Execution with Unnecessary Privileges

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

CVEs (338)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-1744 1Dominionvoting 1Imagecast X Jun 17, 2026 Jun 24, 2022 N/A· v4 6.8 MEDIUM· v3 7.2 HIGH· v2 Applications on the tested version of Dominion Voting Systems ImageCast X can execute code with elevated privileges by exploiting a system level service. An attacker could leverage this vulnerability to escalate privileg...Show more Applications on the tested version of Dominion Voting Systems ImageCast X can execute code with elevated privileges by exploiting a system level service. An attacker could leverage this vulnerability to escalate privileges on a device and/or install malicious code.Show less
CVE-2022-1517 1Illumina 1Local Run Manager Jun 17, 2026 Jun 24, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an attacker to change settings, configurations, software, or access...Show more LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an attacker to change settings, configurations, software, or access sensitive data on the affected produc. An attacker could also exploit this vulnerability to access APIs not intended for general use and interact through the network.Show less
CVE-2022-32535 1Bosch 1Pra Es8p2s Firmware Jun 17, 2026 Jun 23, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 runs its web server with root privilege. In combination with CVE-2022-23534 this could give an attacker root access to the switch.
CVE-2022-1808 1Trudesk Project 1Trudesk Jun 17, 2026 May 31, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Execution with Unnecessary Privileges in GitHub repository polonel/trudesk prior to 1.2.3.
CVE-2022-30695 1Acronis 1Snap Deploy Jun 17, 2026 May 16, 2022 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Snap Deploy (Windows) before build 3640
CVE-2021-34591 1Bender 2Cc612 Firmware Icc15xx Firmware Jun 17, 2026 Apr 27, 2022 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 In Bender/ebee Charge Controllers in multiple versions are prone to Local privilege Escalation. An authenticated attacker could get root access via the suid applications socat, ip udhcpc and ifplugd.
CVE-2022-0071 1Hotdog Project 1Hotdog Jun 17, 2026 Apr 19, 2022 N/A· v4 8.8 HIGH· v3 7.2 HIGH· v2 Incomplete fix for CVE-2021-3101. Hotdog, prior to v1.0.2, did not mimic the resource limits, device restrictions, or syscall filters of the target JVM process. This would allow a container to exhaust the resources of th...Show more Incomplete fix for CVE-2021-3101. Hotdog, prior to v1.0.2, did not mimic the resource limits, device restrictions, or syscall filters of the target JVM process. This would allow a container to exhaust the resources of the host, modify devices, or make syscalls that would otherwise be blocked.Show less
CVE-2022-0070 1Amazon 1Log4jhotpatch Jun 17, 2026 Apr 19, 2022 N/A· v4 8.8 HIGH· v3 7.2 HIGH· v2 Incomplete fix for CVE-2021-3100. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic the Linux capabilities and cgroups of the target Java process that the hotp...Show more Incomplete fix for CVE-2021-3100. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic the Linux capabilities and cgroups of the target Java process that the hotpatch is applied to.Show less
CVE-2021-3101 1Hotdog Project 1Hotdog Jun 17, 2026 Apr 19, 2022 N/A· v4 8.8 HIGH· v3 7.2 HIGH· v2 Hotdog, prior to v1.0.1, did not mimic the capabilities or the SELinux label of the target JVM process. This would allow a container to gain full privileges on the host, bypassing restrictions set on the container.
CVE-2021-3100 1Amazon 1Log4jhotpatch Jun 17, 2026 Apr 19, 2022 N/A· v4 8.8 HIGH· v3 7.2 HIGH· v2 The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM being patched, allowing it to escalate privileges.
CVE-2022-20676 1Cisco 1Ios Xe Jun 17, 2026 Apr 15, 2022 N/A· v4 6.7 MEDIUM· v3 7.2 HIGH· v2 A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS XE Software could allow an authenticated, local attacker to escalate from privilege level 15 to root-level privileges. This vulnerability is due...Show more A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS XE Software could allow an authenticated, local attacker to escalate from privilege level 15 to root-level privileges. This vulnerability is due to insufficient input validation of data that is passed into the Tcl interpreter. An attacker could exploit this vulnerability by loading malicious Tcl code on an affected device. A successful exploit could allow the attacker to execute arbitrary commands as root. By default, Tcl shell access requires privilege level 15.Show less
CVE-2022-27578 1Sick 1Overall Equipment Effectiveness Jun 17, 2026 Apr 11, 2022 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 An attacker can perform a privilege escalation through the SICK OEE if the application is installed in a directory where non authenticated or low privilege users can modify its content.
CVE-2022-24113 1Acronis 4Agent Cyber ProtectCyber Protect Home Office+1 more Jun 17, 2026 Feb 4, 2022 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windows) before build 27147,...Show more Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windows) before build 27147, Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287Show less
CVE-2021-36339 1Dell 7Powermax Os Solutions EnablerSolutions Enabler Virtual Appliance+4 more Jun 17, 2026 Jan 21, 2022 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 The Dell EMC Virtual Appliances before 9.2.2.2 contain undocumented user accounts. A local malicious user may potentially exploit this vulnerability to get privileged access to the virtual appliance.
CVE-2022-21699 3Debian FedoraprojectIpython 3Debian Linux FedoraIpython Jun 17, 2026 Jan 19, 2022 N/A· v4 8.8 HIGH· v3 4.6 MEDIUM· v2 IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code ex...Show more IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.Show less
CVE-2021-34998 1Watchguard 1Panda Antivirus Jun 17, 2026 Jan 13, 2022 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Free Antivirus 20.2.0.0. An attacker must first obtain the ability to execute low-privileged code on the target...Show more This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Free Antivirus 20.2.0.0. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the use of named pipes. The issue results from allowing an untrusted process to impersonate the client of a pipe. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-14208.Show less
CVE-2021-1118 1Nvidia 1Virtual Gpu Jun 17, 2026 Oct 29, 2021 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where there is the potential to execute privileged operations by the guest OS, which may lead to information disclosure, data tamper...Show more NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where there is the potential to execute privileged operations by the guest OS, which may lead to information disclosure, data tampering, escalation of privileges, and denial of serviceShow less
CVE-2021-3576 1Bitdefender 2Endpoint Security Tools Total Security Jun 17, 2026 Oct 28, 2021 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 Execution with Unnecessary Privileges vulnerability in Bitdefender Endpoint Security Tools, Total Security allows a local attacker to elevate to 'NT AUTHORITY\System. Impersonation enables the server thread to perform ac...Show more Execution with Unnecessary Privileges vulnerability in Bitdefender Endpoint Security Tools, Total Security allows a local attacker to elevate to 'NT AUTHORITY\System. Impersonation enables the server thread to perform actions on behalf of the client but within the limits of the client's security context. This issue affects: Bitdefender Endpoint Security Tools versions prior to 7.2.1.65. Bitdefender Total Security versions prior to 25.0.26.Show less
CVE-2021-41035 1Eclipse 1Openj9 Jun 17, 2026 Oct 25, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods.
CVE-2021-37174 1Siemens 10Ruggedcom Rox Mx5000 Firmware Ruggedcom Rox Rx1400 FirmwareRuggedcom Rox Rx1500 Firmware+7 more Jun 17, 2026 Sep 14, 2021 N/A· v4 8.8 HIGH· v3 9.0 HIGH· v2 A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All versions < V2.14.1), RUGGEDCOM ROX RX1501 (All versions < V2....Show more A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All versions < V2.14.1), RUGGEDCOM ROX RX1501 (All versions < V2.14.1), RUGGEDCOM ROX RX1510 (All versions < V2.14.1), RUGGEDCOM ROX RX1511 (All versions < V2.14.1), RUGGEDCOM ROX RX1512 (All versions < V2.14.1), RUGGEDCOM ROX RX1524 (All versions < V2.14.1), RUGGEDCOM ROX RX1536 (All versions < V2.14.1), RUGGEDCOM ROX RX5000 (All versions < V2.14.1). The affected devices have a privilege escalation vulnerability, if exploited, an attacker could gain root user access.Show less

Previous 1...13 141516 17 Next