CWE-269— Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.— MITRE CWE catalog
5,407 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-269page 73 of 109
- CVE-2017-14312HIGHCVSS 7.8EG 7.82017-09-11
Nagios Core through 4.3.4 initially executes /usr/sbin/nagios as root but supports configuration options in which this file is owned by a non-root account (and similarly can have nagios.cfg owned by a non-root account), which allows local …
- CVE-2017-6623HIGHCVSS 7.8EG 7.82017-05-18
A vulnerability in a script file that is installed as part of the Cisco Policy Suite (CPS) Software distribution for the CPS appliance could allow an authenticated, local attacker to escalate their privilege level to root. The vulnerabilit…
- CVE-2017-5207HIGHCVSS 7.8EG 7.82017-03-23
Firejail before 0.9.44.4, when running a bandwidth command, allows local users to gain root privileges via the --shell argument.
- CVE-2017-6401HIGHCVSS 7.8EG 7.82017-03-02
An issue was discovered in Veritas NetBackup before 8.0 and NetBackup Appliance before 3.0. Local arbitrary command execution can occur when using bpcd and bpnbat.
- CVE-2016-3376HIGHCVSS 7.8EG 7.82016-10-14
The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allow local users to gain privileg…
- CVE-2016-2067HIGHCVSS 7.8EG 7.82016-07-11
drivers/gpu/msm/kgsl.c in the MSM graphics driver (aka GPU driver) for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, mishandles the KGSL_MEMFLAGS_GPUREADONLY fl…
- CVE-2016-2066HIGHCVSS 7.8EG 7.82016-06-13
Integer signedness error in the MSM QDSP6 audio driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial o…
- CVE-2016-2061HIGHCVSS 7.8EG 7.82016-06-13
Integer signedness error in the MSM V4L2 video driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of…
- CVE-2016-2854HIGHCVSS 7.8EG 7.82016-05-02
The aufs module for the Linux kernel 3.x and 4.x does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory.
- CVE-2016-2853HIGHCVSS 7.8EG 7.82016-05-02
The aufs module for the Linux kernel 3.x and 4.x does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an aufs filesystem on top of a FUSE filesystem, and then executing a crafted setuid pr…
- CVE-2016-1575HIGHCVSS 7.8EG 7.82016-05-02
The overlayfs implementation in the Linux kernel through 4.5.2 does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory.
- CVE-2015-8539HIGHCVSS 7.8EG 7.82016-02-08
The KEYS subsystem in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (BUG) via crafted keyctl commands that negatively instantiate a key, related to security/keys/encrypted-keys/encrypted.c, …
- CVE-2014-9322HIGHCVSS 7.8EG 7.82014-12-17
arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads …
- CVE-2008-2931HIGHCVSS 7.8EG 7.82008-07-09
The do_change_type function in fs/namespace.c in the Linux kernel before 2.6.22 does not verify that the caller has the CAP_SYS_ADMIN capability, which allows local users to gain privileges or cause a denial of service by modifying the pro…
- CVE-2022-23921HIGHCVSS 7.5EG 7.82022-02-25
Exploitation of this vulnerability may result in local privilege escalation and code execution. GE maintains exploitation of this vulnerability is only possible if the attacker has login access to a machine actively running CIMPLICITY, the…
- CVE-2021-40476HIGHCVSS 7.5EG 7.82021-10-13
Windows AppContainer Elevation Of Privilege Vulnerability
- CVE-2020-1378HIGHCVSS 7.5EG 7.82020-08-17
An elevation of privilege vulnerability exists when the Windows Kernel API improperly handles registry objects in memory. An attacker who successfully exploited the vulnerability could gain elevated privileges on a targeted system. A local…
- CVE-2022-36833HIGHCVSS 7.3EG 7.82022-08-05
Improper Privilege Management vulnerability in Game Optimizing Service prior to versions 3.3.04.0 in Android 10, and 3.5.04.8 in Android 11 and above allows local attacker to execute hidden function for developer by changing package name.
- CVE-2022-31219HIGHCVSS 7.3EG 7.82022-06-15
Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file …
- CVE-2022-0556HIGHCVSS 7.3EG 7.82022-04-11
A local privilege escalation vulnerability caused by incorrect permission assignment in some directories of the Zyxel AP Configurator (ZAC) version 1.1.4, which could allow an attacker to execute arbitrary code as a local administrator.
- CVE-2021-31843HIGHCVSS 7.3EG 7.82021-09-17
Improper privileges management vulnerability in McAfee Endpoint Security (ENS) Windows prior to 10.7.0 September 2021 Update allows local users to access files which they would otherwise not have access to via manipulating junction links t…
- CVE-2021-31938HIGHCVSS 7.3EG 7.82021-06-08
Microsoft VsCode Kubernetes Tools Extension Elevation of Privilege Vulnerability
- CVE-2021-1704HIGHCVSS 7.3EG 7.82021-01-12
Windows Hyper-V Elevation of Privilege Vulnerability
- CVE-2022-4294HIGHCVSS 7.1EG 7.82023-01-10
Norton, Avira, Avast and AVG Antivirus for Windows may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resou…
- CVE-2021-31833HIGHCVSS 7.1EG 7.82022-01-04
Potential product security bypass vulnerability in McAfee Application and Change Control (MACC) prior to version 8.3.4 allows a locally logged in attacker to circumvent the application solidification protection provided by MACC, permitting…
- CVE-2021-43239HIGHCVSS 7.1EG 7.82021-12-15
Windows Recovery Environment Agent Elevation of Privilege Vulnerability
- CVE-2022-30298HIGHCVSS 7.0EG 7.82022-09-06
An improper privilege management vulnerability [CWE-269] in Fortinet FortiSOAR before 7.2.1 allows a GUI user who has already found a way to modify system files (via another, unrelated and hypothetical exploit) to execute arbitrary Python …
- CVE-2022-21903HIGHCVSS 7.0EG 7.82022-01-11
Windows GDI Elevation of Privilege Vulnerability
- CVE-2022-21887HIGHCVSS 7.0EG 7.82022-01-11
Win32k Elevation of Privilege Vulnerability
- CVE-2022-21881HIGHCVSS 7.0EG 7.82022-01-11
Windows Kernel Elevation of Privilege Vulnerability
- CVE-2022-21875HIGHCVSS 7.0EG 7.82022-01-11
Windows Storage Elevation of Privilege Vulnerability
- CVE-2022-21873HIGHCVSS 7.0EG 7.82022-01-11
Tile Data Repository Elevation of Privilege Vulnerability
- CVE-2022-21872HIGHCVSS 7.0EG 7.82022-01-11
Windows Event Tracing Elevation of Privilege Vulnerability
- CVE-2022-21871HIGHCVSS 7.0EG 7.82022-01-11
Microsoft Diagnostics Hub Standard Collector Runtime Elevation of Privilege Vulnerability
- CVE-2022-21870HIGHCVSS 7.0EG 7.82022-01-11
Tablet Windows User Interface Application Core Elevation of Privilege Vulnerability
- CVE-2022-21869HIGHCVSS 7.0EG 7.82022-01-11
Clipboard User Service Elevation of Privilege Vulnerability
- CVE-2022-21861HIGHCVSS 7.0EG 7.82022-01-11
Task Flow Data Engine Elevation of Privilege Vulnerability
- CVE-2022-21834HIGHCVSS 7.0EG 7.82022-01-11
Windows User-mode Driver Framework Reflector Driver Elevation of Privilege Vulnerability
- CVE-2021-26442HIGHCVSS 7.0EG 7.82021-10-13
Windows HTTP.sys Elevation of Privilege Vulnerability
- CVE-2021-29645HIGHCVSS 7.0EG 7.82021-10-12
Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API with arbitrary arguments via a local pipe, leading to a local privilege escalation vulnerability. An attacker who exploits this issue could execute ar…
- CVE-2021-28440HIGHCVSS 7.0EG 7.82021-04-13
Windows Installer Elevation of Privilege Vulnerability
- CVE-2021-27072HIGHCVSS 7.0EG 7.82021-04-13
Win32k Elevation of Privilege Vulnerability
- CVE-2019-19345HIGHCVSS 7.0EG 7.82020-03-20
A vulnerability was found in all openshift/mediawiki-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was found in the container openshift/mediawiki-apb. An attacker with access to the…
- CVE-2018-10853HIGHCVSS 7.0EG 7.82018-09-11
A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilege(CPL) level while emulating unprivileged instructions. An unprivileged guest user…
- CVE-2022-26057HIGHCVSS 6.7EG 7.82022-06-15
Vulnerabilities in the Mint WorkBench allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Mint WorkBench installer file …
- CVE-2021-27767HIGHCVSS 6.7EG 7.82022-05-06
The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShi…
- CVE-2021-27766HIGHCVSS 6.7EG 7.82022-05-06
The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShie…
- CVE-2021-27765HIGHCVSS 6.7EG 7.82022-05-06
The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an Install…
- CVE-2022-1108HIGHCVSS 6.7EG 7.82022-04-22
A potential vulnerability due to improper buffer validation in the SMI handler LenovoFlashDeviceInterface in Thinkpad X1 Fold Gen 1 could be exploited by an attacker with local access and elevated privileges to execute arbitrary code.
- CVE-2022-1107HIGHCVSS 6.7EG 7.82022-04-22
During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovered in some ThinkPad models could be exploited by an attacker with elevated privileges that could all…
Map vulnerabilities like CWE-269 to your infrastructure
EchelonGraph correlates every CVE — across CWE-269 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →