CWE-269: Improper Privilege Management, page 60

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

What the weakness is: CWE-269 at MITRE

1. 8.8CVE-2020-18171EPSS 0.4%2021-07-26

   TechSmith Snagit 19.1.0.2653 uses Object Linking and Embedding (OLE) which can allow attackers to obfuscate and embed crafted files used to escalate privileges. NOTE: This implies that Snagit's use of OLE is a security vulnerability unto i…

2. 7.8CVE-2020-18169EPSS 0.5%2021-07-26

   A vulnerability in the Windows installer XML (WiX) toolset of TechSmith Snagit 19.1.1.2860 allows attackers to escalate privileges. NOTE: Exploit of the Snagit installer would require the end user to ignore other safety mechanisms provided…

3. 9.8CVE-2020-14032EPSS 2.1%2021-07-23

   ASRock 4x4 BOX-R1000 before BIOS P1.40 allows privilege escalation via code execution in the SMM.

4. 4.4CVE-2021-31581ExploitEPSS 1.2%2021-07-22

   The restricted shell provided by Akkadian Provisioning Manager Engine (PME) can be escaped by abusing the 'Edit MySQL Configuration' command. This command launches a standard vi editor interface which can then be escaped. This issue was re…

5. 8.8CVE-2021-34481EPSS 48%2021-07-16

   A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. …

6. 7.8CVE-2021-34461EPSS 0.5%2021-07-16

   Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability

7. 7.8CVE-2021-34460EPSS 0.6%2021-07-16

   Windows Storage Spaces Controller Elevation of Privilege Vulnerability

8. 7.8CVE-2021-34459EPSS 0.5%2021-07-16

   Windows AppContainer Elevation Of Privilege Vulnerability

9. 7.8CVE-2021-34456EPSS 0.6%2021-07-16

   Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

10. 7.8CVE-2021-34455EPSS 0.5%2021-07-16

    Windows File History Service Elevation of Privilege Vulnerability

11. 8.8CVE-2021-32739EPSS 1.1%2021-07-15

    Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From version 2.4.0 through version 2.12.4, a vulnerability exists that may allow pri…

12. 7.8CVE-2021-33505EPSS 0.3%2021-07-15

    A local malicious user can circumvent the Falco detection engine through 0.28.1 by running a program that alters arguments of system calls being executed. Issue is fixed in Falco versions >= 0.29.1.

13. 7.8CVE-2021-34514EPSS 0.7%2021-07-14

    Windows Kernel Elevation of Privilege Vulnerability

14. 7.8CVE-2021-34511EPSS 0.6%2021-07-14

    Windows Installer Elevation of Privilege Vulnerability

15. 6.7CVE-2021-34493EPSS 0.6%2021-07-14

    Windows Partition Management Driver Elevation of Privilege Vulnerability

16. 7.8CVE-2021-34488EPSS 0.6%2021-07-14

    Windows Console Driver Elevation of Privilege Vulnerability

17. 7.8CVE-2021-34477EPSS 0.6%2021-07-14

    Visual Studio Code .NET Runtime Elevation of Privilege Vulnerability

18. 7.0CVE-2021-33751EPSS 0.8%2021-07-14

    Windows Storage Spaces Controller Elevation of Privilege Vulnerability

19. 6.1CVE-2021-31961EPSS 0.8%2021-07-14

    Windows InstallService Elevation of Privilege Vulnerability

20. 7.2CVE-2021-29792EPSS 0.5%2021-07-12

    IBM Event Streams 10.0, 10.1, 10.2, and 10.3 could allow a user the CA private key to create their own certificates and deploy them in the cluster and gain privileges of another user. IBM X-Force ID: 203450.

21. 9.8CVE-2021-35064ExploitEPSS 71%2021-07-12

    KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo. Sudoers permits running of multiple dangerous commands, including unzip, systemctl and dpkg.

22. 7.5CVE-2021-25442EPSS 0.9%2021-07-08

    Improper MDM policy management vulnerability in KME module prior to KCS version 1.39 allows MDM users to bypass Knox Manage authentication.

23. 4.3CVE-2021-25429EPSS 0.2%2021-07-08

    Improper privilege management vulnerability in Bluetooth application prior to SMR July-2021 Release 1 allows untrusted application to access the Bluetooth information in Bluetooth application.

24. 7.8CVE-2021-25428EPSS 0.1%2021-07-08

    Improper validation check vulnerability in PackageManager prior to SMR July-2021 Release 1 allows untrusted applications to get dangerous level permission without user confirmation in limited circumstances.

25. 7.8CVE-2021-21786EPSS 0.3%2021-07-07

    A privilege escalation vulnerability exists in the IOCTL 0x9c406144 handling of IOBit Advanced SystemCare Ultimate 14.2.0.220. A specially crafted I/O request packet (IRP) can lead to increased privileges. An attacker can send a malicious …

26. 8.8CVE-2021-34622ExploitEPSS 4.9%2021-07-07

    A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible for users to escalate their privileges to that of an administrator while editing…

27. 9.8CVE-2021-34621ExploitEPSS 69%2021-07-07

    A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an administrator. This issue affects versions 3…

28. 8.8CVE-2021-27661EPSS 0.8%2021-07-01

    Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user an unintended level of access to the controller’s file system, allowing them to access or modify sy…

29. 8.4CVE-2021-22376EPSS 0.2%2021-06-30

    A component of the HarmonyOS has a Improper Privilege Management vulnerability. Local attackers may exploit this vulnerability to bypass user restrictions.

30. 7.1CVE-2021-22326EPSS 0.2%2021-06-30

    A component of the HarmonyOS has a Privilege Dropping / Lowering Errors vulnerability. Local attackers may exploit this vulnerability to obtain Kernel space read/write capability.

31. 7.1CVE-2021-28692EPSS 0.3%2021-06-30

    inappropriate x86 IOMMU timeout detection / handling IOMMUs process commands issued to them in parallel with the operation of the CPU(s) issuing such commands. In the current implementation in Xen, asynchronous notification of the completi…

32. 7.8CVE-2021-35523EPSS 0.7%2021-06-28

    Securepoint SSL VPN Client v2 before 2.0.32 on Windows has unsafe configuration handling that enables local privilege escalation to NT AUTHORITY\SYSTEM. A non-privileged local user can modify the OpenVPN configuration stored under "%APPDAT…

33. 8.8CVE-2021-33538EPSS 1.0%2021-06-25

    In Weidmueller Industrial WLAN devices in multiple versions an exploitable improper access control vulnerability exists in the iw_webs account settings functionality. A specially crafted user name entry can cause the overwrite of an existi…

34. 7.8CVE-2021-35448ExploitEPSS 1.0%2021-06-24

    Emote Interactive Remote Mouse 3.008 on Windows allows attackers to execute arbitrary programs as Administrator by using the Image Transfer Folder feature to navigate to cmd.exe. It binds to local ports to listen for incoming connections.

35. 6.5CVE-2021-29951EPSS 1.9%2021-06-24

    The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. This could be used to prevent the browser update service from operati…

36. 8.8CVE-2021-23999EPSS 1.4%2021-06-24

    If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR < 78.10, …

37. 7.8CVE-2021-25651EPSS 0.5%2021-06-24

    A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to escalate privileges. Affects all 7.x versions of Avaya Aura Utility Services

38. 8.8CVE-2021-25650EPSS 0.5%2021-06-24

    A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to execute specially crafted scripts as a privileged user. Affects all 7.x versions of Avaya Aura Utility Services

39. 8.8CVE-2021-34810EPSS 1.4%2021-06-18

    Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.

40. 7.8CVE-2021-27483EPSS 0.2%2021-06-16

    ZOLL Defibrillator Dashboard, v prior to 2.2,The affected products contain insecure filesystem permissions that could allow a lower privilege user to escalate privileges to an administrative level user.

41. 7.8CVE-2021-25418EPSS 0.2%2021-06-11

    Improper component protection vulnerability in Samsung Internet prior to version 14.0.1.62 allows untrusted applications to execute arbitrary activity in specific condition.

42. 8.8CVE-2021-28814EPSS 1.2%2021-06-11

    An improper access control vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows remote attackers to compromise the security of the software. This issue affects: QNAP Systems Inc. Helpdesk versions pri…

43. 3.3CVE-2021-31839EPSS 0.2%2021-06-10

    Improper privilege management vulnerability in McAfee Agent for Windows prior to 5.7.3 allows a local user to modify event information in the MA event folder. This allows a local user to either add false events or remove events from the ev…

44. 7.8CVE-2021-0052EPSS 0.2%2021-06-09

    Incorrect default privileges in the Intel(R) Computing Improvement Program before version 2.4.6522 may allow an authenticated user to potentially enable an escalation of privilege via local access.

45. 8.8CVE-2021-33356EPSS 5.3%2021-06-09

    Multiple privilege escalation vulnerabilities in RaspAP 1.5 to 2.6.5 could allow an authenticated remote attacker to inject arbitrary commands to /installers/common.sh component that can result in remote command execution with root privile…

46. 7.8CVE-2021-31969EPSS 1.2%2021-06-08

    Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

47. 7.8CVE-2021-31954EPSS 1.1%2021-06-08

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

48. 8.8CVE-2021-27657EPSS 1.2%2021-06-04

    Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify system files by sending specifically crafted web messages to …

49. 7.8CVE-2013-4536EPSS 0.3%2021-05-28

    An user able to alter the savevm data (either on the disk or over the wire during migration) could use this flaw to to corrupt QEMU process memory on the (destination) host, which could potentially result in arbitrary code execution on the…

50. 7.8CVE-2021-22118EPSS 0.4%2021-05-27

    In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user c…