Medium
CVE-2022-0026
A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with file creation privilege in the Windows…
Tag: Privilege Escalation
All CVEs associated with "Privilege Escalation". Page 33/66 • 7823 CVEs.
Subscribe CVEs: RSS for “Privilege Escalation” · RSS (High+Critical only)
About “Privilege Escalation”
A curated feed of “Privilege Escalation”-related CVEs appears below. We currently track 7823 CVEs for this tag (all time). In the last 365 days, 1227 were published. Average CVSS is 7.7 (all time; 7.9 over 365d), and 84% are rated High/Critical (all time). Top CWEs (last 365 days): CWE-269 - Improper Privilege Management, CWE-266 - Incorrect Privilege Assignment, CWE-862 - Missing Authorization.
In our taxonomy this topic maps to a LOW impact class. Vendor advisories and release notes are key. Verify compatibility matrices, prefer supported long term versions, and stage rollouts with monitoring. Use the filters below to sort by CVSS, risk and CWE. Each detail page highlights vendor advisories and mitigation tips.
CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).
CVSS ≥ 0.0
2022-05-11
Medium
CVE-2022-0025
A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with file creation privilege in the Windows…
High
CVE-2021-37851
Local privilege escalation in Windows products of ESET allows user who is logged into the system to exploit repair feature of the installer to run malicious code with higher privileges. This issue af…
2022-05-10
High
CVE-2022-29151
Windows Cluster Shared Volume (CSV) Elevation of Privilege Vulnerability
High
CVE-2022-29150
Windows Cluster Shared Volume (CSV) Elevation of Privilege Vulnerability
High
CVE-2022-29142
Windows Kernel Elevation of Privilege Vulnerability
High
CVE-2022-29138
Windows Clustered Shared Volume Elevation of Privilege Vulnerability
High
CVE-2022-29135
Windows Cluster Shared Volume (CSV) Elevation of Privilege Vulnerability
High
CVE-2022-29133
Windows Kernel Elevation of Privilege Vulnerability
High
CVE-2022-29132
Windows Print Spooler Elevation of Privilege Vulnerability
High
CVE-2022-29126
Tablet Windows User Interface Application Core Elevation of Privilege Vulnerability
High
CVE-2022-29125
Windows Push Notifications Apps Elevation of Privilege Vulnerability
High
CVE-2022-29113
Windows Digital Media Receiver Elevation of Privilege Vulnerability
High
CVE-2022-29106
Windows Hyper-V Shared Virtual Disk Elevation of Privilege Vulnerability
High
CVE-2022-29104
Windows Print Spooler Elevation of Privilege Vulnerability
High
CVE-2022-29103
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
High
CVE-2022-26939
Storage Spaces Direct Elevation of Privilege Vulnerability
High
CVE-2022-26938
Storage Spaces Direct Elevation of Privilege Vulnerability
High
CVE-2022-26932
Storage Spaces Direct Elevation of Privilege Vulnerability
High
CVE-2022-26931
Windows Kerberos Elevation of Privilege Vulnerability
High
CVE-2022-26923
Active Directory Domain Services Elevation of Privilege Vulnerability
High
CVE-2022-23279
Windows ALPC Elevation of Privilege Vulnerability
High
CVE-2022-22016
Windows PlayToManager Elevation of Privilege Vulnerability
High
CVE-2022-21978
Microsoft Exchange Server Elevation of Privilege Vulnerability
High
CVE-2022-27167
Privilege escalation vulnerability in Windows products of ESET, spol. s r.o. allows attacker to exploit "Repair" and "Uninstall" features what may lead to arbitrary file deletion. This issue affects:…
High
CVE-2022-1537
file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary…
High
CVE-2022-1397
API Privilege Escalation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Full system takeover.
2022-05-06
Medium
CVE-2021-27767
The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability w…
Medium
CVE-2021-27766
The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability wa…
Medium
CVE-2021-27765
The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerabilit…
High
CVE-2021-42743
A misconfiguration in the node default path allows for local privilege escalation from a lower privileged user to the Splunk user in Splunk Enterprise versions before 8.1.1 on Windows.
Critical
CVE-2022-24877
Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to expose sensitive data…
Critical
CVE-2022-24817
Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are v…
2022-05-05
High
CVE-2021-25268
Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Firewall older than version 19.0 GA.
Medium
CVE-2021-25267
Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 19.0 GA.
Medium
CVE-2022-27634
On 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, BIG-IP APM does not properly validate configurations, allowing an authenticated attacker with high privileges to manipulate…
2022-05-04
High
CVE-2021-42192
Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation.
2022-05-02
High
CVE-2022-29849
In Progress OpenEdge before 11.7.14 and 12.x before 12.2.9, certain SUID binaries within the OpenEdge application were susceptible to privilege escalation. If exploited, a local attacker could elevat…
2022-04-29
Medium
CVE-2021-3982
Linux distributions using CAP_SYS_NICE for gnome-shell may be exposed to a privilege escalation issue. An attacker, with low privilege permissions, may take advantage of the way CAP_SYS_NICE is curre…
High
CVE-2022-1227
A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability…
Critical
CVE-2021-44596
Wondershare LTD Dr. Fone as of 2021-12-06 version is affected by Remote code execution. Due to software design flaws an unauthenticated user can communicate over UDP with the "InstallAssistService.ex…
2022-04-28
Medium
CVE-2022-22441
IBM InfoSphere Information Server 11.7 could allow an authenticated user to view information of higher privileged users and groups due to a privilege escalation vulnerability. IBM X-Force ID: 224426.
High
CVE-2022-22782
The Zoom Client for Meetings for Windows prior to version 5.9.7, Zoom Rooms for Conference Room for Windows prior to version 5.10.0, Zoom Plugins for Microsoft Outlook for Windows prior to version 5.…
High
CVE-2021-33436
NoMachine for Windows prior to version 6.15.1 and 7.5.2 suffer from local privilege escalation due to the lack of safe DLL loading. This vulnerability allows local non-privileged users to perform DLL…
2022-04-27
High
CVE-2021-34591
In Bender/ebee Charge Controllers in multiple versions are prone to Local privilege Escalation. An authenticated attacker could get root access via the suid applications socat, ip udhcpc and ifplugd.
High
CVE-2022-29505
Due to build misconfiguration in openssl dependency, LINE for Windows before 7.8 is vulnerable to DLL injection that could lead to privilege escalation.
High
CVE-2022-27905
In ControlUp Real-Time Agent before 8.6, an unquoted path can result in privilege escalation. An attacker would require write permissions to the root level of the OS drive (C:\) to exploit this.
2022-04-22
High
CVE-2022-0192
A DLL search path vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow privilege escalation.
High
CVE-2020-14123
There is a pointer double free vulnerability in Some MIUI Services. When a function is called, the memory pointer is copied to two function modules, and an attacker can cause the pointer to be repeat…
2022-04-20
Medium
CVE-2021-43986
The setup program for the affected product configures its files and folders with full access, which may allow unauthorized users permission to replace original binaries and achieve privilege escalati…
Medium
CVE-2021-38483
The affected product is vulnerable to misconfigured binaries, allowing users on the target PC with SYSTEM level privileges access to overwrite the binary and modify files to gain privilege escalation.
2022-04-15
High
CVE-2022-29072
7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll…
High
CVE-2022-26921
Visual Studio Code Elevation of Privilege Vulnerability
High
CVE-2022-26914
Win32k Elevation of Privilege Vulnerability
High
CVE-2022-26904
Windows User Profile Service Elevation of Privilege Vulnerability
High
CVE-2022-26828
Windows Bluetooth Driver Elevation of Privilege Vulnerability
High
CVE-2022-26827
Windows File Server Resource Management Service Elevation of Privilege Vulnerability
High
CVE-2022-26810
Windows File Server Resource Management Service Elevation of Privilege Vulnerability
High
CVE-2022-26808
Windows File Explorer Elevation of Privilege Vulnerability
High
CVE-2022-26807
Windows Work Folder Service Elevation of Privilege Vulnerability
High
CVE-2022-26803
Windows Print Spooler Elevation of Privilege Vulnerability
High
CVE-2022-26802
Windows Print Spooler Elevation of Privilege Vulnerability
High
CVE-2022-26801
Windows Print Spooler Elevation of Privilege Vulnerability
High
CVE-2022-26798
Windows Print Spooler Elevation of Privilege Vulnerability
High
CVE-2022-26797
Windows Print Spooler Elevation of Privilege Vulnerability
High
CVE-2022-26796
Windows Print Spooler Elevation of Privilege Vulnerability
High
CVE-2022-26795
Windows Print Spooler Elevation of Privilege Vulnerability
High
CVE-2022-26794
Windows Print Spooler Elevation of Privilege Vulnerability
High
CVE-2022-26793
Windows Print Spooler Elevation of Privilege Vulnerability
High
CVE-2022-26792
Windows Print Spooler Elevation of Privilege Vulnerability
High
CVE-2022-26791
Windows Print Spooler Elevation of Privilege Vulnerability
High
CVE-2022-26790
Windows Print Spooler Elevation of Privilege Vulnerability
High
CVE-2022-26789
Windows Print Spooler Elevation of Privilege Vulnerability
High
CVE-2022-26788
PowerShell Elevation of Privilege Vulnerability
High
CVE-2022-26787
Windows Print Spooler Elevation of Privilege Vulnerability
High
CVE-2022-26786
Windows Print Spooler Elevation of Privilege Vulnerability
High
CVE-2022-24550
Windows Telephony Server Elevation of Privilege Vulnerability
High
CVE-2022-24549
Windows AppX Package Manager Elevation of Privilege Vulnerability
High
CVE-2022-24547
Windows Digital Media Receiver Elevation of Privilege Vulnerability
High
CVE-2022-24546
Windows DWM Core Library Elevation of Privilege Vulnerability
High
CVE-2022-24544
Windows Kerberos Elevation of Privilege Vulnerability
High
CVE-2022-24542
Windows Win32k Elevation of Privilege Vulnerability
High
CVE-2022-24540
Windows ALPC Elevation of Privilege Vulnerability
High
CVE-2022-24530
Windows Installer Elevation of Privilege Vulnerability
High
CVE-2022-24527
Microsoft Endpoint Configuration Manager Elevation of Privilege Vulnerability
High
CVE-2022-24521
Windows Common Log File System Driver Elevation of Privilege Vulnerability
High
CVE-2022-24513
Visual Studio Elevation of Privilege Vulnerability
High
CVE-2022-24499
Windows Installer Elevation of Privilege Vulnerability
High
CVE-2022-24496
Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
High
CVE-2022-24494
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
High
CVE-2022-24489
Cluster Client Failover (CCF) Elevation of Privilege Vulnerability
High
CVE-2022-24488
Windows Desktop Bridge Elevation of Privilege Vulnerability
High
CVE-2022-24486
Windows Kerberos Elevation of Privilege Vulnerability
High
CVE-2022-24482
Windows ALPC Elevation of Privilege Vulnerability
High
CVE-2022-24481
Windows Common Log File System Driver Elevation of Privilege Vulnerability
High
CVE-2022-24479
Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
High
CVE-2022-24474
Windows Win32k Elevation of Privilege Vulnerability
2022-04-14
High
CVE-2022-25165
An issue was discovered in Amazon AWS VPN Client 2.0.0. A TOCTOU race condition exists during the validation of VPN configuration files. This allows parameters outside of the AWS VPN Client allow lis…
High
CVE-2022-22187
An Improper Privilege Management vulnerability in the Windows Installer framework used in the Juniper Networks Juniper Identity Management Service (JIMS) allows an unprivileged user to trigger a repa…
High
CVE-2022-1256
A local privilege escalation vulnerability in MA for Windows prior to 5.7.6 allows a local low privileged user to gain system privileges through running the repair functionality. Temporary file actio…
2022-04-13
High
CVE-2022-1347
Stored XSS in the "Username" & "Email" input fields leads to account takeover of Admin & Co-admin users in GitHub repository causefx/organizr prior to 2.1.1810. Account takeover and privilege escalat…
High
CVE-2022-22960
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access…
2022-04-12
High
CVE-2022-24411
Dell PowerScale OneFS 8.2.2 and above contain an elevation of privilege vulnerability. A local attacker with ISI_PRIV_LOGIN_SSH and/or ISI_PRIV_LOGIN_CONSOLE could potentially exploit this vulnerabil…
High
CVE-2021-42255
AppGuard Enterprise before 6.7.100.1 creates a Temporary File in a Directory with Insecure Permissions. Local users can gain SYSTEM privileges because a repair operation relies on the %TEMP% director…
High
CVE-2021-42029
A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) V15 (All versions), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 5), SIMATIC STEP 7 (TIA Portal) V17 (All versions < V…
2022-04-11
High
CVE-2022-27578
An attacker can perform a privilege escalation through the SICK OEE if the application is installed in a directory where non authenticated or low privilege users can modify its content.
High
CVE-2022-22964
VMware Horizon Agent for Linux (prior to 22.x) contains a local privilege escalation that allows a user to escalate to root due to a vulnerable configuration file.
High
CVE-2022-22962
VMware Horizon Agent for Linux (prior to 22.x) contains a local privilege escalation as a user is able to change the default shared folder location due to a vulnerable symbolic link. Successful explo…
Critical
CVE-2022-22258
The Wi-Fi module has an event notification vulnerability.Successful exploitation of this vulnerability may allow third-party applications to intercept event notifications and add information and resu…
High
CVE-2022-1316
Incorrect Permission Assignment for Critical Resource in GitHub repository zerotier/zerotierone prior to 1.8.8. Local Privilege Escalation
High
CVE-2022-0556
A local privilege escalation vulnerability caused by incorrect permission assignment in some directories of the Zyxel AP Configurator (ZAC) version 1.1.4, which could allow an attacker to execute arb…
2022-04-09
Medium
CVE-2022-1287
A vulnerability classified as critical was found in School Club Application System 1.0. This vulnerability affects a request to the file /scas/classes/Users.php?f=save_user. The manipulation with a P…
High
CVE-2022-27883
A link following vulnerability in Trend Micro Antivirus for Mac 11.5 could allow an attacker to create a specially-crafted file as a symlink that can lead to privilege escalation. Please note that an…
2022-04-08
Medium
CVE-2021-36293
Dell VNX2 for File version 8.1.21.266 and earlier, contain a privilege escalation vulnerability. A local malicious admin may potentially exploit vulnerability and gain elevated privileges.
Medium
CVE-2021-36290
Dell VNX2 for File version 8.1.21.266 and earlier, contain a privilege escalation vulnerability. A local malicious admin may potentially exploit vulnerability and gain privileges.
2022-04-05
High
CVE-2022-26912
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
High
CVE-2022-26909
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
High
CVE-2022-26908
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
High
CVE-2022-26900
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
High
CVE-2022-26895
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability