cve.bz

CWE-264: Permissions, Privileges, and Access Controls, page 3

Filter

Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

What the weakness is: CWE-264 at MITRE

Ask an AI about CWE-264

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-264: Permissions, Privileges, and Access Controls and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/264.html and https://cve.bz/cve/cwe/264?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2023-2255EPSS 2.2%

    Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that…

  2. 7.1CVE-2023-24573EPSS 0.2%

    Dell Command | Monitor versions prior to 10.9 contain an arbitrary folder delete vulnerability during uninstallation. A locally authenticated malicious user may potentially exploit this vulnerability leading to arbitrary folder deletion.

  3. 4.3CVE-2022-45369EPSS 0.5%

    Auth. (subscriber+) Broken Access Control vulnerability in Plugin for Google Reviews plugin <= 2.2.2 on WordPress.

  4. 7.2CVE-2022-42459EPSS 0.9%

    Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin <= 9.7.1 on WordPress.

  5. 5.3CVE-2022-41839EPSS 0.5%

    Broken Access Control vulnerability in WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth. changing of Opt-In or Opt-Out tracking settings.

  6. 8.8CVE-2022-42461EPSS 0.7%

    Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.

  7. 9.8CVE-2022-41781EPSS 0.7%

    Broken Access Control vulnerability in Permalink Manager Lite plugin <= 2.2.20 on WordPress.

  8. 4.3CVE-2022-38974EPSS 0.6%

    Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with subscriber or higher user roles to change the status of the translation jobs.

  9. 8.8CVE-2022-45069EPSS 0.8%

    Auth. (contributor+) Privilege Escalation vulnerability in Crowdsignal Dashboard plugin <= 3.0.9 on WordPress.

  10. 8.8CVE-2022-45066EPSS 0.7%

    Auth. (subscriber+) Broken Access Control vulnerability in WooSwipe WooCommerce Gallery plugin <= 2.0.1 on WordPress.

  11. 6.1CVE-2022-41132EPSS 0.4%

    Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress.

  12. 4.3CVE-2022-38461EPSS 0.6%

    Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with a subscriber or higher user role to change plugin settings (selected language for legacy widgets, the default behavior for…

  13. 5.4CVE-2022-42460EPSS 0.5%

    Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress.

  14. 6.5CVE-2022-41978EPSS 3.4%

    Auth. (subscriber+) Arbitrary Options Update vulnerability in Zoho CRM Lead Magnet plugin <= 1.7.5.8 on WordPress.

  15. 7.2CVE-2022-38104EPSS 1.2%

    Auth. WordPress Options Change (siteurl, users_can_register, default_role, admin_email and new_admin_email) vulnerability in Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder plugin (versions <= 2.0.3 on WordPress.

  16. 7.3CVE-2022-3421EPSS 0.1%

    An attacker can pre-create the `/Applications/Google\ Drive.app/Contents/MacOS` directory which is expected to be owned by root to be owned by a non-root user. When the Drive for Desktop installer is run for the first time, it will place a…

  17. 4.9CVE-2021-28052EPSS 0.8%

    A tenant administrator Hitachi Content Platform (HCP) may modify the configuration in another tenant without authorization, potentially allowing unauthorized access to data in the other tenant. Also, a tenant user (non-administrator) may v…

  18. 8.8CVE-2022-38134EPSS 1.0%

    Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress.

  19. 5.3CVE-2022-35238EPSS 0.7%

    Unauthenticated Plugin Settings Change vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress.

  20. 4.3CVE-2022-38135EPSS 0.7%

    Broken Access Control vulnerability in Dean Oakley's Photospace Gallery plugin <= 2.3.5 at WordPress allows users with subscriber or higher role to change plugin settings.

  21. 8.8CVE-2022-38070EPSS 1.0%

    Privilege Escalation (subscriber+) vulnerability in Pop-up plugin <= 1.1.5 at WordPress.

  22. 5.3CVE-2022-38067EPSS 0.7%

    Unauthenticated Event Deletion vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress.

  23. 4.3CVE-2022-38058EPSS 0.6%

    Authenticated (subscriber+) Plugin Setting change vulnerability in WP Shamsi plugin <= 4.1.1 at WordPress.

  24. 9.1CVE-2022-36793EPSS 0.9%

    Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities in WP Shop plugin <= 3.9.6 at WordPress.

  25. 9.8CVE-2022-37344EPSS 0.9%

    Missing Access Control vulnerability in PHP Crafts Accommodation System plugin <= 1.0.1 at WordPress.

  26. 9.8CVE-2022-36427EPSS 0.9%

    Missing Access Control vulnerability in About Rentals. Inc. About Rentals plugin <= 1.5 at WordPress.

  27. 9.8CVE-2022-36387EPSS 1.0%

    Broken Access Control vulnerability in Alessio Caiazza's About Me plugin <= 1.0.12 at WordPress.

  28. 9.8CVE-2022-36425EPSS 0.9%

    Broken Access Control vulnerability in Beaver Builder plugin <= 2.5.4.3 at WordPress.

  29. 5.3CVE-2022-35242EPSS 0.7%

    Unauthenticated plugin settings change vulnerability in 59sec THE Leads Management System: 59sec LITE plugin <= 3.4.1 at WordPress.

  30. 6.5CVE-2022-34868EPSS 1.1%

    Authenticated Arbitrary Settings Update vulnerability in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress.

  31. 9.8CVE-2022-34149EPSS 1.3%

    Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress.

  32. 8.8CVE-2022-25649EPSS 0.9%

    Multiple Improper Access Control vulnerabilities in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress.

  33. 7.2CVE-2022-33970EPSS 1.1%

    Authenticated WordPress Options Change vulnerability in Biplob018 Shortcode Addons plugin <= 3.1.2 at WordPress.

  34. 7.2CVE-2022-36375EPSS 1.3%

    Authenticated (high role user) WordPress Options Change vulnerability in Biplob Adhikari's Tabs plugin <= 3.6.0 at WordPress.

  35. 7.2CVE-2022-33969EPSS 1.3%

    Authenticated WordPress Options Change vulnerability in Biplob Adhikari's Flipbox plugin <= 2.6.0 at WordPress.

  36. 8.8CVE-2022-27235EPSS 0.9%

    Multiple Broken Access Control vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress.

  37. 5.3CVE-2022-34487ExploitEPSS 3.3%

    Unauthenticated Arbitrary Option Update vulnerability in biplob018's Shortcode Addons plugin <= 3.0.2 at WordPress.

  38. 5.3CVE-2022-33198ExploitEPSS 3.3%

    Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin <= 2.0.2 at WordPress.

  39. 7.8CVE-2022-23714EPSS 0.2%

    A local privilege escalation (LPE) issue was discovered in the ransomware canaries features of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate their privileges to those of the LocalSystem account.

  40. 8.8CVE-2021-33036EPSS 4.0%

    In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 …

  41. 6.5CVE-2020-36528EPSS 0.8%

    A vulnerability, which was classified as critical, was found in Platinum Mobile 1.0.4.850. Affected is /MobileHandler.ashx which leads to broken access control. The attack requires authentication. Upgrading to version 1.0.4.851 is able to …

  42. 9.8CVE-2022-29423EPSS 1.1%

    Pro Features Lock Bypass vulnerability in Countdown & Clock plugin <= 2.3.2 at WordPress.

  43. 8.8CVE-2022-1548EPSS 0.6%

    Mattermost Playbooks plugin 1.25 and earlier fails to properly restrict user-level permissions, which allows playbook members to escalate their membership privileges and perform actions restricted to playbook admins.

  44. 5.4CVE-2022-29444EPSS 0.6%

    Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability in Cloudways Breeze plugin <= 2.0.2 on WordPress allows users with a subscriber or higher user role to execute any of the wp_ajax_* actions in the class Breeze_Conf…

  45. 7.8CVE-2022-0237EPSS 0.5%

    Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due to an unquoted argument to the runas.exe command used by the ir_agent.exe compone…

  46. 7.8CVE-2022-23731EPSS 0.6%

    V8 javascript engine (heap vulnerability) can cause privilege escalation ,which can impact on some webOS TV models.

  47. 4.3CVE-2022-23709EPSS 0.6%

    A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A user with this privilege would be able to create new alerting rules or overwrite existing ones. However, any new or modifi…

  48. 4.3CVE-2022-23708EPSS 1.0%

    A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to t…

  49. 8.8CVE-2021-27644EPSS 1.9%

    In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with internal login account password)

  50. 4.4CVE-2021-25482EPSS 0.1%

    SQL injection vulnerabilities in CMFA framework prior to SMR Oct-2021 Release 1 allow untrusted application to overwrite some CMFA framework information.