CWE-269: Improper Privilege Management, page 59

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

What the weakness is: CWE-269 at MITRE

1. 7.8CVE-2021-36975EPSS 1.3%2021-09-15

   Win32k Elevation of Privilege Vulnerability

2. 7.8CVE-2021-36974EPSS 0.5%2021-09-15

   Windows SMB Elevation of Privilege Vulnerability

3. 7.8CVE-2021-36973EPSS 0.5%2021-09-15

   Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability

4. 7.8CVE-2021-36968EPSS 0.5%2021-09-15

   Windows DNS Elevation of Privilege Vulnerability

5. 8.0CVE-2021-36967EPSS 0.9%2021-09-15

   Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability

6. 7.8CVE-2021-36966EPSS 0.5%2021-09-15

   Windows Subsystem for Linux Elevation of Privilege Vulnerability

7. 7.8CVE-2021-36964EPSS 0.5%2021-09-15

   Windows Event Tracing Elevation of Privilege Vulnerability

8. 7.8CVE-2021-36963EPSS 1.2%2021-09-15

   Windows Common Log File System Driver Elevation of Privilege Vulnerability

9. 8.8CVE-2021-36954EPSS 0.5%2021-09-15

   Windows Bind Filter Driver Elevation of Privilege Vulnerability

10. 7.1CVE-2021-40354EPSS 0.6%2021-09-14

    A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions < V13.1.0.5), Teamcenter V13.2 (All versions < 13.2.0.2). The "surrogate" funct…

11. 8.8CVE-2021-37173EPSS 1.6%2021-09-14

    A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All versions < V2.14.1), RUGGEDCOM ROX RX1501 (All versions < V2.14.1), RUGGEDCOM RO…

12. 9.8CVE-2021-38540ExploitEPSS 81%2021-09-09

    The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service…

13. 7.8CVE-2021-1868EPSS 0.3%2021-09-08

    A logic issue was addressed with improved state management. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. A local attacker m…

14. 7.8CVE-2021-1853EPSS 0.3%2021-09-08

    A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3. A local attacker may be able to elevate their privileges.

15. 8.8CVE-2021-1851EPSS 2.2%2021-09-08

    A logic issue was addressed with improved state management. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. An application may…

16. 7.8CVE-2021-1839EPSS 0.3%2021-09-08

    The issue was addressed with improved permissions logic. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina, Security Update 2021-003 Mojave. A local attacker may be able to elevate their privileges.

17. 5.5CVE-2021-1836EPSS 0.3%2021-09-08

    A logic issue was addressed with improved restrictions. This issue is fixed in iOS 14.5 and iPadOS 14.5, tvOS 14.5. A local user may be able to create or modify privileged files.

18. 7.8CVE-2021-1813EPSS 1.1%2021-09-08

    A validation issue was addressed with improved logic. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. A malicious application …

19. 9.8CVE-2021-35946EPSS 1.5%2021-09-07

    A receiver of a federated share with access to the database with ownCloud version before 10.8 could update the permissions and therefore elevate their own permissions.

20. 7.2CVE-2021-39192EPSS 1.0%2021-09-03

    Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.0 and 4.9.4 allows all authenticated users (including contributors) to view admin-level API keys via the integrations A…

21. 5.3CVE-2021-36930EPSS 1.1%2021-09-02

    Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

22. 8.6CVE-2021-30355EPSS 6.9%2021-09-01

    Amazon Kindle e-reader prior to and including version 5.13.4 improperly manages privileges, allowing the framework user to elevate privileges to root.

23. 8.8CVE-2021-37911EPSS 0.6%2021-08-30

    The management interface of BenQ smart wireless conference projector does not properly control user's privilege. Attackers can access any system directory of this device through the interface and execute arbitrary commands if he enters the…

24. 9.8CVE-2021-39168EPSS 1.6%2021-08-27

    OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed a…

25. 9.8CVE-2021-39167EPSS 1.6%2021-08-27

    OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed a…

26. 4.4CVE-2021-36931EPSS 1.3%2021-08-26

    Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

27. 8.8CVE-2021-1579EPSS 2.1%2021-08-25

    A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an authenticated, remote attacker with Administrator read…

28. 7.5CVE-2021-29802EPSS 0.6%2021-08-23

    IBM Security SOAR performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

29. 8.8CVE-2021-24602EPSS 1.5%2021-08-23

    The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile page

30. 7.8CVE-2021-24038EPSS 0.2%2021-08-19

    Due to a bug with management of handles in OVRServiceLauncher.exe, an attacker could expose a privileged process handle to an unprivileged process, leading to local privilege escalation. This issue affects Oculus Desktop versions after 1.3…

31. 7.8CVE-2021-34745EPSS 0.2%2021-08-18

    A vulnerability in the AppDynamics .NET Agent for Windows could allow an attacker to leverage an authenticated, local user account to gain SYSTEM privileges. This vulnerability is due to the .NET Agent Coordinator Service executing code wi…

32. 7.8CVE-2021-37345EPSS 0.6%2021-08-13

    Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because xi-sys.cfg is being imported from the var directory for some scripts with elevated permissions.

33. 7.3CVE-2021-36945EPSS 1.9%2021-08-12

    Windows 10 Update Assistant Elevation of Privilege Vulnerability

34. 4.0CVE-2021-36943EPSS 0.8%2021-08-12

    Azure CycleCloud Elevation of Privilege Vulnerability

35. 7.8CVE-2021-36927EPSS 0.5%2021-08-12

    Windows Digital TV Tuner device registration application Elevation of Privilege Vulnerability

36. 7.8CVE-2021-34537EPSS 0.5%2021-08-12

    Windows Bluetooth Driver Elevation of Privilege Vulnerability

37. 7.0CVE-2021-34487EPSS 0.6%2021-08-12

    Windows Event Tracing Elevation of Privilege Vulnerability

38. 7.8CVE-2021-34483EPSS 1.1%2021-08-12

    Windows Print Spooler Elevation of Privilege Vulnerability

39. 7.8CVE-2021-34471EPSS 0.5%2021-08-12

    Microsoft Defender Elevation of Privilege Vulnerability

40. 8.8CVE-2020-24576EPSS 2.2%2021-08-12

    Netskope Client through 77 allows low-privileged users to elevate their privileges to NT AUTHORITY\SYSTEM.

41. 7.2CVE-2021-37627EPSS 1.0%2021-08-11

    Contao is an open source CMS that allows creation of websites and scalable web applications. In affected versions it is possible to gain privileged rights in the Contao back end. Installations are only affected if they have untrusted back …

42. 7.8CVE-2021-21567EPSS 0.2%2021-08-10

    Dell PowerScale OneFS 9.1.0.x contains an improper privilege management vulnerability. It may allow an authenticated user with ISI_PRIV_LOGIN_SSH and/or ISI_PRIV_LOGIN_CONSOLE to elevate privilege.

43. 9.8CVE-2021-38140EPSS 1.3%2021-08-10

    The set_user extension module before 2.0.1 for PostgreSQL allows a potential privilege escalation using RESET SESSION AUTHORIZATION after set_user().

44. 7.8CVE-2021-1572EPSS 0.2%2021-08-04

    A vulnerability in ConfD could allow an authenticated, local attacker to execute arbitrary commands at the level of the account under which ConfD is running, which is commonly root. To exploit this vulnerability, an attacker must have a va…

45. 7.8CVE-2021-22421EPSS 0.2%2021-08-03

    A component of the HarmonyOS has a Improper Privilege Management vulnerability. Local attackers may exploit this vulnerability to cause further Elevation of Privileges.

46. 8.8CVE-2019-14453EPSS 1.2%2021-08-03

    An issue was discovered in Comelit "App lejos de casa (web)" 2.8.0. It allows privilege escalation via modified domus and logged fields, related to js/bridge.min.js and login.json. For example, an attacker can achieve high privileges (inst…

47. 7.8CVE-2021-22396EPSS 0.1%2021-08-02

    There is a privilege escalation vulnerability in some Huawei products. Due to improper privilege management, a local attacker with common privilege may access some specific files in the affected products. Successful exploit will cause priv…

48. 9.8CVE-2021-37167EPSS 1.7%2021-08-02

    An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. A user logged in using the default credentials can gain root acc…

49. 7.8CVE-2021-33526EPSS 0.3%2021-08-02

    In MB connect line mbDIALUP versions <= 3.9R0.0 a low privileged local attacker can send a command to the service running with NT AUTHORITY\SYSTEM instructing it to execute a malicous OpenVPN configuration resulting in arbitrary code execu…

50. 8.8CVE-2021-34802EPSS 1.0%2021-07-30

    A failure in resetting the security context in some transaction actions in Neo4j Graph Database 4.2 and 4.3 could allow authenticated users to execute commands with elevated privileges.