An issue was discovered in CALDERA 2.8.1. It does not properly segregate user privileges, resulting in non-admin users having access to read and modify configuration or other components that should only be accessible by admin users.

CVE-2021-42956HIGHCVSS 7.8EG 7.8

2021-11-17

Zoho Remote Access Plus Server Windows Desktop Binary fixed in 10.1.2132.6 is affected by a sensitive information disclosure vulnerability. Due to improper privilege management, the process launches as the logged in user, so memory dump ca…

CVE-2021-43034HIGHCVSS 7.8EG 7.8

2021-12-06

An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A world writable file allowed local users to execute arbitrary code as the user apache, leading to privilege escalation.

CVE-2021-43040HIGHCVSS 8.8EG 8.8

2021-12-06

An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The privileged vaultServer could be leveraged to create arbitrary writable files, leading to privilege escalation.

CVE-2021-43055MEDIUMCVSS 5.9EG 8.8

2022-01-11

The eFTL Server component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows clients to inherit the permissi…

CVE-2021-43076MEDIUMCVSS 6.3EG 6.5

2022-09-06

An improper privilege management vulnerability [CWE-269] in FortiADC versions 6.2.1 and below, 6.1.5 and below, 6.0.4 and below, 5.4.5 and below and 5.3.7 and below may allow a remote authenticated attacker with restricted user profile to …

CVE-2021-4314MEDIUMCVSS 5.3EG 5.3

2023-01-18

It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only in the situation when zOSMF doesn’t have the APAR PH12143 applied. This issue…

CVE-2021-43207HIGHCVSS 7.8EG 7.8

2021-12-15

Windows Common Log File System Driver Elevation of Privilege Vulnerability

CVE-2021-43211MEDIUMCVSS 5.5EG 5.5

2021-11-24

Windows 10 Update Assistant Elevation of Privilege Vulnerability

CVE-2021-43223HIGHCVSS 7.8EG 7.8

2021-12-15

Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

CVE-2021-43226HIGHCVSS 7.8EG 9.0⚠ KEV

2021-12-15

Windows Common Log File System Driver Elevation of Privilege Vulnerability

CVE-2021-43229HIGHCVSS 7.8EG 7.8

2021-12-15

Windows NTFS Elevation of Privilege Vulnerability

CVE-2021-43230HIGHCVSS 7.8EG 7.8

2021-12-15

Windows NTFS Elevation of Privilege Vulnerability

CVE-2021-43231HIGHCVSS 7.8EG 7.8

2021-12-15

Windows NTFS Elevation of Privilege Vulnerability

CVE-2021-43237HIGHCVSS 7.8EG 7.3

2021-12-15

Windows Setup Elevation of Privilege Vulnerability

CVE-2021-43238HIGHCVSS 7.8EG 7.8

2021-12-15

Windows Remote Access Elevation of Privilege Vulnerability

CVE-2021-43239HIGHCVSS 7.1EG 7.8

2021-12-15

Windows Recovery Environment Agent Elevation of Privilege Vulnerability

CVE-2021-43240HIGHCVSS 7.8EG 7.8

2021-12-15

NTFS Set Short Name Elevation of Privilege Vulnerability

CVE-2021-43245HIGHCVSS 7.8EG 7.8

2021-12-15

Windows Digital TV Tuner Elevation of Privilege Vulnerability

CVE-2021-43247HIGHCVSS 7.8EG 7.8

2021-12-15

Windows TCP/IP Driver Elevation of Privilege Vulnerability

CVE-2021-43248HIGHCVSS 7.8EG 7.8

2021-12-15

Windows Digital Media Receiver Elevation of Privilege Vulnerability

CVE-2021-43397HIGHCVSS 8.8EG 8.8

2021-11-11

LiquidFiles before 3.6.3 allows remote attackers to elevate their privileges from Admin (or User Admin) to Sysadmin.

CVE-2021-43528MEDIUMCVSS 6.5EG 6.5

2021-12-08

Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to this area and did not receive chrome-level privileges, but could be used as a stepping stone to further an attack with oth…

CVE-2021-43768MEDIUMCVSS 5.3EG 5.3

2025-10-24

In Malwarebytes For Teams v.1.0.990 and before and fixed in v.1.0.1003 and later a privilege escalation can occur via the COM interface running in mbamservice.exe.

CVE-2021-43793MEDIUMCVSS 4.3EG 4.3

2021-12-01

Discourse is an open source discussion platform. In affected versions a vulnerability in the Polls feature allowed users to vote multiple times in a single-option poll. The problem is patched in the latest tests-passed, beta and stable ver…

CVE-2021-43828HIGHCVSS 7.5EG 7.5

2021-12-14

PatrOwl is a free and open-source solution for orchestrating Security Operations. In versions prior to 1.77 an improper privilege management (IDOR) has been found in PatrowlManager. All imports findings file is placed under /media/imports/…

CVE-2021-43835HIGHCVSS 7.2EG 7.2

2021-12-15

Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions Sulu users who have access to any subset of the admin UI are able to elevate their privilege. Over the API it was possible for them t…

CVE-2021-43858HIGHCVSS 8.8EG 8.8

2021-12-27

MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The p…

CVE-2021-43860HIGHCVSS 8.2EG 8.2

2022-01-12

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions…

CVE-2021-43876HIGHCVSS 8.8EG 8.8

2021-12-29

Microsoft SharePoint Elevation of Privilege Vulnerability

CVE-2021-43880MEDIUMCVSS 5.5EG 5.5

2021-12-15

Windows Mobile Device Management Elevation of Privilege Vulnerability

CVE-2021-43883HIGHCVSS 7.8EG 7.8

2021-12-15

Windows Installer Elevation of Privilege Vulnerability

CVE-2021-43893HIGHCVSS 7.5EG 7.5

2021-12-15

Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability

CVE-2021-44019HIGHCVSS 7.8EG 7.8

2021-12-03

An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute lo…

CVE-2021-44020HIGHCVSS 7.8EG 7.8

2021-12-03

An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute lo…

CVE-2021-44021HIGHCVSS 7.8EG 7.8

2021-12-03

An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute lo…

CVE-2021-44038HIGHCVSS 7.8EG 7.8

2021-11-19

An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation…

CVE-2021-44049HIGHCVSS 7.8EG 7.8

2022-01-15

CyberArk Endpoint Privilege Manager (EPM) through 11.5.3.328 before 2021-12-20 allows a local user to gain elevated privileges via a Trojan horse Procmon64.exe in the user's Temp directory.

CVE-2021-44226HIGHCVSS 7.3EG 7.3

2022-03-23

Razer Synapse before 3.7.0228.022817 allows privilege escalation because it relies on %PROGRAMDATA%\Razer\Synapse3\Service\bin even if %PROGRAMDATA%\Razer has been created by any unprivileged user before Synapse is installed. The unprivile…

CVE-2021-44466HIGHCVSS 7.3EG 7.3

2021-12-30

Bitmask Riseup VPN 0.21.6 contains a local privilege escalation flaw due to improper access controls. When the software is installed with a non-default installation directory off of the system root, the installer fails to properly set ACLs…

CVE-2021-44828HIGHCVSS 7.8EG 7.8

2022-01-14

Arm Mali GPU Kernel Driver (Midgard r26p0 through r30p0, Bifrost r0p0 through r34p0, and Valhall r19p0 through r34p0) allows a non-privileged user to achieve write access to read-only memory, and possibly obtain root privileges, corrupt me…

CVE-2021-44840LOWCVSS 2.7EG 2.7

2022-01-18

An issue was discovered in Delta RM 1.2. Using an privileged account, it is possible to edit, create, and delete risk labels, such as Criticality and Priority Indication labels. By using the /core/table/query endpoint, and by using a POST …

CVE-2021-44857MEDIUMCVSS 6.5EG 6.5

2021-12-17

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=mcrundo followed by action=mcrrestore to replace the content of any arbitrary page (that the user doesn't have…

CVE-2021-44899HIGHCVSS 7.8EG 7.8

2022-02-04

Micro-Star International (MSI) Center <= 1.0.31.0 is vulnerable to multiple Privilege Escalation vulnerabilities in the atidgllk.sys, atillk64.sys, MODAPI.sys, NTIOLib.sys, NTIOLib_X64.sys, WinRing0.sys, WinRing0x64.sys drivers components.…

CVE-2021-44900HIGHCVSS 7.8EG 7.8

2022-02-04

Micro-Star International (MSI) App Player <= 4.280.1.6309 is vulnerable to multiple Privilege Escalation (LPE/EoP) vulnerabilities in the NTIOLib_X64.sys and BstkDrv_msi2.sys drivers components. All the vulnerabilities are triggered by sen…

CVE-2021-44901HIGHCVSS 7.8EG 7.8

2022-02-04

Micro-Star International (MSI) Dragon Center <= 2.0.116.0 is vulnerable to multiple Privilege Escalation (LPE/EoP) vulnerabilities in the atidgllk.sys, atillk64.sys, MODAPI.sys, NTIOLib.sys, NTIOLib_X64.sys, WinRing0.sys, WinRing0x64.sys d…

CVE-2021-44903HIGHCVSS 7.8EG 7.8

2022-02-04

Micro-Star International (MSI) Center Pro <= 2.0.16.0 is vulnerable to multiple Privilege Escalation (LPE/EoP) vulnerabilities in the atidgllk.sys, atillk64.sys, MODAPI.sys, NTIOLib.sys, NTIOLib_X64.sys, WinRing0.sys, WinRing0x64.sys drive…

CVE-2021-44981HIGHCVSS 8.8EG 8.8

2022-01-24

In QuickBox Pro v2.5.8 and below, the config.php file has a variable which takes a GET parameter value and parses it into a shell_exec(''); function without properly sanitizing any shell arguments, therefore remote code execution is possib…

CVE-2021-45222HIGHCVSS 8.8EG 8.8

2022-01-24

An issue was discovered in COINS Construction Cloud 11.12. Due to logical flaws in the human ressources interface, it is vulnerable to privilege escalation by HR personnel.

CVE-2021-45231HIGHCVSS 7.8EG 7.8

2022-01-10

A link following privilege escalation vulnerability in Trend Micro Apex One (on-prem and SaaS) and Trend Micro Worry-Free Business Security (10.0 SP1 and Services) could allow a local attacker to create a specially crafted file with arbitr…

CWE-269— Improper Privilege Management

CVEs classified under CWE-269page 48 of 85

Map vulnerabilities like CWE-269 to your infrastructure