CWE-269— Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.— MITRE CWE catalog

5,404 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-269page 58 of 109

CVE-2021-1657HIGHCVSS 7.8EG 7.8
2021-01-12
Windows Fax Compose Form Remote Code Execution Vulnerability
CVE-2021-1655HIGHCVSS 7.8EG 7.8
2021-01-12
Windows CSC Service Elevation of Privilege Vulnerability
CVE-2021-1654HIGHCVSS 7.8EG 7.8
2021-01-12
Windows CSC Service Elevation of Privilege Vulnerability
CVE-2021-1653HIGHCVSS 7.8EG 7.8
2021-01-12
Windows CSC Service Elevation of Privilege Vulnerability
CVE-2021-1652HIGHCVSS 7.8EG 7.8
2021-01-12
Windows CSC Service Elevation of Privilege Vulnerability
CVE-2021-1651HIGHCVSS 7.8EG 7.8
2021-01-12
Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability
CVE-2021-1650HIGHCVSS 7.8EG 7.8
2021-01-12
Windows Runtime C++ Template Library Elevation of Privilege Vulnerability
CVE-2021-1649HIGHCVSS 7.8EG 7.8
2021-01-12
Active Template Library Elevation of Privilege Vulnerability
CVE-2021-1648HIGHCVSS 7.8EG 7.8
2021-01-12
Microsoft splwow64 Elevation of Privilege Vulnerability
CVE-2021-1642HIGHCVSS 7.8EG 7.8
2021-01-12
Windows AppX Deployment Extensions Elevation of Privilege Vulnerability
CVE-2020-35459HIGHCVSS 7.8EG 7.8
2021-01-12
An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" (when "crm" is run) were able to execute commands via shell code injection to the crm history commandline, potentially allowing escalati…
CVE-2020-26050HIGHCVSS 7.8EG 7.8
2021-01-12
SaferVPN for Windows Ver 5.0.3.3 through 5.0.4.15 could allow local privilege escalation from low privileged users to SYSTEM via a crafted openssl configuration file. This issue is similar to CVE-2019-12572.
CVE-2021-0317HIGHCVSS 7.8EG 7.8
2021-01-11
In createOrUpdate of Permission.java and related code, there is possible permission escalation due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is neede…
CVE-2021-0306HIGHCVSS 7.8EG 7.8
2021-01-11
In addAllPermissions of PermissionManagerService.java, there is a possible permissions bypass when upgrading major Android versions which allows an app to gain the android.permission.ACTIVITY_RECOGNITION permission without user confirmatio…
CVE-2020-27059HIGHCVSS 7.8EG 7.8
2021-01-11
In onAuthenticated of AuthenticationClient.java, there is a possible tapjacking attack when requesting the user's fingerprint due to an overlaid window. This could lead to local escalation of privilege with no additional execution privileg…
CVE-2018-9333HIGHCVSS 7.8EG 7.8
2021-01-11
K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affected by: Buffer Overflow. The impact is: execute arbitrary code (local). The component is: K7TSMngr.exe.
CVE-2018-9332HIGHCVSS 7.8EG 7.8
2021-01-11
K7Computing Pvt Ltd K7AntiVirus Premium 15.01.00.53 is affected by: Incorrect Access Control. The impact is: gain privileges (local).
CVE-2018-8724HIGHCVSS 7.8EG 7.8
2021-01-11
K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affected by: Incorrect Access Control. The impact is: gain privileges (local). The component is: K7TSMngr.exe.
CVE-2018-8044HIGHCVSS 7.8EG 7.8
2021-01-11
K7Computing Pvt Ltd K7Antivirus Premium 15.1.0.53 is affected by: Incorrect Access Control. The impact is: Local Process Execution (local). The component is: K7Sentry.sys.
CVE-2021-1052HIGHCVSS 7.8EG 7.8
2021-01-08
NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape or IOCTL in which user-mode clients can access legacy privileged APIs, which may lead…
CVE-2020-13540HIGHCVSS 7.8EG 7.8
2021-01-05
An exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise V4.20.13 install directory via WIN-911 Account Change Utility. Depending on the vector chosen, an attacker can overwrite…
CVE-2020-13539HIGHCVSS 7.8EG 7.8
2021-01-05
An exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise V4.20.13 install directory via “WIN-911 Mobile Runtime” service. Depending on the vector chosen, an attacker can ove…
CVE-2020-8290HIGHCVSS 7.8EG 7.8
2020-12-27
Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in `bztransmit` helper due to lack of permission handling and validation before creation of client update directories allowing for loc…
CVE-2020-24676HIGHCVSS 7.8EG 7.8
2020-12-22
In Symphony Plus Operations and Symphony Plus Historian, some services can be vulnerable to privilege escalation attacks. An unprivileged (but authenticated) user could execute arbitrary code and result in privilege escalation, depending o…
CVE-2020-25106HIGHCVSS 7.8EG 7.8
2020-12-22
Nanosystems SupRemo 4.1.3.2348 allows attackers to obtain LocalSystem access because File Manager can be used to rename Supremo.exe and then upload a Trojan horse with the Supremo.exe filename.
CVE-2020-27054HIGHCVSS 7.8EG 7.8
2020-12-15
In onFactoryReset of BluetoothManagerService.java, there is a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Produc…
CVE-2020-27052HIGHCVSS 7.8EG 7.8
2020-12-15
In getLockTaskLaunchMode of ActivityRecord.java, there is a possible way for any app to start in Lock Task Mode due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. U…
CVE-2020-27030HIGHCVSS 7.8EG 7.8
2020-12-15
In onCreate of HandleApiCalls.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege that allows an app to set or dismiss the alarm with no additional execution privileges nee…
CVE-2020-0444HIGHCVSS 7.8EG 7.8
2020-12-14
In audit_free_lsm_field of auditfilter.c, there is a possible bad kfree due to a logic error in audit_data_to_entry. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not n…
CVE-2020-0099HIGHCVSS 7.8EG 7.8
2020-12-14
In addWindow of WindowManagerService.java, there is a possible window overlay attack due to an insecure default value. This could lead to local escalation of privilege via tapjacking with no additional execution privileges needed. User int…
CVE-2020-4829HIGHCVSS 7.8EG 7.8
2020-12-10
IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a local user to exploit a vulnerability in the ksu user command to gain root privileges. IBM X-Force ID: 189960.
CVE-2020-17137HIGHCVSS 7.8EG 7.8
2020-12-10
DirectX Graphics Kernel Elevation of Privilege Vulnerability
CVE-2020-17136HIGHCVSS 7.8EG 7.8
2020-12-10
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
CVE-2020-17134HIGHCVSS 7.8EG 7.8
2020-12-10
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
CVE-2020-17092HIGHCVSS 7.8EG 7.8
2020-12-10
Windows Network Connections Service Elevation of Privilege Vulnerability
CVE-2020-16964HIGHCVSS 7.8EG 7.8
2020-12-10
Windows Backup Engine Elevation of Privilege Vulnerability
CVE-2020-16963HIGHCVSS 7.8EG 7.8
2020-12-10
Windows Backup Engine Elevation of Privilege Vulnerability
CVE-2020-16962HIGHCVSS 7.8EG 7.8
2020-12-10
Windows Backup Engine Elevation of Privilege Vulnerability
CVE-2020-16961HIGHCVSS 7.8EG 7.8
2020-12-10
Windows Backup Engine Elevation of Privilege Vulnerability
CVE-2020-16960HIGHCVSS 7.8EG 7.8
2020-12-10
Windows Backup Engine Elevation of Privilege Vulnerability
CVE-2020-16959HIGHCVSS 7.8EG 7.8
2020-12-10
Windows Backup Engine Elevation of Privilege Vulnerability
CVE-2020-16958HIGHCVSS 7.8EG 7.8
2020-12-10
Windows Backup Engine Elevation of Privilege Vulnerability
CVE-2020-10143HIGHCVSS 7.8EG 7.8
2020-12-09
Macrium Reflect includes an OpenSSL component that specifies an OPENSSLDIR variable as C:\openssl\. Macrium Reflect contains a privileged service that uses this OpenSSL component. Because unprivileged Windows users can create subdirectorie…
CVE-2020-27614HIGHCVSS 7.8EG 7.8
2020-12-09
AnyDesk for macOS versions 6.0.2 and older have a vulnerability in the XPC interface that does not properly validate client requests and allows local privilege escalation.
CVE-2020-27903HIGHCVSS 7.8EG 7.8
2020-12-08
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Big Sur 11.0.1. An application may be able to gain elevated privileges.
CVE-2020-23740HIGHCVSS 7.8EG 7.8
2020-12-03
In DriverGenius 9.61.5480.28 there is a local privilege escalation vulnerability in the driver wizard, attackers can use constructed programs to increase user privileges.
CVE-2020-28175HIGHCVSS 7.8EG 7.8
2020-12-03
There is a local privilege escalation vulnerability in Alfredo Milani Comparetti SpeedFan 4.52. Attackers can use constructed programs to increase user privileges
CVE-2020-23735HIGHCVSS 7.8EG 7.8
2020-12-03
In Saibo Cyber Game Accelerator 3.7.9 there is a local privilege escalation vulnerability. Attackers can use the constructed program to increase user privileges
CVE-2020-9114HIGHCVSS 7.8EG 7.8
2020-12-01
FusionCompute versions 6.3.0, 6.3.1, 6.5.0, 6.5.1 and 8.0.0 have a privilege escalation vulnerability. Due to improper privilege management, an attacker with common privilege may access some specific files and get the administrator privile…
CVE-2020-8351HIGHCVSS 7.8EG 7.8
2020-11-30
A privilege escalation vulnerability was reported in Lenovo PCManager prior to version 3.0.50.9162 that could allow an authenticated user to execute code with elevated privileges.

Map vulnerabilities like CWE-269 to your infrastructure

EchelonGraph correlates every CVE — across CWE-269 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →