CWE-269— Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.— MITRE CWE catalog

5,404 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-269page 56 of 109

CVE-2021-28685HIGHCVSS 7.8EG 7.8
2021-04-08
AsIO2_64.sys and AsIO2_32.sys in ASUS GPUTweak II before 2.3.0.3 allow low-privileged users to interact directly with physical memory (by calling one of several driver routines that map physical memory into the virtual address space of the…
CVE-2021-1802HIGHCVSS 7.8EG 7.8
2021-04-02
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave. A local attacker may be able to elevate their privileges.
CVE-2021-1787HIGHCVSS 7.8EG 7.8
2021-04-02
Multiple issues were addressed with improved logic. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A local attacker may be ab…
CVE-2021-1750HIGHCVSS 7.8EG 7.8
2021-04-02
Multiple issues were addressed with improved logic. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. An application may be able…
CVE-2020-29620HIGHCVSS 7.8EG 7.8
2021-04-02
This issue was addressed with improved entitlements. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. A malicious application may be able to elevate privileges.
CVE-2020-27938HIGHCVSS 7.8EG 7.8
2021-04-02
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Upda…
CVE-2021-28250HIGHCVSS 7.8EG 7.8
2021-03-26
CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a setuid (and/or setgid) file. When a component is run as an argument of the runpicEhealth executable, the script code will be executed as the ehealth …
CVE-2021-27454HIGHCVSS 7.8EG 7.8
2021-03-25
The software performs an operation at a privilege level higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses on the Reason DR60 (all firmware versions prior to 02A04.1).
CVE-2021-27448HIGHCVSS 7.8EG 7.8
2021-03-25
A miscommunication in the file system allows adversaries with access to the MU320E to escalate privileges on the MU320E (all firmware versions prior to v04A00.1).
CVE-2021-27192HIGHCVSS 7.8EG 7.8
2021-03-25
Local privilege escalation vulnerability in Windows clients of Netop Vision Pro up to and including 9.7.1 allows a local user to gain administrator privileges whilst using the clients.
CVE-2019-19354HIGHCVSS 7.8EG 7.8
2021-03-24
An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/hadoop as shipped in Red Hat Openshift 4. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate th…
CVE-2020-7346HIGHCVSS 7.8EG 7.8
2021-03-23
Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) for Windows prior to 11.6.100 allows a local, low privileged, attacker through the use of junctions to cause the product to load DLLs of the attacker's choosing. This …
CVE-2021-22314HIGHCVSS 7.8EG 7.8
2021-03-22
There is a local privilege escalation vulnerability in some versions of ManageOne. A local authenticated attacker could perform specific operations to exploit this vulnerability. Successful exploitation may cause the attacker to obtain a h…
CVE-2020-11228HIGHCVSS 7.8EG 7.8
2021-03-17
Part of RPM region was not protected from xblSec itself due to improper policy and leads to unprivileged access in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…
CVE-2017-20002HIGHCVSS 7.8EG 7.8
2021-03-17
The Debian shadow package before 1:4.5-1 for Shadow incorrectly lists pts/0 and pts/1 as physical terminals in /etc/securetty. This allows local users to login as password-less users even if they are connected by non-physical means such as…
CVE-2021-27892HIGHCVSS 7.8EG 7.8
2021-03-15
SSH Tectia Client and Server before 6.4.19 on Windows allow local privilege escalation. ConnectSecure on Windows is affected.
CVE-2021-28375HIGHCVSS 7.8EG 7.8
2021-03-15
An issue was discovered in the Linux kernel through 5.11.6. fastrpc_internal_invoke in drivers/misc/fastrpc.c does not prevent user applications from sending kernel RPC messages, aka CID-20c40794eb85. This is a related issue to CVE-2019-23…
CVE-2021-27077HIGHCVSS 7.8EG 7.8
2021-03-11
Windows Win32k Elevation of Privilege Vulnerability
CVE-2021-27070HIGHCVSS 7.8EG 7.8
2021-03-11
Windows 10 Update Assistant Elevation of Privilege Vulnerability
CVE-2021-26901HIGHCVSS 7.8EG 7.8
2021-03-11
Windows Event Tracing Elevation of Privilege Vulnerability
CVE-2021-26900HIGHCVSS 7.8EG 7.8
2021-03-11
Windows Win32k Elevation of Privilege Vulnerability
CVE-2021-26899HIGHCVSS 7.8EG 7.8
2021-03-11
Windows UPnP Device Host Elevation of Privilege Vulnerability
CVE-2021-26898HIGHCVSS 7.8EG 7.8
2021-03-11
Windows Event Tracing Elevation of Privilege Vulnerability
CVE-2021-26891HIGHCVSS 7.8EG 7.8
2021-03-11
Windows Container Execution Agent Elevation of Privilege Vulnerability
CVE-2021-26889HIGHCVSS 7.8EG 7.8
2021-03-11
Windows Update Stack Elevation of Privilege Vulnerability
CVE-2021-26887HIGHCVSS 7.8EG 7.8
2021-03-11
An elevation of privilege vulnerability exists in Microsoft Windows when Folder redirection has been enabled via Group Policy. When folder redirection file server is co-located with Terminal server, an attacker who successfully exploited t…
CVE-2021-26885HIGHCVSS 7.8EG 7.8
2021-03-11
Windows WalletService Elevation of Privilege Vulnerability
CVE-2021-26882HIGHCVSS 7.8EG 7.8
2021-03-11
Remote Access API Elevation of Privilege Vulnerability
CVE-2021-26880HIGHCVSS 7.8EG 7.8
2021-03-11
Windows Storage Spaces Controller Elevation of Privilege Vulnerability
CVE-2021-26878HIGHCVSS 7.8EG 7.8
2021-03-11
Windows Print Spooler Elevation of Privilege Vulnerability
CVE-2021-26875HIGHCVSS 7.8EG 7.8
2021-03-11
Windows Win32k Elevation of Privilege Vulnerability
CVE-2021-26874HIGHCVSS 7.8EG 7.8
2021-03-11
Windows Overlay Filter Elevation of Privilege Vulnerability
CVE-2021-26873HIGHCVSS 7.8EG 7.8
2021-03-11
Windows User Profile Service Elevation of Privilege Vulnerability
CVE-2021-26872HIGHCVSS 7.8EG 7.8
2021-03-11
Windows Event Tracing Elevation of Privilege Vulnerability
CVE-2021-26871HIGHCVSS 7.8EG 7.8
2021-03-11
Windows WalletService Elevation of Privilege Vulnerability
CVE-2021-26870HIGHCVSS 7.8EG 7.8
2021-03-11
Windows Projected File System Elevation of Privilege Vulnerability
CVE-2021-26868HIGHCVSS 7.8EG 7.8
2021-03-11
Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2021-26865HIGHCVSS 7.8EG 7.8
2021-03-11
Windows Container Execution Agent Elevation of Privilege Vulnerability
CVE-2021-26864HIGHCVSS 7.8EG 7.8
2021-03-11
Windows Virtual Registry Provider Elevation of Privilege Vulnerability
CVE-2021-26863HIGHCVSS 7.8EG 7.8
2021-03-11
Windows Win32k Elevation of Privilege Vulnerability
CVE-2021-26862HIGHCVSS 7.8EG 7.8
2021-03-11
Windows Installer Elevation of Privilege Vulnerability
CVE-2021-26860HIGHCVSS 7.8EG 7.8
2021-03-11
Windows App-V Overlay Filter Elevation of Privilege Vulnerability
CVE-2021-24095HIGHCVSS 7.8EG 7.8
2021-03-11
DirectX Elevation of Privilege Vulnerability
CVE-2021-24090HIGHCVSS 7.8EG 7.8
2021-03-11
Windows Error Reporting Elevation of Privilege Vulnerability
CVE-2021-1729HIGHCVSS 7.8EG 7.8
2021-03-11
Windows Update Stack Setup Elevation of Privilege Vulnerability
CVE-2021-1640HIGHCVSS 7.8EG 7.8
2021-03-11
Windows Print Spooler Elevation of Privilege Vulnerability
CVE-2021-0388HIGHCVSS 7.8EG 7.8
2021-03-10
In onReceive of ImsPhoneCallTracker.java, there is a possible misattribution of data usage due to an incorrect broadcast handler. This could lead to local escalation of privilege resulting in attributing video call data to the wrong app, w…
CVE-2021-0385HIGHCVSS 7.8EG 7.8
2021-03-10
In createConnectToAvailableNetworkNotification of ConnectToNetworkNotificationBuilder.java, there is a possible connection to untrusted WiFi networks due to notification interaction above the lockscreen. This could lead to local escalation…
CVE-2021-0383HIGHCVSS 7.8EG 7.8
2021-03-10
In done of CaptivePortalLoginActivity.java, there is a confused deputy. This could lead to local escalation of privilege in carrier settings with no additional execution privileges needed. User interaction is not needed for exploitation.Pr…
CVE-2021-0376HIGHCVSS 7.8EG 7.8
2021-03-10
In checkUriPermission and related functions of MediaProvider.java, there is a possible way to access external files due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges neede…

Map vulnerabilities like CWE-269 to your infrastructure

EchelonGraph correlates every CVE — across CWE-269 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →