Weakness (CWE)
CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Source: MITRE CWE-264
135 results · Clear filters · Feed
-
Medium 5.9
Vulnerability that allows third-party call apps to send broadcasts without verification in the audio framework module I…
-
Medium 4.8
Permission bypass vulnerability in the calendar storage module Impact: Successful exploitation of this vulnerability ma…
-
Medium 4.6
Redash getattr python.py run_query sandbox
A vulnerability was found in Redash up to 10.1.0/25.1.0. It has been rated as problematic. This issue affects the function run_query of the file /query_runner/python.py of the component getattr Handler. The manipulation leads to sandbox issue. The complexity …
-
Medium 6.3
aimhubio aim run_view Object query.py RestrictedPythonQuery privilege escalation
A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function RestrictedPythonQuery of the file /aim/storage/query.py of the component run_view Object Handler. The manipulation of the argument Abfrage l…
-
Medium 6.2
Permission control vulnerability in the media library module Impact: Successful exploitation of this vulnerability may …
-
Medium 5.8
Cisco IOS XR Software Access Control List Bypass Vulnerability
A vulnerability in the access control list (ACL) processing in the egress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability exists because certain packets are handled incorrectly …
-
Medium 6.2
Permission control vulnerability in the Connectivity module Impact: Successful exploitation of this vulnerability may c…
-
Medium 6.5
Vulnerability of improper authentication in the ANS system service module Impact: Successful exploitation of this vulne…
-
Medium 6.2
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerabilit…
-
Medium 6.1
Vulnerability of improper access control in the album module Impact: Successful exploitation of this vulnerability may …
-
Medium 6.7
Permissions, Privileges, and Access Controls in Data
Certain unprivileged processes are able to perform IOCTL calls.
-
Medium 5.3
Cisco Nexus 3550-F Switches Access Control List Programming Vulnerability
A vulnerability in the access control list (ACL) programming of Cisco Nexus 3550-F Switches could allow an unauthenticated, remote attacker to send traffic that should be blocked to the management interface of an affected device. This vulnerability exis…
-
Medium 5.1
Permission control vulnerability in the Gallery app Impact: Successful exploitation of this vulnerability may affect se…
-
Medium 4.0
Permission control vulnerability in the Wi-Fi module Impact: Successful exploitation of this vulnerability may affect s…
-
Medium 6.0
A vulnerability in the Cisco FXOS CLI feature on specific hardware platforms for Cisco Adaptive Security Appliance (ASA…
-
Medium 5.1
Access permission verification vulnerability in the ringtone setting module Impact: Successful exploitation of this vul…
-
Medium 5.1
Vulnerability of permission verification for APIs in the DownloadProviderMain module Impact: Successful exploitation of…
-
Medium 4.0
Permission verification vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability m…
-
Medium 6.2
Privilege escalation vulnerability in the account synchronisation module. Impact: Successful exploitation of this vulne…
-
Medium 5.9
Function vulnerabilities in the Calendar module Impact: Successful exploitation of this vulnerability will affect avail…
-
Medium 5.8
A vulnerability in the Object Groups for Access Control Lists (ACLs) feature of Cisco Firepower Management Center (FMC)…
-
Medium 6.2
The WindowManager module has a vulnerability in permission control. Impact: Successful exploitation of this vulnerabili…
-
Medium 6.2
Privilege escalation vulnerability in the account module Impact: Successful exploitation of this vulnerability will aff…
-
Medium 6.6
Dell Pair Installer version prior to 1.2.1 contains an elevation of privilege vulnerability. A low privilege user with …
-
Medium 4.4
Vulnerability of permission verification for APIs in the DownloadProviderMain module. Impact: Successful exploitation o…
-
Medium 5.8
A vulnerability in the classic access control list (ACL) compression feature of Cisco IOS XR Software could allow an un…
-
Medium 6.3
SourceCodester Best Fee Management System Add User admin_class.php save_user access control
A vulnerability was found in SourceCodester Best Fee Management System 1.0. It has been rated as critical. Affected by this issue is the function save_user of the file admin_class.php of the component Add User Handler. The manipulation leads to improper acces…
-
Medium 6.6
Permissions, Privileges, and Access Controls in Display
An app with non-privileged access can change global system brightness and cause undesired system behavior.
-
Medium 4.7
Dell Command | Monitor versions prior to 10.9 contain an arbitrary folder delete vulnerability during uninstallation. A…
-
Medium 4.3
WordPress Plugin for Google Reviews plugin <= 2.2.2 - Auth. Broken Access Control vulnerability
Auth. (subscriber+) Broken Access Control vulnerability in Plugin for Google Reviews plugin <= 2.2.2 on WordPress.
-
Medium 5.3
WordPress LoginPress plugin <= 1.6.2 - Broken Access Control vulnerability
Broken Access Control vulnerability in WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth. changing of Opt-In or Opt-Out tracking settings.
-
Medium 5.4
WordPress miniOrange's Google Authenticator plugin <= 5.6.1 - Broken Access Control vulnerability
Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.
-
Medium 6.5
WordPress Permalink Manager Lite plugin <= 2.2.20 - Broken Access Control vulnerability
Broken Access Control vulnerability in Permalink Manager Lite plugin <= 2.2.20 on WordPress.
-
Medium 4.3
WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability
Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with subscriber or higher user roles to change the status of the translation jobs.
-
Medium 6.3
WordPress Crowdsignal Dashboard plugin <= 3.0.9 - Privilege Escalation vulnerability
Auth. (contributor+) Privilege Escalation vulnerability in Crowdsignal Dashboard plugin <= 3.0.9 on WordPress.
-
Medium 6.1
WordPress Ezoic plugin <= 2.8.8 - Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability
Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress.
-
Medium 5.4
WordPress WooSwipe WooCommerce Gallery plugin <= 2.0.1 - Auth. Broken Access Control vulnerability
Auth. (subscriber+) Broken Access Control vulnerability in WooSwipe WooCommerce Gallery plugin <= 2.0.1 on WordPress.
-
Medium 5.4
WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability
Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with a subscriber or higher user role to change plugin settings (selected language for legacy widgets, the default behavior for media content).
-
Medium 6.5
WordPress Traffic Manager plugin <= 1.4.5 - Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS)
Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress.
-
Medium 5.6
Privilege escalation in Google Drive for Desktop on MacOS
An attacker can pre-create the `/Applications/Google\ Drive.app/Contents/MacOS` directory which is expected to be owned by root to be owned by a non-root user. When the Drive for Desktop installer is run for the first time, it will place a binary in that dire…