CWE-264 (page 2)
Page 2 of 55 — CVEs classified under CWE-264, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-38067 | Medium | 6.5 | 2022-09-09 | Unauthenticated Event Deletion vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress. |
CVE-2022-38058 | Medium | 4.3 | 2022-09-09 | Authenticated (subscriber+) Plugin Setting change vulnerability in WP Shamsi plugin <= 4.1.1 at WordPress. |
CVE-2022-36793 | Medium | 6.5 | 2022-09-09 | Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities in WP Shop plugin <= 3.9.6 at WordPress. |
CVE-2022-37344 | High | 7.6 | 2022-09-06 | Missing Access Control vulnerability in PHP Crafts Accommodation System plugin <= 1.0.1 at WordPress. |
CVE-2022-36427 | High | 7.3 | 2022-09-06 | Missing Access Control vulnerability in About Rentals. Inc. About Rentals plugin <= 1.5 at WordPress. |
CVE-2022-36387 | High | 7.6 | 2022-09-06 | Broken Access Control vulnerability in Alessio Caiazza's About Me plugin <= 1.0.12 at WordPress. |
CVE-2022-36425 | Medium | 5.4 | 2022-09-06 | Broken Access Control vulnerability in Beaver Builder plugin <= 2.5.4.3 at WordPress. |
CVE-2022-35242 | Medium | 6.5 | 2022-08-23 | Unauthenticated plugin settings change vulnerability in 59sec THE Leads Management System: 59sec LITE plugin <= 3.4.1 at WordPress. |
CVE-2022-34868 | High | 8.8 | 2022-08-23 | Authenticated Arbitrary Settings Update vulnerability in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress. |
CVE-2022-34149 | Critical | 9.8 | 2022-08-22 | Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress. |
CVE-2022-25649 | Medium | 5.0 | 2022-08-05 | Multiple Improper Access Control vulnerabilities in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress. |
CVE-2022-33970 | High | 7.2 | 2022-07-27 | Authenticated WordPress Options Change vulnerability in Biplob018 Shortcode Addons plugin <= 3.1.2 at WordPress. |
CVE-2022-36375 | High | 7.2 | 2022-07-25 | Authenticated (high role user) WordPress Options Change vulnerability in Biplob Adhikari's Tabs plugin <= 3.6.0 at WordPress. |
CVE-2022-33969 | High | 7.2 | 2022-07-25 | Authenticated WordPress Options Change vulnerability in Biplob Adhikari's Flipbox plugin <= 2.6.0 at WordPress. |
CVE-2022-27235 | Medium | 6.3 | 2022-07-22 | Multiple Broken Access Control vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress. |
CVE-2022-34487 | Critical | 9.8 | 2022-07-21 | Unauthenticated Arbitrary Option Update vulnerability in biplob018's Shortcode Addons plugin <= 3.0.2 at WordPress. |
CVE-2022-33198 | Critical | 9.8 | 2022-07-21 | Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin <= 2.0.2 at WordPress. |
CVE-2022-23714 | High | 7.8 | 2022-07-06 | A local privilege escalation (LPE) issue was discovered in the ransomware canaries features of Elastic Endpoint Security for Windows, which could allow unprivi… |
CVE-2021-33036 | High | 8.8 | 2022-06-15 | In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary co… |
CVE-2020-36528 | Medium | 5.5 | 2022-06-07 | A vulnerability, which was classified as critical, was found in Platinum Mobile 1.0.4.850. Affected is /MobileHandler.ashx which leads to broken access control… |
CVE-2022-29423 | Low | 3.8 | 2022-05-06 | Pro Features Lock Bypass vulnerability in Countdown & Clock plugin <= 2.3.2 at WordPress. |
CVE-2022-1548 | Low | 3.7 | 2022-05-03 | Mattermost Playbooks plugin 1.25 and earlier fails to properly restrict user-level permissions, which allows playbook members to escalate their membership priv… |
CVE-2022-29444 | Medium | 6.5 | 2022-05-02 | Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability in Cloudways Breeze plugin <= 2.0.2 on WordPress allows users with a subscriber or h… |
CVE-2022-0237 | Medium | 4.0 | 2022-03-17 | Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due t… |
CVE-2022-23731 | High | 7.8 | 2022-03-11 | V8 javascript engine (heap vulnerability) can cause privilege escalation ,which can impact on some webOS TV models. |
CVE-2022-23709 | Medium | 4.3 | 2022-03-03 | A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A user with this privilege would be able to… |
CVE-2022-23708 | Medium | 4.3 | 2022-03-03 | A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the sec… |
CVE-2021-27644 | High | 8.8 | 2021-11-01 | In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with… |
CVE-2021-25482 | Medium | 5.9 | 2021-10-06 | SQL injection vulnerabilities in CMFA framework prior to SMR Oct-2021 Release 1 allow untrusted application to overwrite some CMFA framework information. |
CVE-2021-25472 | Medium | 4.0 | 2021-10-06 | An improper access control vulnerability in BluetoothSettingsProvider prior to SMR Oct-2021 Release 1 allows untrusted application to overwrite some Bluetooth… |
CVE-2021-36879 | Critical | 9.8 | 2021-09-27 | Unauthenticated Privilege Escalation vulnerability in WordPress uListing plugin (versions <= 2.0.5). Possible if WordPress configuration allows user registrati… |
CVE-2021-28497 | Medium | 4.4 | 2021-09-09 | In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, the bash shell might be accessible… |
CVE-2021-27851 | Medium | 5.5 | 2021-04-26 | A security vulnerability that can lead to local privilege escalation has been found in ’guix-daemon’. It affects multi-user setups in which ’guix-daemon’ runs… |
CVE-2021-21438 | Low | 3.5 | 2021-03-22 | Agents are able to see linked FAQ articles without permissions (defined in FAQ Category). This issue affects: FAQ version 6.0.29 and prior versions, OTRS versi… |
CVE-2021-21437 | Low | 3.5 | 2021-03-22 | Agents are able to see linked Config Items without permissions, which are defined in General Catalog. This issue affects: OTRSCIsInCustomerFrontend 7.0.15 and… |
CVE-2021-22661 | High | 7.5 | 2021-02-26 | Changing the password on the module webpage does not require the user to type in the current password first. Thus, the password could be changed by a user or e… |
CVE-2019-18945 | High | 7.3 | 2021-02-26 | Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to privilege escalation vulnerability. |
CVE-2021-21436 | Low | 3.5 | 2021-02-08 | Agents are able to see and link Config Items without permissions, which are defined in General Catalog. This issue affects: OTRS AG OTRSCIsInCustomerFrontend 7… |
CVE-2021-1258 | Medium | 5.5 | 2021-01-13 | A vulnerability in the upgrade component of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker with low privileges to read ar… |
CVE-2020-13922 | Medium | 6.5 | 2021-01-11 | Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface. |
CVE-2020-3426 | High | 7.5 | 2020-09-24 | A vulnerability in the implementation of the Low Power, Wide Area (LPWA) subsystem of Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Ro… |
CVE-2019-16017 | Medium | 6.8 | 2020-09-23 | A vulnerability in the Operations, Administration, Maintenance and Provisioning (OAMP) OpsConsole Server for Cisco Unified Customer Voice Portal (CVP) could al… |
CVE-2020-3530 | High | 8.4 | 2020-09-04 | A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to execute that comma… |
CVE-2020-3473 | High | 7.8 | 2020-09-04 | A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local CLI shell user to elevate priv… |
CVE-2020-3485 | Medium | 6.3 | 2020-08-26 | A vulnerability in the role-based access control (RBAC) functionality of the web management software of Cisco Vision Dynamic Signage Director could allow an au… |
CVE-2020-3443 | High | 8.8 | 2020-08-26 | A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges and execute commands… |
CVE-2020-7352 | High | 8.4 | 2020-08-06 | The GalaxyClientService component of GOG Galaxy runs with elevated SYSTEM privileges in a Windows environment. Due to the software shipping with embedded, stat… |
CVE-2020-11933 | High | 7.3 | 2020-07-29 | cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical attacker could exploit… |
CVE-2020-12028 | High | 7.3 | 2020-07-20 | In all versions of FactoryTalk View SEA remote, an authenticated attacker may be able to utilize certain handlers to interact with the data on the remote endpo… |
CVE-2020-3379 | High | 7.8 | 2020-07-16 | A vulnerability in Cisco SD-WAN Solution Software could allow an authenticated, local attacker to elevate privileges to Administrator on the underlying operati… |
CVE-2020-3180 | High | 7.8 | 2020-07-16 | A vulnerability in Cisco SD-WAN Solution Software could allow an unauthenticated, local attacker to access an affected device by using an account that has a de… |
CVE-2020-3229 | High | 8.8 | 2020-06-03 | A vulnerability in Role Based Access Control (RBAC) functionality of Cisco IOS XE Web Management Software could allow a Read-Only authenticated, remote attacke… |
CVE-2020-3227 | Critical | 9.8 | 2020-06-03 | A vulnerability in the authorization controls for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an unauthenticated, rem… |
CVE-2020-3215 | Medium | 6.7 | 2020-06-03 | A vulnerability in the Virtual Services Container of Cisco IOS XE Software could allow an authenticated, local attacker to gain root-level privileges on an aff… |
CVE-2020-3214 | Medium | 6.7 | 2020-06-03 | A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to escalate their privileges to a user with root-level privileges. The vu… |
CVE-2020-3213 | Medium | 6.7 | 2020-06-03 | A vulnerability in the ROMMON of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to those of the root user of the unde… |
CVE-2020-3208 | Medium | 6.7 | 2020-06-03 | A vulnerability in the image verification feature of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) could al… |
CVE-2019-19100 | High | 7.5 | 2020-04-29 | A privilege escalation vulnerability in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, < 4.3.11SP, < 4.4.9SP, < 4.5.4SP, <. 4.6.3SP… |
CVE-2020-8489 | High | 7.8 | 2020-04-29 | Insufficient protection of the inter-process communication functions in ABB System 800xA Information Management (all published versions) enables an attacker au… |
CVE-2020-8488 | High | 7.8 | 2020-04-29 | Insufficient protection of the inter-process communication functions in ABB System 800xA Batch Management (all published versions) enables an attacker authenti… |
CVE-2020-8487 | Medium | 6.6 | 2020-04-29 | Insufficient protection of the inter-process communication functions in ABB System 800xA Base (all published versions) enables an attacker authenticated on the… |
CVE-2020-8486 | Medium | 6.6 | 2020-04-29 | Insufficient protection of the inter-process communication functions in ABB System 800xA RNRP (all published versions) enables an attacker authenticated on the… |
CVE-2020-8485 | High | 7.8 | 2020-04-29 | Insufficient protection of the inter-process communication functions in ABB System 800xA for MOD 300 (all published versions) enables an attacker authenticated… |
CVE-2020-8484 | High | 7.8 | 2020-04-29 | Insufficient protection of the inter-process communication functions in ABB System 800xA for DCI (all published versions) enables an attacker authenticated on… |
CVE-2020-8478 | Medium | 5.3 | 2020-04-29 | Insufficient protection of the inter-process communication functions in ABB System 800xA products OPC Server for AC 800M, MMS Server for AC 800M and Base Softw… |
CVE-2019-19107 | Medium | 6.2 | 2020-04-22 | The Configuration pages in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway for user profiles and services transfer the password in plai… |
CVE-2019-19106 | Critical | 9.1 | 2020-04-22 | Improper implementation of Access Control in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway allows an unauthorized user to access data… |
CVE-2020-7255 | Low | 3.9 | 2020-04-15 | Privilege escalation vulnerability in the administrative user interface in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allo… |
CVE-2020-7259 | Medium | 6.6 | 2020-04-15 | Exploitation of Privilege/Trust vulnerability in file in McAfee Endpoint Security (ENS) Prior to 10.7.0 February 2020 Update allows local users to bypass local… |
CVE-2020-7257 | High | 8.4 | 2020-04-15 | Privilege escalation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows local users to cause the deletion… |
CVE-2020-1630 | Medium | 5.0 | 2020-04-08 | A privilege escalation vulnerability in Juniper Networks Junos OS devices configured with dual Routing Engines (RE), Virtual Chassis (VC) or high-availability… |
CVE-2020-1619 | Medium | 6.0 | 2020-04-08 | A privilege escalation vulnerability in Juniper Networks QFX10K Series, EX9200 Series, MX Series, and PTX Series with Next-Generation Routing Engine (NG-RE), a… |
CVE-2020-7263 | Medium | 6.5 | 2020-04-01 | Improper access control vulnerability in ESconfigTool.exe in McAfee Endpoint Security (ENS) for Windows all current versions allows local administrator to alte… |
CVE-2020-7260 | High | 7.3 | 2020-03-26 | DLL Side Loading vulnerability in the installer for McAfee Application and Change Control (MACC) prior to 8.3 allows local users to execute arbitrary code via… |
CVE-2020-3265 | High | 7.8 | 2020-03-19 | A vulnerability in Cisco SD-WAN Solution software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system… |
CVE-2020-7254 | High | 7.7 | 2020-03-12 | Privilege Escalation vulnerability in the command line interface in McAfee Advanced Threat Defense (ATD) 4.x prior to 4.8.2 allows local users to execute arbit… |
CVE-2020-3112 | High | 8.8 | 2020-02-19 | A vulnerability in the REST API endpoint of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to elevate privileges on the… |
CVE-2019-6195 | Medium | 4.8 | 2020-02-14 | An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user… |
CVE-2020-8093 | Medium | 5.3 | 2020-01-30 | A vulnerability in the AntivirusforMac binary as used in Bitdefender Antivirus for Mac allows an attacker to inject a library using DYLD environment variable t… |
CVE-2020-8092 | Low | 1.6 | 2020-01-30 | A privilege escalation vulnerability in BDLDaemon as used in Bitdefender Antivirus for Mac allows a local attacker to obtain authentication tokens for requests… |
CVE-2020-3115 | High | 8.8 | 2020-01-26 | A vulnerability in the CLI of the Cisco SD-WAN Solution vManage software could allow an authenticated, local attacker to elevate privileges to root-level privi… |
CVE-2019-14879 | Medium | 5.4 | 2020-01-07 | A vulnerability was found in Moodle versions 3.7.x before 3.7.3, 3.6.x before 3.6.7 and 3.5.x before 3.5.9. When a cohort role assignment was removed, the asso… |
CVE-2019-15996 | Medium | 6.7 | 2019-11-26 | A vulnerability in Cisco DNA Spaces: Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underly… |
CVE-2019-15960 | Medium | 5.4 | 2019-11-26 | A vulnerability in the Webex Network Recording Admin page of Cisco Webex Meetings could allow an authenticated, remote attacker to elevate privileges in the co… |
CVE-2019-1982 | Medium | 5.3 | 2019-11-05 | A vulnerability in the HTTP traffic filtering component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepo… |
CVE-2019-1981 | Medium | 5.8 | 2019-11-05 | A vulnerability in the normalization functionality of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower M… |
CVE-2019-1980 | Medium | 5.3 | 2019-11-05 | A vulnerability in the protocol detection component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower… |
CVE-2019-1978 | Medium | 5.8 | 2019-11-05 | A vulnerability in the stream reassembly component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower M… |
CVE-2019-17326 | Medium | 6.5 | 2019-10-30 | ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to arbitrary file deletion by issuing a HTTP GET request with a specially crafted paramet… |
CVE-2019-17322 | Medium | 6.5 | 2019-10-30 | ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation via a POST request with the parameter set to the file path to be written. This ca… |
CVE-2019-15277 | Medium | 6.7 | 2019-10-16 | A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to execute code with root pr… |
CVE-2019-15275 | Medium | 6.7 | 2019-10-16 | A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to execute arbitrary command… |
CVE-2019-15272 | Medium | 6.5 | 2019-10-02 | A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) co… |
CVE-2019-11773 | High | 7.8 | 2019-09-12 | Prior to 0.1, AIX builds of Eclipse OMR contain unused RPATHs which may facilitate code injection and privilege elevation by local users. |
CVE-2019-10709 | Critical | 9.8 | 2019-09-04 | AsusPTPFilter.sys on Asus Precision TouchPad 11.0.0.25 hardware has a Pool Overflow associated with the \\.\AsusTP device, leading to a DoS or potentially priv… |
CVE-2019-1969 | Medium | 5.3 | 2019-08-30 | A vulnerability in the implementation of the Simple Network Management Protocol (SNMP) Access Control List (ACL) feature of Cisco NX-OS Software could allow an… |
CVE-2019-1966 | High | 7.8 | 2019-08-30 | A vulnerability in a specific CLI command within the local management (local-mgmt) context for Cisco UCS Fabric Interconnect Software could allow an authentica… |
CVE-2019-11245 | Medium | 4.9 | 2019-08-29 | In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container restart, or if the im… |
CVE-2016-10935 | Critical | 9.8 | 2019-08-27 | The woocommerce-exporter plugin before 1.8.4 for WordPress has privilege escalation. |
CVE-2019-13014 | Medium | 5.5 | 2019-08-23 | Little Snitch versions 4.4.0 fixes a vulnerability in a privileged helper tool. However, the operating system may have made a copy of the privileged helper whi… |