CWE-269— Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.— MITRE CWE catalog
5,404 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-269page 52 of 109
- CVE-2021-42107HIGHCVSS 7.8EG 7.82021-10-21
Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services could allow a local attacker to escalate privileges on affected installat…
- CVE-2021-42106HIGHCVSS 7.8EG 7.82021-10-21
Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services could allow a local attacker to escalate privileges on affected installat…
- CVE-2021-42105HIGHCVSS 7.8EG 7.82021-10-21
Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services could allow a local attacker to escalate privileges on affected installat…
- CVE-2021-42104HIGHCVSS 7.8EG 7.82021-10-21
Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services could allow a local attacker to escalate privileges on affected installat…
- CVE-2021-31359HIGHCVSS 7.8EG 7.82021-10-19
A local privilege escalation vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged user to cause the Juniper DHCP daemon (jdhcpd) process to crash, resulting in a Denial of Service (DoS), or execute…
- CVE-2021-30829HIGHCVSS 7.8EG 7.82021-10-19
A URI parsing issue was addressed with improved parsing. This issue is fixed in Security Update 2021-005 Catalina, macOS Big Sur 11.6. A local user may be able to execute arbitrary files.
- CVE-2021-40989HIGHCVSS 7.8EG 7.82021-10-15
A local escalation of privilege vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6…
- CVE-2021-40854HIGHCVSS 7.8EG 7.82021-10-14
AnyDesk before 6.2.6 and 6.3.x before 6.3.3 allows a local user to obtain administrator privileges by using the Open Chat Log feature to launch a privileged Notepad process that can launch other applications.
- CVE-2021-41347HIGHCVSS 7.8EG 7.82021-10-13
Windows AppX Deployment Service Elevation of Privilege Vulnerability
- CVE-2021-41345HIGHCVSS 7.8EG 7.82021-10-13
Storage Spaces Controller Elevation of Privilege Vulnerability
- CVE-2021-41335HIGHCVSS 7.8EG 7.82021-10-13
Windows Kernel Elevation of Privilege Vulnerability
- CVE-2021-40489HIGHCVSS 7.8EG 7.82021-10-13
Storage Spaces Controller Elevation of Privilege Vulnerability
- CVE-2021-40488HIGHCVSS 7.8EG 7.82021-10-13
Storage Spaces Controller Elevation of Privilege Vulnerability
- CVE-2021-40478HIGHCVSS 7.8EG 7.82021-10-13
Storage Spaces Controller Elevation of Privilege Vulnerability
- CVE-2021-40477HIGHCVSS 7.8EG 7.82021-10-13
Windows Event Tracing Elevation of Privilege Vulnerability
- CVE-2021-40470HIGHCVSS 7.8EG 7.82021-10-13
DirectX Graphics Kernel Elevation of Privilege Vulnerability
- CVE-2021-40467HIGHCVSS 7.8EG 7.82021-10-13
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- CVE-2021-40466HIGHCVSS 7.8EG 7.82021-10-13
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- CVE-2021-40443HIGHCVSS 7.8EG 7.82021-10-13
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- CVE-2021-26441HIGHCVSS 7.8EG 7.82021-10-13
Storage Spaces Controller Elevation of Privilege Vulnerability
- CVE-2021-37969HIGHCVSS 7.8EG 7.82021-10-08
Inappropriate implementation in Google Updater in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker to perform local privilege escalation via a crafted file.
- CVE-2021-28129HIGHCVSS 7.8EG 7.82021-10-07
While working on Apache OpenOffice 4.1.8 a developer discovered that the DEB package did not install using root, but instead used a userid and groupid of 500. This both caused issues with desktop integration and could allow a crafted attac…
- CVE-2021-20264HIGHCVSS 7.8EG 7.82021-10-06
An insecure modification flaw in the /etc/passwd file was found in the openjdk-1.8 and openjdk-11 containers. This flaw allows an attacker with access to the container to modify the /etc/passwd and escalate their privileges. The highest th…
- CVE-2021-0692HIGHCVSS 7.8EG 7.82021-10-06
In sendBroadcastToInstaller of FirstScreenBroadcast.java, there is a possible activity launch due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction…
- CVE-2021-0595HIGHCVSS 7.8EG 7.82021-10-06
In lockAllProfileTasks of RootWindowContainer.java, there is a possible way to access the work profile without the profile PIN, after logging in. This could lead to local escalation of privilege with no additional execution privileges need…
- CVE-2021-41285HIGHCVSS 7.8EG 7.82021-10-04
Ballistix MOD Utility through 2.0.2.5 is vulnerable to privilege escalation in the MODAPI.sys driver component. The vulnerability is triggered by sending a specific IOCTL request that allows low-privileged users to directly interact with p…
- CVE-2021-34412HIGHCVSS 7.8EG 7.82021-09-27
During the installation process for all versions of the Zoom Client for Meetings for Windows before 5.4.0, it is possible to launch Internet Explorer. If the installer was launched with elevated privileges such as by SCCM this can result i…
- CVE-2021-34411HIGHCVSS 7.8EG 7.82021-09-27
During the installation process forZoom Rooms for Conference Room for Windows before version 5.3.0 it is possible to launch Internet Explorer with elevated privileges. If the installer was launched with elevated privileges such as by SCCM …
- CVE-2021-34410HIGHCVSS 7.8EG 7.82021-09-27
A user-writable application bundle unpacked during the install for all versions of the Zoom Plugin for Microsoft Outlook for Mac before 5.0.25611.0521 allows for privilege escalation to root.
- CVE-2021-34409HIGHCVSS 7.8EG 7.82021-09-27
It was discovered that the installation packages of the Zoom Client for Meetings for MacOS (Standard and for IT Admin) installation before version 5.2.0, Zoom Client Plugin for Sharing iPhone/iPad before version 5.2.0, and Zoom Rooms for C…
- CVE-2021-34408HIGHCVSS 7.8EG 7.82021-09-27
The Zoom Client for Meetings for Windows in all versions before version 5.3.2 writes log files to a user writable directory as a privileged user during the installation or update of the client. This could allow for potential privilege esca…
- CVE-2021-23243HIGHCVSS 7.8EG 7.82021-09-27
In Oppo's battery application, the third-party SDK provides the function of loading a third-party Provider, which can be used.
- CVE-2021-22015HIGHCVSS 7.8EG 7.82021-09-23
The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their p…
- CVE-2021-1419HIGHCVSS 7.8EG 7.82021-09-23
A vulnerability in the SSH management feature of multiple Cisco Access Points (APs) platforms could allow a local, authenticated user to modify files on the affected device and possibly gain escalated privileges. The vulnerability is due t…
- CVE-2021-21991HIGHCVSS 7.8EG 7.82021-09-22
The vCenter Server contains a local privilege escalation vulnerability due to the way it handles session tokens. A malicious actor with non-administrative user access on vCenter Server host may exploit this issue to escalate privileges to …
- CVE-2021-41073HIGHCVSS 7.8EG 7.82021-09-19
loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows local users to gain privileges by using IORING_OP_PROVIDE_BUFFERS to trigger a free of a kernel buffer, as demonstrated by using /proc/<pid>/maps for exploitation.
- CVE-2021-40447HIGHCVSS 7.8EG 7.82021-09-15
Windows Print Spooler Elevation of Privilege Vulnerability
- CVE-2021-38671HIGHCVSS 7.8EG 7.82021-09-15
Windows Print Spooler Elevation of Privilege Vulnerability
- CVE-2021-38667HIGHCVSS 7.8EG 7.82021-09-15
Windows Print Spooler Elevation of Privilege Vulnerability
- CVE-2021-38639HIGHCVSS 7.8EG 7.82021-09-15
Win32k Elevation of Privilege Vulnerability
- CVE-2021-38638HIGHCVSS 7.8EG 7.82021-09-15
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CVE-2021-38634HIGHCVSS 7.8EG 7.82021-09-15
Microsoft Windows Update Client Elevation of Privilege Vulnerability
- CVE-2021-38633HIGHCVSS 7.8EG 7.82021-09-15
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- CVE-2021-38630HIGHCVSS 7.8EG 7.82021-09-15
Windows Event Tracing Elevation of Privilege Vulnerability
- CVE-2021-38628HIGHCVSS 7.8EG 7.82021-09-15
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CVE-2021-38626HIGHCVSS 7.8EG 7.82021-09-15
Windows Kernel Elevation of Privilege Vulnerability
- CVE-2021-38625HIGHCVSS 7.8EG 7.82021-09-15
Windows Kernel Elevation of Privilege Vulnerability
- CVE-2021-36975HIGHCVSS 7.8EG 7.82021-09-15
Win32k Elevation of Privilege Vulnerability
- CVE-2021-36974HIGHCVSS 7.8EG 7.82021-09-15
Windows SMB Elevation of Privilege Vulnerability
- CVE-2021-36973HIGHCVSS 7.8EG 7.82021-09-15
Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability
Map vulnerabilities like CWE-269 to your infrastructure
EchelonGraph correlates every CVE — across CWE-269 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →