Filtered by CWE-269
Filtered by vendor Subscriptions
Total 2281 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-31222 1 Apple 6 Ipados, Iphone Os, Macos and 3 more 2025-05-28 7.8 High
A correctness issue was addressed with improved checks. This issue is fixed in watchOS 11.5, macOS Sonoma 14.7.6, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, macOS Ventura 13.7.6. A user may be able to elevate privileges.
CVE-2025-24258 1 Apple 1 Macos 2025-05-27 7.8 High
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Ventura 13.7.6, macOS Sonoma 14.7.6. An app may be able to gain root privileges.
CVE-2025-24805 1 Opensecurity 1 Mobile Security Framework 2025-05-23 5.5 Medium
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. A local user with minimal privileges is able to make use of an access token for materials for scopes which it should not be accepted. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2025-44040 2025-05-23 7.2 High
An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via the UserService.php and the checkFOrOldHash function
CVE-2025-4975 2025-05-23 N/A
When a notification relating to low battery appears for a user with whom the device has been shared, tapping the notification grants full access to the power settings of that device.
CVE-2022-35257 1 Ui 1 Desktop 2025-05-23 7.8 High
A local privilege escalation vulnerability in UI Desktop for Windows (Version 0.55.1.2 and earlier) allows a malicious actor with local access to a Windows device with UI Desktop to run arbitrary commands as SYSTEM.
CVE-2022-30121 1 Ivanti 1 Endpoint Manager 2025-05-23 6.7 Medium
The “LANDesk(R) Management Agent” service exposes a socket and once connected, it is possible to launch commands only for signed executables. This is a security bug that allows a limited user to get escalated admin privileges on their system.
CVE-2022-32819 1 Apple 6 Ipados, Iphone Os, Mac Os X and 3 more 2025-05-22 7.8 High
A logic issue was addressed with improved state management. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macOS Monterey 12.5, Security Update 2022-005 Catalina. An app may be able to gain root privileges.
CVE-2022-32829 1 Apple 3 Ipados, Iphone Os, Macos 2025-05-22 7.8 High
This issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to execute arbitrary code with kernel privileges.
CVE-2022-32826 1 Apple 6 Ipados, Iphone Os, Mac Os X and 3 more 2025-05-22 7.8 High
An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macOS Monterey 12.5, Security Update 2022-005 Catalina. An app may be able to gain root privileges.
CVE-2022-32782 1 Apple 1 Macos 2025-05-22 4.4 Medium
This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.4. An app with root privileges may be able to access private information.
CVE-2022-32781 1 Apple 4 Ipados, Iphone Os, Mac Os X and 1 more 2025-05-22 4.4 Medium
This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.4, iOS 15.5 and iPadOS 15.5, Security Update 2022-005 Catalina, macOS Big Sur 11.6.8. An app with root privileges may be able to access private information.
CVE-2022-32801 1 Apple 1 Macos 2025-05-22 7.8 High
This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5. An app may be able to gain root privileges.
CVE-2022-41604 1 Checkpoint 1 Zonealarm 2025-05-22 8.8 High
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. This occurs because of weak permissions for the %PROGRAMDATA%\CheckPoint\ZoneAlarm\Data\Updates directory, and a self-protection driver bypass that allows creation of a junction directory. This can be leveraged to perform an arbitrary file move as NT AUTHORITY\SYSTEM.
CVE-2022-39032 1 Lcnet 1 Smart Evision 2025-05-21 8.8 High
Smart eVision has an improper privilege management vulnerability. A remote attacker with general user privilege can exploit this vulnerability to escalate to administrator privilege, and then perform arbitrary system command or disrupt service.
CVE-2024-52336 1 Redhat 1 Enterprise Linux 2025-05-21 7.8 High
A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call with `script_pre` or `script_post` options that permit arbitrary scripts with their absolute paths to be passed. These user or attacker-controlled executable scripts or programs could then be executed by Tuned with root privileges that could allow attackers to local privilege escalation.
CVE-2019-1007 1 Microsoft 3 Windows 10, Windows Server 2016, Windows Server 2019 2025-05-20 7.8 High
An elevation of privilege exists in Windows Audio Service. An attacker who successfully exploited the vulnerability could run arbitrary code with elevated privileges. To exploit the vulnerability, an attacker could run a specially crafted application that could exploit the vulnerability. This vulnerability by itself does not allow arbitrary code to be run. However, this vulnerability could be used in conjunction with one or more vulnerabilities (e.g. a remote code execution vulnerability and another elevation of privilege) that could take advantage of the elevated privileges when running. The update addresses the vulnerability by correcting how the Windows Audio Service handles processes these requests.
CVE-2022-41975 2 Microsoft, Realvnc 3 Windows, Vnc Server, Vnc Viewer 2025-05-20 7.8 High
RealVNC VNC Server before 6.11.0 and VNC Viewer before 6.22.826 on Windows allow local privilege escalation via MSI installer Repair mode.
CVE-2025-21199 2025-05-20 6.7 Medium
Improper privilege management in Azure Agent Installer allows an authorized attacker to elevate privileges locally.
CVE-2025-24070 1 Redhat 2 Enterprise Linux, Rhel Eus 2025-05-20 7 High
Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network.