability