Weakness (CWE)
CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Source: MITRE CWE-264
309 results · Feed
-
Medium 6.5
WordPress Event Calendar – Calendar plugin <= 1.4.6 - Unauthenticated Event Deletion vulnerability
Unauthenticated Event Deletion vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress.
-
Medium 6.5
WordPress WP Shop plugin <= 3.9.6 - Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities
Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities in WP Shop plugin <= 3.9.6 at WordPress.
-
Medium 4.3
WordPress WP Shamsi plugin <= 4.1.1 - Authenticated Plugin Setting change vulnerability
Authenticated (subscriber+) Plugin Setting change vulnerability in WP Shamsi plugin <= 4.1.1 at WordPress.
-
Medium 5.4
WordPress Pop-up plugin <= 1.1.5 - Privilege Escalation vulnerability
Privilege Escalation (subscriber+) vulnerability in Pop-up plugin <= 1.1.5 at WordPress.
-
High 7.3
WordPress About Rentals plugin <= 1.5 - Missing Access Control vulnerability
Missing Access Control vulnerability in About Rentals. Inc. About Rentals plugin <= 1.5 at WordPress.
-
High 7.6
WordPress Accommodation System plugin <= 1.0.1 - Missing Access Control vulnerability
Missing Access Control vulnerability in PHP Crafts Accommodation System plugin <= 1.0.1 at WordPress.
-
High 7.6
WordPress About Me plugin <= 1.0.12 - Broken Access Control vulnerability
Broken Access Control vulnerability in Alessio Caiazza's About Me plugin <= 1.0.12 at WordPress.
-
Medium 5.4
WordPress Beaver Builder plugin <= 2.5.4.3 - Broken Access Control vulnerability
Broken Access Control vulnerability in Beaver Builder plugin <= 2.5.4.3 at WordPress.
-
High 8.8
WordPress ЮKassa для WooCommerce plugin <= 2.3.0 - Authenticated Arbitrary Settings Update vulnerability
Authenticated Arbitrary Settings Update vulnerability in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress.
-
Medium 6.5
WordPress THE Leads Management System: 59sec LITE plugin <= 3.4.1 - Unauthenticated plugin settings change vulnerability
Unauthenticated plugin settings change vulnerability in 59sec THE Leads Management System: 59sec LITE plugin <= 3.4.1 at WordPress.
-
Critical 9.8
WordPress WP OAuth Server plugin <= 3.0.4 - Authentication Bypass vulnerability
Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress.
-
Medium 5.0
WordPress Affiliate For WooCommerce premium plugin <= 4.7.0 - Multiple Improper Access Control vulnerabilities
Multiple Improper Access Control vulnerabilities in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress.
-
High 7.2
WordPress Shortcode Addons plugin <= 3.1.2 - Authenticated WordPress Options Change vulnerability
Authenticated WordPress Options Change vulnerability in Biplob018 Shortcode Addons plugin <= 3.1.2 at WordPress.
-
High 7.2
WordPress Tabs plugin <= 3.6.0 - Authenticated WordPress Options Change vulnerability
Authenticated (high role user) WordPress Options Change vulnerability in Biplob Adhikari's Tabs plugin <= 3.6.0 at WordPress.
-
High 7.2
WordPress Flipbox plugin <= 2.6.0 - Authenticated WordPress Options Change vulnerability
Authenticated WordPress Options Change vulnerability in Biplob Adhikari's Flipbox plugin <= 2.6.0 at WordPress.
-
Medium 6.3
WordPress Social Share Buttons by Supsystic plugin <= 2.2.3 - Multiple Broken Access Control vulnerabilities
Multiple Broken Access Control vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress.
-
Critical 9.8CVE-2022-34487 Scanner template
WordPress Shortcode Addons plugin <= 3.0.2 - Unauthenticated Arbitrary Option Update vulnerability
Unauthenticated Arbitrary Option Update vulnerability in biplob018's Shortcode Addons plugin <= 3.0.2 at WordPress.
