cve.bz

CWE-269: Improper Privilege Management, page 63

Filter

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

What the weakness is: CWE-269 at MITRE

Ask an AI about CWE-269

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-269: Improper Privilege Management and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/269.html and https://cve.bz/cve/cwe/269?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.0CVE-2021-1712EPSS 2.4%

    Microsoft SharePoint Elevation of Privilege Vulnerability

  2. 7.0CVE-2021-1709EPSS 0.8%

    Windows Win32k Elevation of Privilege Vulnerability

  3. 7.3CVE-2021-1706EPSS 2.2%

    Windows LUAFV Elevation of Privilege Vulnerability

  4. 7.3CVE-2021-1704EPSS 1.0%

    Windows Hyper-V Elevation of Privilege Vulnerability

  5. 7.8CVE-2021-1703EPSS 0.8%

    Windows Event Logging Service Elevation of Privilege Vulnerability

  6. 7.8CVE-2021-1702EPSS 0.8%

    Windows Remote Procedure Call Runtime Elevation of Privilege Vulnerability

  7. 7.8CVE-2021-1697EPSS 0.8%

    Windows InstallService Elevation of Privilege Vulnerability

  8. 7.8CVE-2021-1695EPSS 0.9%

    Windows Print Spooler Elevation of Privilege Vulnerability

  9. 7.5CVE-2021-1694EPSS 3.5%

    Windows Update Stack Elevation of Privilege Vulnerability

  10. 7.8CVE-2021-1693EPSS 0.8%

    Windows CSC Service Elevation of Privilege Vulnerability

  11. 7.8CVE-2021-1690EPSS 0.7%

    Windows WalletService Elevation of Privilege Vulnerability

  12. 7.8CVE-2021-1689EPSS 0.7%

    Windows Multipoint Management Elevation of Privilege Vulnerability

  13. 7.8CVE-2021-1688EPSS 0.7%

    Windows CSC Service Elevation of Privilege Vulnerability

  14. 7.8CVE-2021-1687EPSS 0.7%

    Windows WalletService Elevation of Privilege Vulnerability

  15. 7.8CVE-2021-1686EPSS 0.7%

    Windows WalletService Elevation of Privilege Vulnerability

  16. 7.3CVE-2021-1685EPSS 0.9%

    Windows AppX Deployment Extensions Elevation of Privilege Vulnerability

  17. 7.0CVE-2021-1682EPSS 0.7%

    Windows Kernel Elevation of Privilege Vulnerability

  18. 7.8CVE-2021-1681EPSS 0.7%

    Windows WalletService Elevation of Privilege Vulnerability

  19. 7.8CVE-2021-1680EPSS 0.7%

    Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability

  20. 7.8CVE-2021-1662EPSS 0.7%

    Windows Event Tracing Elevation of Privilege Vulnerability

  21. 7.8CVE-2021-1659EPSS 0.7%

    Windows CSC Service Elevation of Privilege Vulnerability

  22. 7.8CVE-2021-1657EPSS 1.0%

    Windows Fax Compose Form Remote Code Execution Vulnerability

  23. 7.8CVE-2021-1655EPSS 0.8%

    Windows CSC Service Elevation of Privilege Vulnerability

  24. 7.8CVE-2021-1654EPSS 0.8%

    Windows CSC Service Elevation of Privilege Vulnerability

  25. 7.8CVE-2021-1653EPSS 0.8%

    Windows CSC Service Elevation of Privilege Vulnerability

  26. 7.8CVE-2021-1652EPSS 0.8%

    Windows CSC Service Elevation of Privilege Vulnerability

  27. 7.8CVE-2021-1651EPSS 0.8%

    Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability

  28. 7.8CVE-2021-1650EPSS 0.8%

    Windows Runtime C++ Template Library Elevation of Privilege Vulnerability

  29. 7.8CVE-2021-1649EPSS 0.8%

    Active Template Library Elevation of Privilege Vulnerability

  30. 7.8CVE-2021-1648EPSS 1.2%

    Microsoft splwow64 Elevation of Privilege Vulnerability

  31. 6.6CVE-2021-1646EPSS 0.8%

    Windows WLAN Service Elevation of Privilege Vulnerability

  32. 7.8CVE-2021-1642EPSS 0.8%

    Windows AppX Deployment Extensions Elevation of Privilege Vulnerability

  33. 7.8CVE-2021-0306EPSS 0.3%

    In addAllPermissions of PermissionManagerService.java, there is a possible permissions bypass when upgrading major Android versions which allows an app to gain the android.permission.ACTIVITY_RECOGNITION permission without user confirmatio…

