cve.bz

CWE-264: Permissions, Privileges, and Access Controls, page 5

Filter

Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

What the weakness is: CWE-264 at MITRE

Ask an AI about CWE-264

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-264: Permissions, Privileges, and Access Controls and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/264.html and https://cve.bz/cve/cwe/264?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.5CVE-2020-8092EPSS 0.3%

    A privilege escalation vulnerability in BDLDaemon as used in Bitdefender Antivirus for Mac allows a local attacker to obtain authentication tokens for requests submitted to the Bitdefender Cloud. This issue affects: Bitdefender Bitdefender…

  2. 8.8CVE-2020-3115EPSS 0.3%

    A vulnerability in the CLI of the Cisco SD-WAN Solution vManage software could allow an authenticated, local attacker to elevate privileges to root-level privileges on the underlying operating system. The vulnerability is due to insufficie…

  3. 5.4CVE-2019-14879EPSS 0.7%

    A vulnerability was found in Moodle versions 3.7.x before 3.7.3, 3.6.x before 3.6.7 and 3.5.x before 3.5.9. When a cohort role assignment was removed, the associated capabilities were not being revoked (where applicable).

  4. 6.7CVE-2019-15996EPSS 0.5%

    A vulnerability in Cisco DNA Spaces: Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. The vulnerability is due to insufficient restricti…

  5. 5.4CVE-2019-15960EPSS 1.1%

    A vulnerability in the Webex Network Recording Admin page of Cisco Webex Meetings could allow an authenticated, remote attacker to elevate privileges in the context of the affected page. To exploit this vulnerability, the attacker must be …

  6. 5.3CVE-2019-1982EPSS 1.0%

    A vulnerability in the HTTP traffic filtering component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker t…

  7. 5.8CVE-2019-1981EPSS 1.0%

    A vulnerability in the normalization functionality of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to byp…

  8. 5.3CVE-2019-1980EPSS 1.0%

    A vulnerability in the protocol detection component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to by…

  9. 5.8CVE-2019-1978ExploitEPSS 9.4%

    A vulnerability in the stream reassembly component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to byp…

  10. 6.5CVE-2019-17326EPSS 1.3%

    ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to arbitrary file deletion by issuing a HTTP GET request with a specially crafted parameter. User interaction is required to exploit this vulnerability in that the targe…

  11. 6.5CVE-2019-17322EPSS 1.2%

    ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation via a POST request with the parameter set to the file path to be written. This can be an executable file that is written to in the arbitrary directory. User inte…

  12. 6.7CVE-2019-15277EPSS 0.4%

    A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to execute code with root privileges. The vulnerability is due to insufficient input validation. An attacker…

  13. 6.7CVE-2019-15275EPSS 0.4%

    A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. The vulnerability is due to insufficient input validatio…

  14. 6.5CVE-2019-15272EPSS 1.3%

    A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated, remote attacker to bypass security restrictions. T…

  15. 7.8CVE-2019-11773EPSS 0.4%

    Prior to 0.1, AIX builds of Eclipse OMR contain unused RPATHs which may facilitate code injection and privilege elevation by local users.

  16. 9.8CVE-2019-10709ExploitEPSS 12%

    AsusPTPFilter.sys on Asus Precision TouchPad 11.0.0.25 hardware has a Pool Overflow associated with the \\.\AsusTP device, leading to a DoS or potentially privilege escalation via a crafted DeviceIoControl call.

  17. 5.3CVE-2019-1969EPSS 1.4%

    A vulnerability in the implementation of the Simple Network Management Protocol (SNMP) Access Control List (ACL) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to perform SNMP polling of an affected device,…

  18. 7.8CVE-2019-1966EPSS 0.4%

    A vulnerability in a specific CLI command within the local management (local-mgmt) context for Cisco UCS Fabric Interconnect Software could allow an authenticated, local attacker to gain elevated privileges as the root user on an affected …

  19. 7.8CVE-2019-11245EPSS 0.6%

    In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container restart, or if the image was previously pulled to the node. If the pod specified mustRunAsNonRoot: tr…

  20. 9.8CVE-2016-10935EPSS 2.1%

    The woocommerce-exporter plugin before 1.8.4 for WordPress has privilege escalation.

  21. 5.5CVE-2019-13014EPSS 0.4%

    Little Snitch versions 4.4.0 fixes a vulnerability in a privileged helper tool. However, the operating system may have made a copy of the privileged helper which is not removed or updated immediately. Computers may therefore still be vulne…

  22. 5.5CVE-2019-13013EPSS 0.3%

    Little Snitch versions 4.3.0 to 4.3.2 have a local privilege escalation vulnerability in their privileged helper tool. The privileged helper tool implements an XPC interface which is available to any process and allows directory listings a…

  23. 5.3CVE-2016-10929EPSS 1.3%

    The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in.

  24. 7.5CVE-2017-18584EPSS 1.4%

    The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.

  25. 9.8CVE-2016-10923EPSS 2.1%

    The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.

  26. 9.8CVE-2016-10922EPSS 2.1%

    The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.

  27. 7.8CVE-2019-14257EPSS 0.6%

    pyraw in Zenoss 2.5.3 allows local privilege escalation by modifying environment variables to redirect execution before privileges are dropped, aka ZEN-31765.

  28. 7.5CVE-2019-12634EPSS 2.0%

    A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to cause a de…

  29. 7.3CVE-2019-2122EPSS 0.2%

    In LockTaskController.lockKeyguardIfNeeded of the LockTaskController.java, there was a difference in the handling of the default case between the WindowManager and the Settings. This could lead to a local escalation of privilege with no ad…

  30. 6.7CVE-2019-3637EPSS 0.3%

    Privilege Escalation vulnerability in McAfee FRP 5.x prior to 5.1.0.209 allows local users to gain elevated privileges via running McAfee Tray with elevated privileges.

  31. 9.8CVE-2016-10886EPSS 2.0%

    The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.

  32. 7.8CVE-2019-12808EPSS 0.4%

    ALTOOLS update service 18.1 and earlier versions contains a local privilege escalation vulnerability due to insecure permission. An attacker can overwrite an executable that is launched as a service to exploit this vulnerability and execut…

  33. 6.7CVE-2019-1972EPSS 0.5%

    A vulnerability the Cisco Enterprise NFV Infrastructure Software (NFVIS) restricted CLI could allow an authenticated, local attacker with valid administrator-level credentials to elevate privileges and execute arbitrary commands on the und…

  34. 2.7CVE-2017-18455EPSS 0.8%

    In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208).

  35. 5.3CVE-2017-18451EPSS 0.9%

    cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade (SEC-257).

  36. 4.5CVE-2017-18450EPSS 0.3%

    cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert_roundcube_mysql2sqlite (SEC-255).

  37. 7.8CVE-2017-18413EPSS 0.4%

    In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears (SEC-299).

  38. 3.7CVE-2017-18399EPSS 0.7%

    cPanel before 68.0.15 allows attackers to read root's crontab file during a short time interval upon enabling or disabling sqloptimizer (SEC-332).

  39. 7.8CVE-2017-18383EPSS 0.4%

    cPanel before 68.0.15 writes home-directory backups to an incorrect location (SEC-309).

  40. 7.8CVE-2019-11771EPSS 0.4%

    AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users.

  41. 7.2CVE-2019-1889EPSS 2.8%

    A vulnerability in the REST API for software device management in Cisco Application Policy Infrastructure Controller (APIC) Software could allow an authenticated, remote attacker to escalate privileges to root on an affected device. The vu…

  42. 7.3CVE-2019-1855EPSS 2.3%

    A vulnerability in the loading mechanism of specific dynamic link libraries in Cisco Jabber for Windows could allow an authenticated, local attacker to perform a DLL preloading attack. To exploit this vulnerability, the attacker would need…

  43. 8.8CVE-2017-8230EPSS 1.6%

    On Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices, the users on the device are divided into 2 groups "admin" and "user". However, as a part of security analysis it was identified that a low privileged user who belongs to the "user" gro…

  44. 8.8CVE-2017-8228EPSS 2.6%

    Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices mishandle reboots within the past two hours. Amcrest cloud services does not perform a thorough verification when allowing the user to add a new camera to the user's account to ensure that…

  45. 7.8CVE-2019-13125EPSS 1.0%

    HaboMalHunter through 2.0.0.3 in Tencent Habo allows attackers to evade dynamic malware analysis via PIE compilation.

  46. 7.5CVE-2019-1621ExploitEPSS 30%

    A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to gain access to sensitive files on an affected device. The vulnerability is due to incorrec…

  47. 9.8CVE-2019-1620ExploitEPSS 84%

    A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to upload arbitrary files on an affected device. The vulnerability is due to incorrect permis…

  48. 6.5CVE-2019-1906EPSS 1.2%

    A vulnerability in the Virtual Domain system of Cisco Prime Infrastructure (PI) could allow an authenticated, remote attacker to change the virtual domain configuration, which could lead to privilege escalation. The vulnerability is due to…

  49. 8.8CVE-2019-1626EPSS 1.9%

    A vulnerability in the vManage web-based UI (Web UI) of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to gain elevated privileges on an affected vManage device. The vulnerability is due to a failure to properly au…

  50. 7.8CVE-2019-1625EPSS 0.4%

    A vulnerability in the CLI of Cisco SD-WAN Solution could allow an authenticated, local attacker to elevate lower-level privileges to the root user on an affected device. The vulnerability is due to insufficient authorization enforcement. …