-
Critical 9.8CVE-2022-33198 Scanner template
WordPress Accordions plugin <= 2.0.2 - Unauthenticated WordPress Options Change vulnerability
Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin <= 2.0.2 at WordPress.
-
Unscored —
A local privilege escalation (LPE) issue was discovered in the ransomware canaries features of Elastic Endpoint Securit…
-
High 8.8
Apache Hadoop Privilege escalation vulnerability
In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.
-
Medium 5.5
Platinum Mobile MobileHandler.ashx access control
A vulnerability, which was classified as critical, was found in Platinum Mobile 1.0.4.850. Affected is /MobileHandler.ashx which leads to broken access control. The attack requires authentication. Upgrading to version 1.0.4.851 is able to address this issue. …
-
Low 3.8
WordPress Countdown & Clock plugin <= 2.3.2 - Pro Features Lock Bypass vulnerability
Pro Features Lock Bypass vulnerability in Countdown & Clock plugin <= 2.3.2 at WordPress.
-
Low 3.7
Playbook members are allowed to escalate their membership privileges and perform actions restricted to playbook admins.
Mattermost Playbooks plugin 1.25 and earlier fails to properly restrict user-level permissions, which allows playbook members to escalate their membership privileges and perform actions restricted to playbook admins.
-
Medium 6.5
WordPress Breeze plugin <= 2.0.2 - Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability
Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability in Cloudways Breeze plugin <= 2.0.2 on WordPress allows users with a subscriber or higher user role to execute any of the wp_ajax_* actions in the class Breeze_Configuration which incl…
-
Medium 4.0
Rapid7 Insight Agent Privilege Escalation
Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due to an unquoted argument to the runas.exe command used by the ir_agent.exe component, resulting in ele…
-
Unscored —CVE-2022-23731 Public exploit
V8 javascript engine (heap vulnerability) can cause privilege escalation ,which can impact on some webOS TV models.
-
Unscored —
A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A us…
-
Medium 4.3
Elasticsearch privilege escalation
A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index.
-
High 8.8
DolphinScheduler mysql jdbc connector parameters deserialize remote code execution
In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with internal login account password)
-
Medium 5.9
SQL injection vulnerabilities in CMFA framework prior to SMR Oct-2021 Release 1 allow untrusted application to overwrit…
-
Medium 4.0
An improper access control vulnerability in BluetoothSettingsProvider prior to SMR Oct-2021 Release 1 allows untrusted …
-
Critical 9.8
WordPress uListing plugin <= 2.0.5 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability in WordPress uListing plugin (versions <= 2.0.5). Possible if WordPress configuration allows user registration.
-
Medium 4.4
In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditi…
-
Unscored —
Local privilege escalation in GNU Guix via guix-daemon and '--keep-failed'
A security vulnerability that can lead to local privilege escalation has been found in ’guix-daemon’. It affects multi-user setups in which ’guix-daemon’ runs locally. The attack consists in having an unprivileged user spawn a build process, for instance with…
-
Low 3.5
Config Items are shown to users without permission
Agents are able to see linked Config Items without permissions, which are defined in General Catalog. This issue affects: OTRSCIsInCustomerFrontend 7.0.15 and prior versions, ITSMConfigurationManagement 7.0.24 and prior versions
-
Low 3.5
FAQ articles are shown to users without permission
Agents are able to see linked FAQ articles without permissions (defined in FAQ Category). This issue affects: FAQ version 6.0.29 and prior versions, OTRS version 7.0.24 and prior versions.
-
Unscored —
Changing the password on the module webpage does not require the user to type in the current password first. Thus, the …
-
High 7.3
privilege escalation
Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to privilege escalation vulnerability.
-
Low 3.5
Agent is able to link customer's Config Items without permission
Agents are able to see and link Config Items without permissions, which are defined in General Catalog. This issue affects: OTRS AG OTRSCIsInCustomerFrontend 7.0.x version 7.0.14 and prior versions.
-
Medium 5.5
Cisco AnyConnect Secure Mobility Client Arbitrary File Read Vulnerability
A vulnerability in the upgrade component of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker with low privileges to read arbitrary files on the underlying operating system (OS) of an affected device. The vulnerability is du…