CWE-269— Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.— MITRE CWE catalog

5,407 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-269page 71 of 109

CVE-2015-5466HIGHCVSS 7.8EG 7.8
2020-01-15
Silicon Integrated Systems XGI WindowsXP Display Manager (aka XGI VGA Driver Manager and VGA Display Manager) 6.14.10.1090 allows local users to gain privileges via a crafted 0x96002404 IOCTL call.
CVE-2015-7556HIGHCVSS 7.8EG 7.8
2020-01-15
DeleGate 9.9.13 allows local users to gain privileges as demonstrated by the dgcpnod setuid program.
CVE-2020-0644HIGHCVSS 7.8EG 7.8
2020-01-14
An elevation of privilege vulnerability exists when Microsoft Windows implements predictable memory section names, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0635.
CVE-2020-0642HIGHCVSS 7.8EG 7.8
2020-01-14
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0624.
CVE-2020-0641HIGHCVSS 7.8EG 7.8
2020-01-14
An elevation of privilege vulnerability exists in Windows Media Service that allows file creation in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Microsoft Windows Elevation o…
CVE-2020-0636HIGHCVSS 7.8EG 7.8
2020-01-14
An elevation of privilege vulnerability exists in the way that the Windows Subsystem for Linux handles files, aka 'Windows Subsystem for Linux Elevation of Privilege Vulnerability'.
CVE-2020-0635HIGHCVSS 7.8EG 7.8
2020-01-14
An elevation of privilege vulnerability exists in Microsoft Windows when Windows fails to properly handle certain symbolic links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0644.
CVE-2020-0634HIGHCVSS 7.8EG 7.8
2020-01-14
An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common Log File System Driver Elevation of Privilege Vulnerability'.
CVE-2020-0633HIGHCVSS 7.8EG 7.8
2020-01-14
An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0613, CVE-2020-0614…
CVE-2020-0632HIGHCVSS 7.8EG 7.8
2020-01-14
An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0613, CVE-2020-0614…
CVE-2020-0631HIGHCVSS 7.8EG 7.8
2020-01-14
An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0613, CVE-2020-0614…
CVE-2020-0630HIGHCVSS 7.8EG 7.8
2020-01-14
An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0613, CVE-2020-0614…
CVE-2020-0629HIGHCVSS 7.8EG 7.8
2020-01-14
An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0613, CVE-2020-0614…
CVE-2020-0628HIGHCVSS 7.8EG 7.8
2020-01-14
An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0613, CVE-2020-0614…
CVE-2020-0627HIGHCVSS 7.8EG 7.8
2020-01-14
An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0613, CVE-2020-0614…
CVE-2020-0626HIGHCVSS 7.8EG 7.8
2020-01-14
An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0613, CVE-2020-0614…
CVE-2020-0625HIGHCVSS 7.8EG 7.8
2020-01-14
An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0613, CVE-2020-0614…
CVE-2020-0624HIGHCVSS 7.8EG 7.8
2020-01-14
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0642.
CVE-2020-0623HIGHCVSS 7.8EG 7.8
2020-01-14
An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0613, CVE-2020-0614…
CVE-2020-0620HIGHCVSS 7.8EG 7.8
2020-01-14
An elevation of privilege vulnerability exists when Microsoft Cryptographic Services improperly handles files, aka 'Microsoft Cryptographic Services Elevation of Privilege Vulnerability'.
CVE-2020-0614HIGHCVSS 7.8EG 7.8
2020-01-14
An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0613, CVE-2020-0623…
CVE-2020-0613HIGHCVSS 7.8EG 7.8
2020-01-14
An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0614, CVE-2020-0623…
CVE-2020-5180HIGHCVSS 7.8EG 7.8
2020-01-14
Viscosity 1.8.2 on Windows and macOS allows an unprivileged user to set a subset of OpenVPN parameters, which can be used to load a malicious library into the memory of the OpenVPN process, leading to limited local privilege escalation. (W…
CVE-2012-4761HIGHCVSS 7.8EG 7.8
2020-01-13
A Privilege Escalation vulnerability exists in the unquoted Service Binary in SDPAgent or SDBAgent in Safend Data Protector Agent 3.4.5586.9772, which could let a local malicious user obtain privileges.
CVE-2012-4760HIGHCVSS 7.8EG 7.8
2020-01-13
A Privilege Escalation vulnerability exists in the SDBagent service in Safend Data Protector Agent 3.4.5586.9772, which could let a local malicious user obtain privileges.
CVE-2020-0001HIGHCVSS 7.8EG 7.8
2020-01-08
In getProcessRecordLocked of ActivityManagerService.java isolated apps are not handled correctly. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitat…
CVE-2019-19544HIGHCVSS 7.8EG 7.8
2020-01-08
CA Automic Dollar Universe 5.3.3 contains a vulnerability, related to the uxdqmsrv binary being setuid root, that allows local attackers to elevate privileges. This vulnerability was reported to CA several years after CA Automic Dollar Uni…
CVE-2016-6590HIGHCVSS 7.8EG 7.8
2020-01-08
A privilege escalation vulnerability exists when loading DLLs during boot up and reboot in Symantec IT Management Suite 8.0 prior to 8.0 HF4 and Suite 7.6 prior to 7.6 HF7, Symantec Ghost Solution Suite 3.1 prior to 3.1 MP4, Symantec Endpo…
CVE-2019-19585HIGHCVSS 7.8EG 7.8
2020-01-06
An issue was discovered in rConfig 3.9.3. The install script updates the /etc/sudoers file for rconfig specific tasks. After an "rConfig specific Apache configuration" update, apache has high privileges for some binaries. This can be explo…
CVE-2013-4161HIGHCVSS 7.8EG 7.8
2019-12-31
gksu-polkit-0.0.3-6.fc18 was reported as fixing the issue in CVE-2012-5617 but the patch was improperly applied and it did not fixed the security issue.
CVE-2013-2016HIGHCVSS 7.8EG 7.8
2019-12-30
A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. If the virtio device has zero/small sized config space, such as virtio-rng, a privileged guest user…
CVE-2019-19470HIGHCVSS 7.8EG 7.8
2019-12-30
Unsafe usage of .NET deserialization in Named Pipe message processing allows privilege escalation to NT AUTHORITY\SYSTEM for a local attacker. Affected product is TinyWall, all versions up to and including 2.1.12. Fixed in version 2.1.13.
CVE-2019-6685HIGHCVSS 7.8EG 7.8
2019-12-23
On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, users with access to edit iRules are able to create iRules which can lead to an elevation of privilege, configuration …
CVE-2012-2312HIGHCVSS 7.8EG 7.8
2019-12-18
An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread pool that still retains the security context from the process …
CVE-2019-5250HIGHCVSS 7.8EG 7.8
2019-12-13
Mate 20 Pro smartphones with versions earlier than 9.1.0.135(C00E133R3P1) have an improper authorization vulnerability. The software does not properly restrict certain operation of certain privilege, the attacker could trick the user into …
CVE-2019-19726HIGHCVSS 7.8EG 7.8
2019-12-12
OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be defeated by setting a very small RLIMIT_DATA resource limit. When executing chpass or passwd (which are setuid root), …
CVE-2013-0293HIGHCVSS 7.8EG 7.8
2019-12-10
oVirt Node: Lock screen accepts F2 to drop to shell causing privilege escalation
CVE-2012-1615HIGHCVSS 7.8EG 7.8
2019-12-06
A Privilege Escalation vulnerability exits in Fedoraproject Sectool due to an incorrect DBus file.
CVE-2012-4480HIGHCVSS 7.8EG 7.8
2019-12-02
mom creates world-writable pid files in /var/run
CVE-2019-19014HIGHCVSS 7.8EG 7.8
2019-12-02
An issue was discovered in TitanHQ WebTitan before 5.18. It has a sudoers file that enables low-privilege users to execute a vast number of commands as root, including mv, chown, and chmod. This can be trivially exploited to gain root priv…
CVE-2019-13702HIGHCVSS 7.8EG 7.8
2019-11-25
Inappropriate implementation in installer in Google Chrome on Windows prior to 78.0.3904.70 allowed a local attacker to perform privilege escalation via a crafted executable.
CVE-2012-5617HIGHCVSS 7.8EG 7.8
2019-11-25
gksu-polkit: permissive PolicyKit policy configuration file allows privilege escalation
CVE-2019-15511HIGHCVSS 7.8EG 7.8
2019-11-21
An exploitable local privilege escalation vulnerability exists in the GalaxyClientService installed by GOG Galaxy. Due to Improper Access Control, an attacker can send unauthenticated local TCP packets to the service to gain SYSTEM privile…
CVE-2019-3466HIGHCVSS 7.8EG 7.8
2019-11-20
The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which could result in local privilege escalation.
CVE-2011-3349HIGHCVSS 7.8EG 7.8
2019-11-19
lightdm before 0.9.6 writes in .dmrc and Xauthority files using root permissions while the files are in user controlled folders. A local user can overwrite root-owned files via a symlink, which can allow possible privilege escalation.
CVE-2011-4954HIGHCVSS 7.8EG 7.8
2019-11-19
cobbler has local privilege escalation via the use of insecure location for PYTHON_EGG_CACHE
CVE-2018-18368HIGHCVSS 7.8EG 7.8
2019-11-15
Symantec Endpoint Protection Manager (SEPM), prior to 14.2 RU1, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated ac…
CVE-2019-11112HIGHCVSS 7.8EG 7.8
2019-11-14
Memory corruption in Kernel Mode Driver in Intel(R) Graphics Driver before 26.20.100.6813 (DCH) or 26.20.100.6812 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2019-0155HIGHCVSS 7.8EG 7.8
2019-11-14
Insufficient access control in a subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Pentium(R) Processor J, N, Silver and Gold Series; Intel(R) Celeron(R) Processor…
CVE-2019-11156HIGHCVSS 7.8EG 7.8
2019-11-14
Logic errors in Intel(R) PROSet/Wireless WiFi Software before version 21.40 may allow an authenticated user to potentially enable escalation of privilege, denial of service, and information disclosure via local access.

Map vulnerabilities like CWE-269 to your infrastructure

EchelonGraph correlates every CVE — across CWE-269 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →