CWE-269— Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.— MITRE CWE catalog
5,404 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-269page 50 of 109
- CVE-2021-44900HIGHCVSS 7.8EG 7.82022-02-04
Micro-Star International (MSI) App Player <= 4.280.1.6309 is vulnerable to multiple Privilege Escalation (LPE/EoP) vulnerabilities in the NTIOLib_X64.sys and BstkDrv_msi2.sys drivers components. All the vulnerabilities are triggered by sen…
- CVE-2021-44899HIGHCVSS 7.8EG 7.82022-02-04
Micro-Star International (MSI) Center <= 1.0.31.0 is vulnerable to multiple Privilege Escalation vulnerabilities in the atidgllk.sys, atillk64.sys, MODAPI.sys, NTIOLib.sys, NTIOLib_X64.sys, WinRing0.sys, WinRing0x64.sys drivers components.…
- CVE-2022-23727HIGHCVSS 7.8EG 7.82022-01-28
There is a privilege escalation vulnerability in some webOS TVs. Due to wrong setting environments, local attacker is able to perform specific operation to exploit this vulnerability. Exploitation may cause the attacker to obtain a higher …
- CVE-2021-36339HIGHCVSS 7.8EG 7.82022-01-21
The Dell EMC Virtual Appliances before 9.2.2.2 contain undocumented user accounts. A local malicious user may potentially exploit this vulnerability to get privileged access to the virtual appliance.
- CVE-2022-0166HIGHCVSS 7.8EG 7.82022-01-19
A privilege escalation vulnerability in the McAfee Agent prior to 5.7.5. McAfee Agent uses openssl.cnf during the build process to specify the OPENSSLDIR variable as a subdirectory within the installation directory. A low privilege user co…
- CVE-2021-44049HIGHCVSS 7.8EG 7.82022-01-15
CyberArk Endpoint Privilege Manager (EPM) through 11.5.3.328 before 2021-12-20 allows a local user to gain elevated privileges via a Trojan horse Procmon64.exe in the user's Temp directory.
- CVE-2021-44828HIGHCVSS 7.8EG 7.82022-01-14
Arm Mali GPU Kernel Driver (Midgard r26p0 through r30p0, Bifrost r0p0 through r34p0, and Valhall r19p0 through r34p0) allows a non-privileged user to achieve write access to read-only memory, and possibly obtain root privileges, corrupt me…
- CVE-2021-39684HIGHCVSS 7.8EG 7.82022-01-14
In target_init of gs101/abl/target/slider/target.c, there is a possible allocation of RWX memory due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User intera…
- CVE-2021-39678HIGHCVSS 7.8EG 7.82022-01-14
In <TBD> of <TBD>, there is a possible bypass of Factory Reset Protection due to <TBD>. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Produc…
- CVE-2021-39630HIGHCVSS 7.8EG 7.82022-01-14
In executeRequest of OverlayManagerService.java, there is a possible way to control fabricated overlays from adb shell due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges ne…
- CVE-2021-39627HIGHCVSS 7.8EG 7.82022-01-14
In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interactio…
- CVE-2021-39621HIGHCVSS 7.8EG 7.82022-01-14
In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interactio…
- CVE-2021-39618HIGHCVSS 7.8EG 7.82022-01-14
In multiple methods of EuiccNotificationManager.java, there is a possible way to install existing packages without user consent due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges…
- CVE-2021-0959HIGHCVSS 7.8EG 7.82022-01-14
In jit_memory_region.cc, there is a possible bypass of memory restrictions due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploit…
- CVE-2021-34998HIGHCVSS 7.8EG 7.82022-01-13
This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Free Antivirus 20.2.0.0. An attacker must first obtain the ability to execute low-privileged code on the target system in order to…
- CVE-2022-21916HIGHCVSS 7.8EG 7.82022-01-11
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- CVE-2022-21914HIGHCVSS 7.8EG 7.82022-01-11
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
- CVE-2022-21910HIGHCVSS 7.8EG 7.82022-01-11
Microsoft Cluster Port Driver Elevation of Privilege Vulnerability
- CVE-2022-21908HIGHCVSS 7.8EG 7.82022-01-11
Windows Installer Elevation of Privilege Vulnerability
- CVE-2022-21902HIGHCVSS 7.8EG 7.82022-01-11
Windows DWM Core Library Elevation of Privilege Vulnerability
- CVE-2022-21897HIGHCVSS 7.8EG 7.82022-01-11
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- CVE-2022-21895HIGHCVSS 7.8EG 7.82022-01-11
Windows User Profile Service Elevation of Privilege Vulnerability
- CVE-2022-21885HIGHCVSS 7.8EG 7.82022-01-11
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
- CVE-2022-21884HIGHCVSS 7.8EG 7.82022-01-11
Local Security Authority Subsystem Service Elevation of Privilege Vulnerability
- CVE-2022-21858HIGHCVSS 7.8EG 7.82022-01-11
Windows Bind Filter Driver Elevation of Privilege Vulnerability
- CVE-2022-21852HIGHCVSS 7.8EG 7.82022-01-11
Windows DWM Core Library Elevation of Privilege Vulnerability
- CVE-2022-21835HIGHCVSS 7.8EG 7.82022-01-11
Microsoft Cryptographic Services Elevation of Privilege Vulnerability
- CVE-2022-21833HIGHCVSS 7.8EG 7.82022-01-11
Virtual Machine IDE Drive Elevation of Privilege Vulnerability
- CVE-2021-45440HIGHCVSS 7.8EG 7.82022-01-10
A unnecessary privilege vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security 10.0 SP1 (on-prem versions only) could allow a local attacker to abuse an impersonation privilege and elevate to a higher level of p…
- CVE-2021-45231HIGHCVSS 7.8EG 7.82022-01-10
A link following privilege escalation vulnerability in Trend Micro Apex One (on-prem and SaaS) and Trend Micro Worry-Free Business Security (10.0 SP1 and Services) could allow a local attacker to create a specially crafted file with arbitr…
- CVE-2021-41388HIGHCVSS 7.8EG 7.82022-01-04
Netskope client prior to 89.x on macOS is impacted by a local privilege escalation vulnerability. The XPC implementation of nsAuxiliarySvc process does not perform validation on new connections before accepting the connection. Thus any low…
- CVE-2021-20172HIGHCVSS 7.8EG 7.82021-12-30
All known versions of the Netgear Genie Installer for macOS contain a local privilege escalation vulnerability. The installer of the macOS version of Netgear Genie handles certain files in an insecure way. A malicious actor who has local a…
- CVE-2021-21750HIGHCVSS 7.8EG 7.82021-12-27
ZTE BigVideo Analysis product has a privilege escalation vulnerability. Due to improper management of the timed task modification privilege, an attacker with ordinary user permissions could exploit this vulnerability to gain unauthorized a…
- CVE-2021-45339HIGHCVSS 7.8EG 7.82021-12-27
Privilege escalation vulnerability in Avast Antivirus prior to 20.4 allows a local user to gain elevated privileges by "hollowing" trusted process which could lead to the bypassing of Avast self-defense.
- CVE-2021-45338HIGHCVSS 7.8EG 7.82021-12-27
Multiple privilege escalation vulnerabilities in Avast Antivirus prior to 20.4 allow a local user to gain elevated privileges by calling unnecessarily powerful internal methods of the main antivirus service which could lead to the (1) arbi…
- CVE-2021-21912HIGHCVSS 7.8EG 7.82021-12-22
A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM au…
- CVE-2021-21911HIGHCVSS 7.8EG 7.82021-12-22
A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM au…
- CVE-2021-21910HIGHCVSS 7.8EG 7.82021-12-22
A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM au…
- CVE-2021-27445HIGHCVSS 7.8EG 7.82021-12-21
Mesa Labs AmegaView Versions 3.0 and prior has insecure file permissions that could be exploited to escalate privileges on the device.
- CVE-2021-39653HIGHCVSS 7.8EG 7.82021-12-15
In (TBD) of (TBD), there is a possible way to boot with a hidden debug policy due to a missing warning to the user. This could lead to local escalation of privilege after preparing the device, hiding the warning, and passing the phone to a…
- CVE-2021-1027HIGHCVSS 7.8EG 7.82021-12-15
In setTransactionState of SurfaceFlinger, there is possible arbitrary code execution in a privileged process due to improper casting. This could lead to local escalation of privilege with no additional execution privileges needed. User int…
- CVE-2021-0984HIGHCVSS 7.8EG 7.82021-12-15
In onNullBinding of ManagedServices.java, there is a possible permission bypass due to an incorrectly unbound service. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not…
- CVE-2021-0981HIGHCVSS 7.8EG 7.82021-12-15
In enqueueNotificationInternal of NotificationManagerService.java, there is a possible way to run a foreground service without showing a notification due to improper input validation. This could lead to local escalation of privilege with n…
- CVE-2021-0799HIGHCVSS 7.8EG 7.82021-12-15
In ActivityThread.java, there is a possible way to collide the content provider's authorities. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation…
- CVE-2021-43883HIGHCVSS 7.8EG 7.82021-12-15
Windows Installer Elevation of Privilege Vulnerability
- CVE-2021-43248HIGHCVSS 7.8EG 7.82021-12-15
Windows Digital Media Receiver Elevation of Privilege Vulnerability
- CVE-2021-43247HIGHCVSS 7.8EG 7.82021-12-15
Windows TCP/IP Driver Elevation of Privilege Vulnerability
- CVE-2021-43245HIGHCVSS 7.8EG 7.82021-12-15
Windows Digital TV Tuner Elevation of Privilege Vulnerability
- CVE-2021-43240HIGHCVSS 7.8EG 7.82021-12-15
NTFS Set Short Name Elevation of Privilege Vulnerability
- CVE-2021-43238HIGHCVSS 7.8EG 7.82021-12-15
Windows Remote Access Elevation of Privilege Vulnerability
Map vulnerabilities like CWE-269 to your infrastructure
EchelonGraph correlates every CVE — across CWE-269 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →