High
CVE-2020-13551
An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In privilege escalation via PostgreSQL executable, an att…
Tag: Privilege Escalation
All CVEs associated with "Privilege Escalation". Page 40/66 • 7823 CVEs.
Subscribe CVEs: RSS for “Privilege Escalation” · RSS (High+Critical only)
About “Privilege Escalation”
A curated feed of “Privilege Escalation”-related CVEs appears below. We currently track 7823 CVEs for this tag (all time). In the last 365 days, 1227 were published. Average CVSS is 7.7 (all time; 7.9 over 365d), and 84% are rated High/Critical (all time). Top CWEs (last 365 days): CWE-269 - Improper Privilege Management, CWE-266 - Incorrect Privilege Assignment, CWE-862 - Missing Authorization.
In our taxonomy this topic maps to a LOW impact class. Vendor advisories and release notes are key. Verify compatibility matrices, prefer supported long term versions, and stage rollouts with monitoring. Use the filters below to sort by CVSS, risk and CWE. Each detail page highlights vendor advisories and mitigation tips.
CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).
CVSS ≥ 0.0
2021-02-17
Medium
CVE-2021-26559
Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when `…
Critical
CVE-2021-23885
Privilege escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.8 allows an authenticated user to gain elevated privileges through the User Interface and execute commands on the appliance…
2021-02-16
High
CVE-2021-20075
Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows for privilege escalation via configd.
2021-02-10
Low
CVE-2021-21296
Fleet is an open source osquery manager. In Fleet before version 3.7.0 a malicious actor with a valid node key can send a badly formatted request that causes the Fleet server to exit, resulting in de…
High
CVE-2021-23873
Privilege Escalation vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and perform arbitrary file deletion as the SYSTEM user potentially…
2021-02-09
High
CVE-2020-26192
Dell EMC PowerScale OneFS versions 8.2.0 - 9.1.0 contain a privilege escalation vulnerability. A non-admin user with either ISI_PRIV_LOGIN_CONSOLE or ISI_PRIV_LOGIN_SSH may potentially exploit this v…
High
CVE-2020-26191
Dell EMC PowerScale OneFS versions 8.1.0 - 9.1.0 contain a privilege escalation vulnerability. A user with ISI_PRIV_JOB_ENGINE may use the PermissionRepair job to grant themselves the highest level o…
High
CVE-2021-3394
Millennium Millewin (also known as "Cartella clinica") 13.39.028, 13.39.28.3342, and 13.39.146.1 has insecure folder permissions allowing a malicious user for a local privilege escalation.
High
CVE-2021-21117
Insufficient policy enforcement in Cryptohome in Google Chrome prior to 88.0.4324.96 allowed a local attacker to perform OS-level privilege escalation via a crafted file.
2021-02-06
High
CVE-2021-22299
There is a local privilege escalation vulnerability in some Huawei products. A local, authenticated attacker could craft specific commands to exploit this vulnerability. Successful exploitation may c…
2021-02-05
High
CVE-2021-26708
A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOCK implementation are caused by wrong locking in net/vmw_vsock/af_vsock.c. The ra…
2021-02-03
Medium
CVE-2020-35152
Cloudflare WARP for Windows allows privilege escalation due to an unquoted service path. A malicious user or process running with non-administrative privileges can become an administrator by abusing…
2021-02-02
High
CVE-2020-8672
Out of bound read in BIOS firmware for 8th, 9th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 Series Processors may allow an unauthenticated user to potentially enable elevation of…
Medium
CVE-2021-21284
In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns…
2021-01-29
High
CVE-2020-35145
Acronis True Image for Windows prior to 2021 Update 3 allowed local privilege escalation due to a DLL hijacking vulnerability in multiple components, aka an Untrusted Search Path issue.
2021-01-28
High
CVE-2020-35517
A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system daemon where a privileged guest user is able to create a device special file in the shared di…
2021-01-26
High
CVE-2021-3156
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends wit…
High
CVE-2021-22159
Insider Threat Management Windows Agent Local Privilege Escalation Vulnerability The Proofpoint Insider Threat Management (formerly ObserveIT) Agent for Windows before 7.4.3, 7.5.4, 7.6.5, 7.7.5, 7.8…
High
CVE-2020-25737
An elevation of privilege vulnerability exists in Hackolade versions prior 4.2.0 on Windows has an issue in specific deployment scenarios that could allow local users to gain elevated privileges duri…
2021-01-21
Medium
CVE-2020-3687
Local privilege escalation in admin services in Windows environment can occur due to an arbitrary read issue.
Medium
CVE-2020-11183
A process can potentially cause a buffer overflow in the display service allowing privilege escalation by executing code as that service in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consum…
2021-01-20
High
CVE-2020-6024
Check Point SmartConsole before R80.10 Build 185, R80.20 Build 119, R80.30 before Build 94, R80.40 before Build 415, and R81 before Build 548 were vulnerable to a possible local privilege escalation…
High
CVE-2020-14360
A flaw was found in the X.Org Server before version 1.20.10. An out-of-bounds access in the XkbSetMap function may lead to a privilege escalation vulnerability. The highest threat from this vulnerabi…
2021-01-15
High
CVE-2021-3162
Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.
High
CVE-2021-0223
A local privilege escalation vulnerability in telnetd.real of Juniper Networks Junos OS may allow a locally authenticated shell user to escalate privileges and execute arbitrary commands as root. tel…
2021-01-13
High
CVE-2021-21011
Adobe Captivate 2019 version 11.5.1.499 (and earlier) is affected by an uncontrolled search path element vulnerability that could lead to privilege escalation. An attacker with permissions to write t…
Medium
CVE-2020-9209
There is a privilege escalation vulnerability in SMC2.0 product. Some files in a directory of a module are located improperly. It does not apply the directory limitation. Attackers can exploit this v…
2021-01-12
High
CVE-2021-1719
Microsoft SharePoint Elevation of Privilege Vulnerability
High
CVE-2021-1712
Microsoft SharePoint Elevation of Privilege Vulnerability
High
CVE-2021-1709
Windows Win32k Elevation of Privilege Vulnerability
High
CVE-2021-1706
Windows LUAFV Elevation of Privilege Vulnerability
High
CVE-2021-1704
Windows Hyper-V Elevation of Privilege Vulnerability
High
CVE-2021-1703
Windows Event Logging Service Elevation of Privilege Vulnerability
High
CVE-2021-1702
Windows Remote Procedure Call Runtime Elevation of Privilege Vulnerability
High
CVE-2021-1697
Windows InstallService Elevation of Privilege Vulnerability
High
CVE-2021-1695
Windows Print Spooler Elevation of Privilege Vulnerability
High
CVE-2021-1694
Windows Update Stack Elevation of Privilege Vulnerability
High
CVE-2021-1693
Windows CSC Service Elevation of Privilege Vulnerability
High
CVE-2021-1690
Windows WalletService Elevation of Privilege Vulnerability
High
CVE-2021-1689
Windows Multipoint Management Elevation of Privilege Vulnerability
High
CVE-2021-1688
Windows CSC Service Elevation of Privilege Vulnerability
High
CVE-2021-1687
Windows WalletService Elevation of Privilege Vulnerability
High
CVE-2021-1686
Windows WalletService Elevation of Privilege Vulnerability
High
CVE-2021-1685
Windows AppX Deployment Extensions Elevation of Privilege Vulnerability
High
CVE-2021-1682
Windows Kernel Elevation of Privilege Vulnerability
High
CVE-2021-1681
Windows WalletService Elevation of Privilege Vulnerability
High
CVE-2021-1680
Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability
High
CVE-2021-1662
Windows Event Tracing Elevation of Privilege Vulnerability
High
CVE-2021-1661
Windows Installer Elevation of Privilege Vulnerability
High
CVE-2021-1659
Windows CSC Service Elevation of Privilege Vulnerability
High
CVE-2021-1655
Windows CSC Service Elevation of Privilege Vulnerability
High
CVE-2021-1654
Windows CSC Service Elevation of Privilege Vulnerability
High
CVE-2021-1653
Windows CSC Service Elevation of Privilege Vulnerability
High
CVE-2021-1652
Windows CSC Service Elevation of Privilege Vulnerability
High
CVE-2021-1651
Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability
High
CVE-2021-1650
Windows Runtime C++ Template Library Elevation of Privilege Vulnerability
High
CVE-2021-1649
Active Template Library Elevation of Privilege Vulnerability
High
CVE-2021-1648
Microsoft splwow64 Elevation of Privilege Vulnerability
Medium
CVE-2021-1646
Windows WLAN Service Elevation of Privilege Vulnerability
High
CVE-2021-1642
Windows AppX Deployment Extensions Elevation of Privilege Vulnerability
High
CVE-2021-1636
Microsoft SQL Elevation of Privilege Vulnerability
High
CVE-2020-26050
SaferVPN for Windows Ver 5.0.3.3 through 5.0.4.15 could allow local privilege escalation from low privileged users to SYSTEM via a crafted openssl configuration file. This issue is similar to CVE-201…
2021-01-11
High
CVE-2020-17534
There exists a race condition between the deletion of the temporary file and the creation of the temporary directory in `webkit` subproject of HTML/Java API version 1.7. A similar vulnerability has r…
2021-01-08
High
CVE-2020-16021
Race in image burner in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process to perform OS-level privilege escalation via a malicious file.
2021-01-05
High
CVE-2020-26181
Dell EMC Isilon OneFS versions 8.1 and later and Dell EMC PowerScale OneFS version 9.0.0 contain a privilege escalation vulnerability on a SmartLock Compliance mode cluster. The compadmin user connec…
High
CVE-2020-13541
An exploitable local privilege elevation vulnerability exists in the file system permissions of the Mobile-911 Server V2.5 install directory. Depending on the vector chosen, an attacker can overwrite…
2021-01-04
Critical
CVE-2020-36157
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles. Due to the lack of filtering on the role parameter that cou…
Critical
CVE-2020-36156
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update. Any user with wp-admin access to the profile.php page cou…
Critical
CVE-2020-36155
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. An attacker could supply an array parameter for sensitive me…
High
CVE-2020-4912
IBM Cloud Pak System 2.3 Self Service Console could allow a privilege escalation by capturing the user request URL when logged in as a privileged user. IBM X-Force ID: 191287.
2021-01-01
High
CVE-2020-35935
The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple Role support is enabled. (The mechanism…
2020-12-29
Medium
CVE-2020-27643
The %PROGRAMDATA%\1E\Client directory in 1E Client 5.0.0.745 and 4.1.0.267 allows remote authenticated users and local users to create and modify files in protected directories (where they would not…
2020-12-28
Critical
CVE-2020-27172
An issue was discovered in G-Data before 25.5.9.25 using Symbolic links, it is possible to abuse the infected-file restore mechanism to achieve arbitrary write that leads to elevation of privileges.
2020-12-24
Medium
CVE-2020-9137
There is a privilege escalation vulnerability in some versions of CloudEngine 12800,CloudEngine 5800,CloudEngine 6800 and CloudEngine 7800. Due to insufficient input validation, a local attacker with…
Medium
CVE-2020-9119
There is a privilege escalation vulnerability on some Huawei smart phones due to design defects. The attacker needs to physically contact the mobile phone and obtain higher privileges, and execute re…
2020-12-22
High
CVE-2020-24677
Vulnerabilities in the S+ Operations and S+ Historian web applications can lead to a possible code execution and privilege escalation, redirect the user somewhere else or download unwanted data.
High
CVE-2020-24676
In Symphony Plus Operations and Symphony Plus Historian, some services can be vulnerable to privilege escalation attacks. An unprivileged (but authenticated) user could execute arbitrary code and res…
High
CVE-2020-29396
A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticated users to execute arbitrary code, leadi…
Medium
CVE-2019-11782
Improper access control in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users with access to contact management to modify user accounts, leading t…
High
CVE-2019-11781
Improper input validation in portal component in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier, allows remote attackers to trick victims into modifying their account via crafte…
Medium
CVE-2018-15645
Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticated users to create arbitrary records via crafted payloads,…
2020-12-18
High
CVE-2020-27781
User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential privilege escalation. An Open Stack Manila user can request access to a share to…
High
CVE-2020-13535
A privilege escalation vulnerability exists in Kepware LinkMaster 3.0.94.0. In its default configuration, an attacker can globally overwrite service configuration to execute arbitrary code with NT SY…
High
CVE-2020-13519
A privilege escalation vulnerability exists in the WinRing0x64 Driver IRP 0x9c402088 functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (IRP) can cause increased privileges. An a…
High
CVE-2020-13515
A privilege escalation vulnerability exists in the WinRing0x64 Driver IRP 0x9c40a148 functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (IRP) can cause an adversary to obtain ele…
High
CVE-2020-13514
A privilege escalation vulnerability exists in the WinRing0x64 Driver Privileged I/O Write IRPs functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (IRP) can cause increased privi…
High
CVE-2020-13513
A privilege escalation vulnerability exists in the WinRing0x64 Driver Privileged I/O Write IRPs functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (IRP) can cause increased privi…
High
CVE-2020-13512
A privilege escalation vulnerability exists in the WinRing0x64 Driver Privileged I/O Write IRPs functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (IRP) can cause increased privi…
2020-12-17
High
CVE-2020-12517
On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vu…
2020-12-15
High
CVE-2020-29569
An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux kernel PV block backend expects the kernel thread handler to reset ring->xenblkd to NULL when st…
High
CVE-2020-25712
A flaw was found in xorg-x11-server before 1.20.10. A heap-buffer overflow in XkbSetDeviceInfo may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data…
2020-12-14
Critical
CVE-2020-8257
Improper privilege management on services run by Citrix Gateway Plug-in for Windows, versions before and including 13.0-61.48 and 12.1-58.15, lead to privilege escalation attacks
2020-12-11
High
CVE-2020-27786
A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue.…
2020-12-10
High
CVE-2020-4829
IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a local user to exploit a vulnerability in the ksu user command to gain root privileges. IBM X-Force ID: 189960.
High
CVE-2020-12594
A privilege escalation flaw allows a malicious, authenticated, privileged CLI user to escalate their privileges on the system and gain full control over the SMG appliance. This affects SMG prior to 1…
High
CVE-2020-17137
DirectX Graphics Kernel Elevation of Privilege Vulnerability
High
CVE-2020-17136
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
High
CVE-2020-17134
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
High
CVE-2020-17103
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Low
CVE-2020-17097
Windows Digital Media Receiver Elevation of Privilege Vulnerability
High
CVE-2020-17092
Windows Network Connections Service Elevation of Privilege Vulnerability
High
CVE-2020-17089
Microsoft SharePoint Elevation of Privilege Vulnerability
High
CVE-2020-16964
Windows Backup Engine Elevation of Privilege Vulnerability
High
CVE-2020-16963
Windows Backup Engine Elevation of Privilege Vulnerability
High
CVE-2020-16962
Windows Backup Engine Elevation of Privilege Vulnerability
High
CVE-2020-16961
Windows Backup Engine Elevation of Privilege Vulnerability
High
CVE-2020-16960
Windows Backup Engine Elevation of Privilege Vulnerability
High
CVE-2020-16959
Windows Backup Engine Elevation of Privilege Vulnerability
High
CVE-2020-16958
Windows Backup Engine Elevation of Privilege Vulnerability
2020-12-09
High
CVE-2020-2049
A local privilege escalation vulnerability exists in Palo Alto Networks Cortex XDR Agent on the Windows platform that allows an authenticated local Windows user to execute programs with SYSTEM privil…
High
CVE-2020-27614
AnyDesk for macOS versions 6.0.2 and older have a vulnerability in the XPC interface that does not properly validate client requests and allows local privilege escalation.
2020-12-03
High
CVE-2020-23740
In DriverGenius 9.61.5480.28 there is a local privilege escalation vulnerability in the driver wizard, attackers can use constructed programs to increase user privileges.
High
CVE-2020-28175
There is a local privilege escalation vulnerability in Alfredo Milani Comparetti SpeedFan 4.52. Attackers can use constructed programs to increase user privileges
High
CVE-2020-23735
In Saibo Cyber Game Accelerator 3.7.9 there is a local privilege escalation vulnerability. Attackers can use the constructed program to increase user privileges
2020-12-01
Medium
CVE-2020-28575
A heap-based buffer overflow privilege escalation vulnerability in Trend Micro ServerProtect for Linux 3.0 may allow an attacker to escalate privileges on affected installations. An attacker must fir…
High
CVE-2020-7335
Privilege Escalation vulnerability in Microsoft Windows client McAfee Total Protection (MTP) prior to 16.0.29 allows local users to gain elevated privileges via careful manipulation of a folder by cr…
High
CVE-2020-9114
FusionCompute versions 6.3.0, 6.3.1, 6.5.0, 6.5.1 and 8.0.0 have a privilege escalation vulnerability. Due to improper privilege management, an attacker with common privilege may access some specific…
2020-11-30
High
CVE-2020-8351
A privilege escalation vulnerability was reported in Lenovo PCManager prior to version 3.0.50.9162 that could allow an authenticated user to execute code with elevated privileges.
2020-11-24
High
CVE-2020-3985
The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3 and 3.4.x prior to 3.4.4 allows an access to set arbitrary authorization levels leading to a privilege escalation issue. An authenticated SD-WAN Orches…