Weakness (CWE)
CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Source: MITRE CWE-264
309 results · Feed
-
Medium 5.9
Function vulnerabilities in the Calendar module Impact: Successful exploitation of this vulnerability will affect avail…
-
High 7.4
IBM Db2 on Cloud Pak for Data privilege escalation
IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data 3.5, 4.0, 4.5, 4.6, 4.7, and 4.8 could allow a user with access to the Kubernetes pod, to make system calls compromising the security of containers. IBM X-Force ID: 265264.
-
Medium 5.8
A vulnerability in the Object Groups for Access Control Lists (ACLs) feature of Cisco Firepower Management Center (FMC)…
-
Medium 6.2
The WindowManager module has a vulnerability in permission control. Impact: Successful exploitation of this vulnerabili…
-
Medium 6.2
Privilege escalation vulnerability in the account module Impact: Successful exploitation of this vulnerability will aff…
-
High 7.3
Dell Display and Peripheral Manager for macOS prior to 1.3 contains an improper access control vulnerability. A low pri…
-
Medium 6.6
Dell Pair Installer version prior to 1.2.1 contains an elevation of privilege vulnerability. A low privilege user with …
-
Medium 4.4
Vulnerability of permission verification for APIs in the DownloadProviderMain module. Impact: Successful exploitation o…
-
Medium 5.8
A vulnerability in the classic access control list (ACL) compression feature of Cisco IOS XR Software could allow an un…
-
Unscored —
Permission control vulnerability in the XLayout component. Successful exploitation of this vulnerability may cause apps…
-
Unscored —
Vulnerability of API privilege escalation in the wifienhance module. Successful exploitation of this vulnerability may …
-
Unscored —
Vulnerability of system file information leakage in the USB Service module. Successful exploitation of this vulnerabili…
-
Unscored —
Vulnerability of permission control in the window management module. Successful exploitation of this vulnerability may …
-
Unscored —
Vulnerability of incomplete permission verification in the input method module. Successful exploitation of this vulnera…
-
Unscored —
Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause audio dev…
-
Medium 6.3
SourceCodester Best Fee Management System Add User admin_class.php save_user access control
A vulnerability was found in SourceCodester Best Fee Management System 1.0. It has been rated as critical. Affected by this issue is the function save_user of the file admin_class.php of the component Add User Handler. The manipulation leads to improper acces…
-
Unscored —
Inappropriate authorization vulnerability in the system apps. Successful exploitation of this vulnerability may affect …
-
Medium 6.6
Permissions, Privileges, and Access Controls in Display
An app with non-privileged access can change global system brightness and cause undesired system behavior.
-
High 7.2
An improper permissions, privileges, and access controls vulnerability [CWE-264] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 an…
-
Critical 9.8
Shop Beat Services Vulnerable To Insecure Permissions
Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Insecure Permissions.
-
Unscored —CVE-2023-2255 Public exploit
Remote documents loaded without prompt via IFrame
Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating fram…
-
Medium 4.7
Dell Command | Monitor versions prior to 10.9 contain an arbitrary folder delete vulnerability during uninstallation. A…
-
High 7.2
WordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Auth. WordPress Options Change vulnerability
Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin <= 9.7.1 on WordPress.
-
Medium 4.3
WordPress Plugin for Google Reviews plugin <= 2.2.2 - Auth. Broken Access Control vulnerability
Auth. (subscriber+) Broken Access Control vulnerability in Plugin for Google Reviews plugin <= 2.2.2 on WordPress.
-
Medium 5.3
WordPress LoginPress plugin <= 1.6.2 - Broken Access Control vulnerability
Broken Access Control vulnerability in WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth. changing of Opt-In or Opt-Out tracking settings.
-
Medium 5.4
WordPress miniOrange's Google Authenticator plugin <= 5.6.1 - Broken Access Control vulnerability
Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.
-
Medium 6.5
WordPress Permalink Manager Lite plugin <= 2.2.20 - Broken Access Control vulnerability
Broken Access Control vulnerability in Permalink Manager Lite plugin <= 2.2.20 on WordPress.
-
Medium 4.3
WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability
Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with subscriber or higher user roles to change the status of the translation jobs.
-
Medium 6.3
WordPress Crowdsignal Dashboard plugin <= 3.0.9 - Privilege Escalation vulnerability
Auth. (contributor+) Privilege Escalation vulnerability in Crowdsignal Dashboard plugin <= 3.0.9 on WordPress.
-
Medium 6.1
WordPress Ezoic plugin <= 2.8.8 - Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability
Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress.
-
Medium 5.4
WordPress WooSwipe WooCommerce Gallery plugin <= 2.0.1 - Auth. Broken Access Control vulnerability
Auth. (subscriber+) Broken Access Control vulnerability in WooSwipe WooCommerce Gallery plugin <= 2.0.1 on WordPress.
-
Medium 5.4
WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability
Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with a subscriber or higher user role to change plugin settings (selected language for legacy widgets, the default behavior for media content).
-
Medium 6.5
WordPress Traffic Manager plugin <= 1.4.5 - Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS)
Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress.
-
High 8.8
WordPress Zoho CRM Lead Magnet plugin <= 1.7.5.8 - Auth. Arbitrary Options Update vulnerability
Auth. (subscriber+) Arbitrary Options Update vulnerability in Zoho CRM Lead Magnet plugin <= 1.7.5.8 on WordPress.
-
High 7.2
WordPress Accordions plugin <= 2.0.3 - Auth. WordPress Options Change vulnerability
Auth. WordPress Options Change (siteurl, users_can_register, default_role, admin_email and new_admin_email) vulnerability in Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder plugin (versions <= 2.0.3 on WordPress.
-
Medium 5.6
Privilege escalation in Google Drive for Desktop on MacOS
An attacker can pre-create the `/Applications/Google\ Drive.app/Contents/MacOS` directory which is expected to be owned by root to be owned by a non-root user. When the Drive for Desktop installer is run for the first time, it will place a binary in that dire…
-
High 7.5
Hitachi Content Platform Information Disclosure Vulnerability
A tenant administrator Hitachi Content Platform (HCP) may modify the configuration in another tenant without authorization, potentially allowing unauthorized access to data in the other tenant. Also, a tenant user (non-administrator) may view configuration in…
-
Medium 4.3
WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Authenticated Broken Access Control vulnerability
Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress.
-
Medium 6.5
WordPress Awesome Filterable Portfolio plugin <= 1.9.7 - Unauthenticated Plugin Settings Change vulnerability
Unauthenticated Plugin Settings Change vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress.
-
Medium 5.4
WordPress Photospace Gallery plugin <= 2.3.5 - Broken Access Control vulnerability
Broken Access Control vulnerability in Dean Oakley's Photospace Gallery plugin <= 2.3.5 at WordPress allows users with subscriber or higher role to change plugin settings.