Skip to content
OpenAdvisories

Weakness (CWE)

CWE-264: Permissions, Privileges, and Access Controls

Category Obsolete Mapping prohibited

Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Source: MITRE CWE-264

All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-96012

    IBM Db2 Mirror for i Privilege Escalation

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit thi…

    IBM Db2 Mirror for i
  • Critical 9.8
    CVE-2022-36246

    Shop Beat Services Vulnerable To Insecure Permissions

    Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Insecure Permissions.

    Shop Beat studio
  • Critical 9.8
    CVE-2022-34149

    WordPress WP OAuth Server plugin <= 3.0.4 - Authentication Bypass vulnerability

    Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress.

    miniOrange WP OAuth Server (WordPress plugin) Web / CMS
  • Critical 9.8
    CVE-2022-34487 Scanner template

    WordPress Shortcode Addons plugin <= 3.0.2 - Unauthenticated Arbitrary Option Update vulnerability

    Unauthenticated Arbitrary Option Update vulnerability in biplob018's Shortcode Addons plugin <= 3.0.2 at WordPress.

    biplob018 Shortcode Addons (WordPress plugin) Web / CMS
  • Critical 9.8
    CVE-2022-33198 Scanner template

    WordPress Accordions plugin <= 2.0.2 - Unauthenticated WordPress Options Change vulnerability

    Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin <= 2.0.2 at WordPress.

    Biplob Adhikari Accordions (WordPress plugin) Web / CMS
  • Critical 9.8
    CVE-2021-36879

    WordPress uListing plugin <= 2.0.5 - Unauthenticated Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation vulnerability in WordPress uListing plugin (versions <= 2.0.5). Possible if WordPress configuration allows user registration.

    StylemixThemes uListing (WordPress plugin) Web / CMS
  • Critical 9.8
    CVE-2020-3227

    Cisco IOx for IOS XE Software Privilege Escalation Vulnerability

    A vulnerability in the authorization controls for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an unauthenticated, remote attacker to execute Cisco IOx API commands without proper authorization. The vulnerability is du…

    Cisco Cisco IOS XE Software 16.3.1 iOS Network devices
  • Critical 9.1
    CVE-2019-19106

    ABB/Busch-Jaeger Telephone Gateway TG/S 3.2 Access Control issues

    Improper implementation of Access Control in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway allows an unauthorized user to access data marked as restricted, such as viewing or editing user profiles and application settings.

    ABB Busch-Jaeger TG/S 3.2 Telephone Gateway 6186/11 Telefon-Gateway ICS / OT
  • Critical 9.8
    CVE-2019-1620 Public exploit EPSS 84%

    Cisco Data Center Network Manager Arbitrary File Upload and Remote Code Execution Vulnerability

    A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to upload arbitrary files on an affected device. The vulnerability is due to incorrect permission settings in aff…

    Cisco Cisco Data Center Network Manager Network devices
  • Critical 9.8
    CVE-2019-1723

    Cisco Common Services Platform Collector Static Credential Vulnerability

    A vulnerability in the Cisco Common Services Platform Collector (CSPC) could allow an unauthenticated, remote attacker to access an affected device by using an account that has a default, static password. This account does not have administrator privileges. T…

    Cisco Cisco Common Services Platform Collector Software Network devices