  34. 7.8CVE-2018-9333EPSS 0.4%

    K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affected by: Buffer Overflow. The impact is: execute arbitrary code (local). The component is: K7TSMngr.exe.

  35. 7.8CVE-2018-9332EPSS 0.3%

    K7Computing Pvt Ltd K7AntiVirus Premium 15.01.00.53 is affected by: Incorrect Access Control. The impact is: gain privileges (local).

  36. 7.8CVE-2018-8724EPSS 0.3%

    K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affected by: Incorrect Access Control. The impact is: gain privileges (local). The component is: K7TSMngr.exe.

  37. 7.8CVE-2018-8044EPSS 0.3%

    K7Computing Pvt Ltd K7Antivirus Premium 15.1.0.53 is affected by: Incorrect Access Control. The impact is: Local Process Execution (local). The component is: K7Sentry.sys.

  38. 5.5CVE-2018-11008EPSS 0.7%

    An Incorrect Access Control issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53.

  39. 5.5CVE-2018-11006EPSS 0.7%

    An Incorrect Access Control issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53.

  40. 8.4CVE-2021-1051EPSS 0.3%

    NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which a local user can get elevated privileges to modify display configuration data, which may result in de…

  41. 4.3CVE-2020-8275EPSS 2.0%

    Citrix Secure Mail for Android before 20.11.0 suffers from improper access control allowing unauthenticated access to read limited calendar related data stored within Secure Mail. Note that a malicious app would need to be installed on the…

  42. 7.8CVE-2020-26181EPSS 0.3%

    Dell EMC Isilon OneFS versions 8.1 and later and Dell EMC PowerScale OneFS version 9.0.0 contain a privilege escalation vulnerability on a SmartLock Compliance mode cluster. The compadmin user connecting using ISI PRIV LOGIN SSH or ISI PRI…

  43. 8.8CVE-2020-36156EPSS 2.1%

    An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update. Any user with wp-admin access to the profile.php page could supply the parameter um-role with a v…

  44. 9.8CVE-2020-36155ExploitEPSS 9.8%

    An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. An attacker could supply an array parameter for sensitive metadata, such as the wp_capabilities user…

  45. 7.8CVE-2020-8290EPSS 0.6%

    Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in `bztransmit` helper due to lack of permission handling and validation before creation of client update directories allowing for loc…

  46. 8.8CVE-2020-25194EPSS 1.4%

    The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has improper privilege management, which may allow an attacker with user privileges to perform requests with administrative privileges.

  47. 8.8CVE-2020-24678EPSS 1.5%

    An authenticated user might execute malicious code under the user context and take control of the system. S+ Operations or S+ Historian database is affected by multiple vulnerabilities such as the possibility to allow remote authenticated …

  48. 7.8CVE-2020-25106EPSS 1.5%

    Nanosystems SupRemo 4.1.3.2348 allows attackers to obtain LocalSystem access because File Manager can be used to rename Supremo.exe and then upload a Trojan horse with the Supremo.exe filename.

  49. 8.8CVE-2020-13519EPSS 0.6%

    A privilege escalation vulnerability exists in the WinRing0x64 Driver IRP 0x9c402088 functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (IRP) can cause increased privileges. An attacker can send a malicious IRP to trig…

  50. 8.8CVE-2020-13515EPSS 0.5%

    A privilege escalation vulnerability exists in the WinRing0x64 Driver IRP 0x9c40a148 functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (IRP) can cause an adversary to obtain elevated privileges. An attacker can send a…