CWE-269— Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.— MITRE CWE catalog
5,404 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-269page 49 of 109
- CVE-2021-39808HIGHCVSS 7.8EG 7.82022-04-12
In createNotificationChannelGroup of PreferencesHelper.java, there is a possible way for a service to run in foreground without user notification due to improper input validation. This could lead to local escalation of privilege with no ad…
- CVE-2021-39807HIGHCVSS 7.8EG 7.82022-04-12
In handleNfcStateChanged of SecureNfcEnabler.java, there is a possible way to enable NFC from the Guest account due to a missing permission check. This could lead to local escalation of privilege from the Guest account with no additional e…
- CVE-2021-39802HIGHCVSS 7.8EG 7.82022-04-12
In change_pte_range of mprotect.c , there is a possible way to make a shared mmap writable due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is no…
- CVE-2021-39799HIGHCVSS 7.8EG 7.82022-04-12
In AttributionSource of AttributionSource.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is no…
- CVE-2021-39797HIGHCVSS 7.8EG 7.82022-04-12
In several functions of of LauncherApps.java, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction i…
- CVE-2021-42029HIGHCVSS 7.8EG 7.82022-04-12
A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) V15 (All versions), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 5), SIMATIC STEP 7 (TIA Portal) V17 (All versions < V17 Update 2). An attacker could achieve …
- CVE-2021-39784HIGHCVSS 7.8EG 7.82022-03-30
In CellBroadcastReceiver, there is a possible path to enable specific cellular features due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is…
- CVE-2021-39783HIGHCVSS 7.8EG 7.82022-03-30
In rcsservice, there is a possible way to modify TTY mode due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.P…
- CVE-2021-39782HIGHCVSS 7.8EG 7.82022-03-30
In Telephony, there is a possible unauthorized modification of the PLMN SIM file due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not ne…
- CVE-2021-39781HIGHCVSS 7.8EG 7.82022-03-30
In SmsController, there is a possible information disclosure due to a permissions bypass. This could lead to local escalation of privilege and sending sms with no additional execution privileges needed. User interaction is not needed for e…
- CVE-2021-39752HIGHCVSS 7.8EG 7.82022-03-30
In Bubbles, there is a possible way to interfere with Bubbles due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Pro…
- CVE-2021-39746HIGHCVSS 7.8EG 7.82022-03-30
In PermissionController, there is a possible way to delete some local files due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploita…
- CVE-2022-22665HIGHCVSS 7.8EG 7.82022-03-18
A logic issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.3. A malicious application may be able to gain root privileges.
- CVE-2022-22639HIGHCVSS 7.8EG 7.82022-03-18
A logic issue was addressed with improved state management. This issue is fixed in iOS 15.4 and iPadOS 15.4, macOS Monterey 12.3. An application may be able to gain elevated privileges.
- CVE-2022-22617HIGHCVSS 7.8EG 7.82022-03-18
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.6.5, macOS Monterey 12.3, Security Update 2022-003 Catalina. An application may be able to gain elevated privileges.
- CVE-2022-22578HIGHCVSS 7.8EG 7.82022-03-18
A logic issue was addressed with improved validation. This issue is fixed in tvOS 15.3, iOS 15.3 and iPadOS 15.3, watchOS 8.4, macOS Monterey 12.2. A malicious application may be able to gain root privileges.
- CVE-2021-39693HIGHCVSS 7.8EG 7.82022-03-16
In onUidStateChanged of AppOpsService.java, there is a possible way to access location without a visible indicator due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges n…
- CVE-2021-0957HIGHCVSS 7.8EG 7.82022-03-16
In NotificationStackScrollLayout of NotificationStackScrollLayout.java, there is a possible way to bypass Factory Reset Protections. This could lead to local escalation of privilege with no additional execution privileges needed. User inte…
- CVE-2022-22141HIGHCVSS 7.8EG 7.82022-03-11
'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL configuration. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 t…
- CVE-2022-20053HIGHCVSS 7.8EG 7.82022-03-10
In ims service, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation…
- CVE-2022-24459HIGHCVSS 7.8EG 7.82022-03-09
Windows Fax and Scan Service Elevation of Privilege Vulnerability
- CVE-2022-24455HIGHCVSS 7.8EG 7.82022-03-09
Windows CD-ROM Driver Elevation of Privilege Vulnerability
- CVE-2022-24454HIGHCVSS 7.8EG 7.82022-03-09
Windows Security Support Provider Interface Elevation of Privilege Vulnerability
- CVE-2022-23299HIGHCVSS 7.8EG 7.82022-03-09
Windows PDEV Elevation of Privilege Vulnerability
- CVE-2022-23296HIGHCVSS 7.8EG 7.82022-03-09
Windows Installer Elevation of Privilege Vulnerability
- CVE-2022-23293HIGHCVSS 7.8EG 7.82022-03-09
Windows Fast FAT File System Driver Elevation of Privilege Vulnerability
- CVE-2022-23291HIGHCVSS 7.8EG 7.82022-03-09
Windows DWM Core Library Elevation of Privilege Vulnerability
- CVE-2022-23290HIGHCVSS 7.8EG 7.82022-03-09
Windows Inking COM Elevation of Privilege Vulnerability
- CVE-2022-23266HIGHCVSS 7.8EG 7.82022-03-09
Microsoft Defender for IoT Elevation of Privilege Vulnerability
- CVE-2022-24408HIGHCVSS 7.8EG 7.82022-03-08
A vulnerability has been identified in SINUMERIK MC (All versions < V1.15 SP1), SINUMERIK ONE (All versions < V6.15 SP1). The sc SUID binary on affected devices provides several commands that are used to execute system commands or modify s…
- CVE-2022-25623HIGHCVSS 7.8EG 7.82022-03-04
The Symantec Management Agent is susceptible to a privilege escalation vulnerability. A low privilege local account can be elevated to the SYSTEM level through registry manipulations.
- CVE-2022-25636HIGHCVSS 7.8EG 7.82022-02-24
net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds write. This is related to nf_tables_offload.
- CVE-2022-25372HIGHCVSS 7.8EG 7.82022-02-20
Pritunl Client through 1.2.3019.52 on Windows allows local privilege escalation, related to an ACL entry for CREATOR OWNER in platform_windows.go.
- CVE-2021-4106HIGHCVSS 7.8EG 7.82022-02-16
A vulnerability in Snow Inventory Java Scanner allows an attacker to run malicious code at a higher level of privileges. This issue affects: SNOW Snow Inventory Java Scanner 1.0
- CVE-2020-6922HIGHCVSS 7.8EG 7.82022-02-16
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
- CVE-2022-25150HIGHCVSS 7.8EG 7.82022-02-14
In Malwarebytes Binisoft Windows Firewall Control before 6.8.1.0, programs executed from the Tools tab can be used to escalate privileges.
- CVE-2021-39619HIGHCVSS 7.8EG 7.82022-02-11
In updatePackageMappingsData of UsageStatsService.java, there is a possible way to bypass security and privacy settings of app usage due to an unusual root cause. This could lead to local escalation of privilege with no additional executio…
- CVE-2021-0099HIGHCVSS 7.8EG 7.82022-02-09
Insufficient control flow management in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable an escalation of privilege via local access.
- CVE-2021-0091HIGHCVSS 7.8EG 7.82022-02-09
Improper access control in the firmware for some Intel(R) Processors may allow an unauthenticated user to potentially enable an escalation of privilege via local access.
- CVE-2022-23276HIGHCVSS 7.8EG 7.82022-02-09
SQL Server for Linux Containers Elevation of Privilege Vulnerability
- CVE-2022-22715HIGHCVSS 7.8EG 7.82022-02-09
Named Pipe File System Elevation of Privilege Vulnerability
- CVE-2022-22001HIGHCVSS 7.8EG 7.82022-02-09
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
- CVE-2022-22000HIGHCVSS 7.8EG 7.82022-02-09
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- CVE-2022-21996HIGHCVSS 7.8EG 7.82022-02-09
Win32k Elevation of Privilege Vulnerability
- CVE-2022-21994HIGHCVSS 7.8EG 7.82022-02-09
Windows DWM Core Library Elevation of Privilege Vulnerability
- CVE-2022-21989HIGHCVSS 7.8EG 7.82022-02-09
Windows Kernel Elevation of Privilege Vulnerability
- CVE-2022-21981HIGHCVSS 7.8EG 7.82022-02-09
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- CVE-2021-37852HIGHCVSS 7.8EG 7.82022-02-09
ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the context of NT AUTHORITY\SYSTEM.
- CVE-2021-44903HIGHCVSS 7.8EG 7.82022-02-04
Micro-Star International (MSI) Center Pro <= 2.0.16.0 is vulnerable to multiple Privilege Escalation (LPE/EoP) vulnerabilities in the atidgllk.sys, atillk64.sys, MODAPI.sys, NTIOLib.sys, NTIOLib_X64.sys, WinRing0.sys, WinRing0x64.sys drive…
- CVE-2021-44901HIGHCVSS 7.8EG 7.82022-02-04
Micro-Star International (MSI) Dragon Center <= 2.0.116.0 is vulnerable to multiple Privilege Escalation (LPE/EoP) vulnerabilities in the atidgllk.sys, atillk64.sys, MODAPI.sys, NTIOLib.sys, NTIOLib_X64.sys, WinRing0.sys, WinRing0x64.sys d…
Map vulnerabilities like CWE-269 to your infrastructure
EchelonGraph correlates every CVE — across CWE-269 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →