CWE-264 (page 2)
Page 2 of 56 — CVEs classified under CWE-264, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-45066 | Medium | 5.4 | 2022-11-17 | Auth. (subscriber+) Broken Access Control vulnerability in WooSwipe WooCommerce Gallery plugin <= 2.0.1 on WordPress. |
CVE-2022-41132 | Medium | 6.1 | 2022-11-17 | Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress. |
CVE-2022-38461 | Medium | 5.4 | 2022-11-17 | Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with a subscriber or higher user role to change… |
CVE-2022-42460 | Medium | 6.5 | 2022-11-10 | Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress. |
CVE-2022-41978 | High | 8.8 | 2022-11-09 | Auth. (subscriber+) Arbitrary Options Update vulnerability in Zoho CRM Lead Magnet plugin <= 1.7.5.8 on WordPress. |
CVE-2022-38104 | High | 7.2 | 2022-10-21 | Auth. WordPress Options Change (siteurl, users_can_register, default_role, admin_email and new_admin_email) vulnerability in Biplob Adhikari's Accordions – Mul… |
CVE-2022-3421 | Medium | 5.6 | 2022-10-17 | An attacker can pre-create the `/Applications/Google\ Drive.app/Contents/MacOS` directory which is expected to be owned by root to be owned by a non-root user… |
CVE-2021-28052 | High | 7.5 | 2022-09-26 | A tenant administrator Hitachi Content Platform (HCP) may modify the configuration in another tenant without authorization, potentially allowing unauthorized a… |
CVE-2022-38134 | Medium | 4.3 | 2022-09-23 | Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress. |
CVE-2022-35238 | Medium | 6.5 | 2022-09-23 | Unauthenticated Plugin Settings Change vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress. |
CVE-2022-38135 | Medium | 5.4 | 2022-09-12 | Broken Access Control vulnerability in Dean Oakley's Photospace Gallery plugin <= 2.3.5 at WordPress allows users with subscriber or higher role to change plug… |
CVE-2022-38070 | Medium | 5.4 | 2022-09-09 | Privilege Escalation (subscriber+) vulnerability in Pop-up plugin <= 1.1.5 at WordPress. |
CVE-2022-38067 | Medium | 6.5 | 2022-09-09 | Unauthenticated Event Deletion vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress. |
CVE-2022-38058 | Medium | 4.3 | 2022-09-09 | Authenticated (subscriber+) Plugin Setting change vulnerability in WP Shamsi plugin <= 4.1.1 at WordPress. |
CVE-2022-36793 | Medium | 6.5 | 2022-09-09 | Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities in WP Shop plugin <= 3.9.6 at WordPress. |
CVE-2022-37344 | High | 7.6 | 2022-09-06 | Missing Access Control vulnerability in PHP Crafts Accommodation System plugin <= 1.0.1 at WordPress. |
CVE-2022-36427 | High | 7.3 | 2022-09-06 | Missing Access Control vulnerability in About Rentals. Inc. About Rentals plugin <= 1.5 at WordPress. |
CVE-2022-36387 | High | 7.6 | 2022-09-06 | Broken Access Control vulnerability in Alessio Caiazza's About Me plugin <= 1.0.12 at WordPress. |
CVE-2022-36425 | Medium | 5.4 | 2022-09-06 | Broken Access Control vulnerability in Beaver Builder plugin <= 2.5.4.3 at WordPress. |
CVE-2022-35242 | Medium | 6.5 | 2022-08-23 | Unauthenticated plugin settings change vulnerability in 59sec THE Leads Management System: 59sec LITE plugin <= 3.4.1 at WordPress. |
CVE-2022-34868 | High | 8.8 | 2022-08-23 | Authenticated Arbitrary Settings Update vulnerability in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress. |
CVE-2022-34149 | Critical | 9.8 | 2022-08-22 | Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress. |
CVE-2022-25649 | Medium | 5.0 | 2022-08-05 | Multiple Improper Access Control vulnerabilities in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress. |
CVE-2022-33970 | High | 7.2 | 2022-07-27 | Authenticated WordPress Options Change vulnerability in Biplob018 Shortcode Addons plugin <= 3.1.2 at WordPress. |
CVE-2022-36375 | High | 7.2 | 2022-07-25 | Authenticated (high role user) WordPress Options Change vulnerability in Biplob Adhikari's Tabs plugin <= 3.6.0 at WordPress. |
CVE-2022-33969 | High | 7.2 | 2022-07-25 | Authenticated WordPress Options Change vulnerability in Biplob Adhikari's Flipbox plugin <= 2.6.0 at WordPress. |
CVE-2022-27235 | Medium | 6.3 | 2022-07-22 | Multiple Broken Access Control vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress. |
CVE-2022-34487 | Critical | 9.8 | 2022-07-21 | Unauthenticated Arbitrary Option Update vulnerability in biplob018's Shortcode Addons plugin <= 3.0.2 at WordPress. |
CVE-2022-33198 | Critical | 9.8 | 2022-07-21 | Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin <= 2.0.2 at WordPress. |
CVE-2022-23714 | High | 7.8 | 2022-07-06 | A local privilege escalation (LPE) issue was discovered in the ransomware canaries features of Elastic Endpoint Security for Windows, which could allow unprivi… |
CVE-2021-33036 | High | 8.8 | 2022-06-15 | In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary co… |
CVE-2020-36528 | Medium | 5.5 | 2022-06-07 | A vulnerability, which was classified as critical, was found in Platinum Mobile 1.0.4.850. Affected is /MobileHandler.ashx which leads to broken access control… |
CVE-2022-29423 | Low | 3.8 | 2022-05-06 | Pro Features Lock Bypass vulnerability in Countdown & Clock plugin <= 2.3.2 at WordPress. |
CVE-2022-1548 | Low | 3.7 | 2022-05-03 | Mattermost Playbooks plugin 1.25 and earlier fails to properly restrict user-level permissions, which allows playbook members to escalate their membership priv… |
CVE-2022-29444 | Medium | 6.5 | 2022-05-02 | Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability in Cloudways Breeze plugin <= 2.0.2 on WordPress allows users with a subscriber or h… |
CVE-2022-0237 | Medium | 4.0 | 2022-03-17 | Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due t… |
CVE-2022-23731 | High | 7.8 | 2022-03-11 | V8 javascript engine (heap vulnerability) can cause privilege escalation ,which can impact on some webOS TV models. |
CVE-2022-23709 | Medium | 4.3 | 2022-03-03 | A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A user with this privilege would be able to… |
CVE-2022-23708 | Medium | 4.3 | 2022-03-03 | A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the sec… |
CVE-2021-27644 | High | 8.8 | 2021-11-01 | In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with… |
CVE-2021-25482 | Medium | 5.9 | 2021-10-06 | SQL injection vulnerabilities in CMFA framework prior to SMR Oct-2021 Release 1 allow untrusted application to overwrite some CMFA framework information. |
CVE-2021-25472 | Medium | 4.0 | 2021-10-06 | An improper access control vulnerability in BluetoothSettingsProvider prior to SMR Oct-2021 Release 1 allows untrusted application to overwrite some Bluetooth… |
CVE-2021-36879 | Critical | 9.8 | 2021-09-27 | Unauthenticated Privilege Escalation vulnerability in WordPress uListing plugin (versions <= 2.0.5). Possible if WordPress configuration allows user registrati… |
CVE-2021-28497 | Medium | 4.4 | 2021-09-09 | In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, the bash shell might be accessible… |
CVE-2021-27851 | Medium | 5.5 | 2021-04-26 | A security vulnerability that can lead to local privilege escalation has been found in ’guix-daemon’. It affects multi-user setups in which ’guix-daemon’ runs… |
CVE-2021-21438 | Low | 3.5 | 2021-03-22 | Agents are able to see linked FAQ articles without permissions (defined in FAQ Category). This issue affects: FAQ version 6.0.29 and prior versions, OTRS versi… |
CVE-2021-21437 | Low | 3.5 | 2021-03-22 | Agents are able to see linked Config Items without permissions, which are defined in General Catalog. This issue affects: OTRSCIsInCustomerFrontend 7.0.15 and… |
CVE-2021-22661 | High | 7.5 | 2021-02-26 | Changing the password on the module webpage does not require the user to type in the current password first. Thus, the password could be changed by a user or e… |
CVE-2019-18945 | High | 7.3 | 2021-02-26 | Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to privilege escalation vulnerability. |
CVE-2021-21436 | Low | 3.5 | 2021-02-08 | Agents are able to see and link Config Items without permissions, which are defined in General Catalog. This issue affects: OTRS AG OTRSCIsInCustomerFrontend 7… |
CVE-2021-1258 | Medium | 5.5 | 2021-01-13 | A vulnerability in the upgrade component of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker with low privileges to read ar… |
CVE-2020-13922 | Medium | 6.5 | 2021-01-11 | Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface. |
CVE-2020-3426 | High | 7.5 | 2020-09-24 | A vulnerability in the implementation of the Low Power, Wide Area (LPWA) subsystem of Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Ro… |
CVE-2019-16017 | Medium | 6.8 | 2020-09-23 | A vulnerability in the Operations, Administration, Maintenance and Provisioning (OAMP) OpsConsole Server for Cisco Unified Customer Voice Portal (CVP) could al… |
CVE-2020-3530 | High | 8.4 | 2020-09-04 | A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to execute that comma… |
CVE-2020-3473 | High | 7.8 | 2020-09-04 | A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local CLI shell user to elevate priv… |
CVE-2020-3485 | Medium | 6.3 | 2020-08-26 | A vulnerability in the role-based access control (RBAC) functionality of the web management software of Cisco Vision Dynamic Signage Director could allow an au… |
CVE-2020-3443 | High | 8.8 | 2020-08-26 | A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges and execute commands… |
CVE-2020-7352 | High | 8.4 | 2020-08-06 | The GalaxyClientService component of GOG Galaxy runs with elevated SYSTEM privileges in a Windows environment. Due to the software shipping with embedded, stat… |
CVE-2020-11933 | High | 7.3 | 2020-07-29 | cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical attacker could exploit… |
CVE-2020-12028 | High | 7.3 | 2020-07-20 | In all versions of FactoryTalk View SEA remote, an authenticated attacker may be able to utilize certain handlers to interact with the data on the remote endpo… |
CVE-2020-3379 | High | 7.8 | 2020-07-16 | A vulnerability in Cisco SD-WAN Solution Software could allow an authenticated, local attacker to elevate privileges to Administrator on the underlying operati… |
CVE-2020-3180 | High | 7.8 | 2020-07-16 | A vulnerability in Cisco SD-WAN Solution Software could allow an unauthenticated, local attacker to access an affected device by using an account that has a de… |
CVE-2020-3229 | High | 8.8 | 2020-06-03 | A vulnerability in Role Based Access Control (RBAC) functionality of Cisco IOS XE Web Management Software could allow a Read-Only authenticated, remote attacke… |
CVE-2020-3227 | Critical | 9.8 | 2020-06-03 | A vulnerability in the authorization controls for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an unauthenticated, rem… |
CVE-2020-3215 | Medium | 6.7 | 2020-06-03 | A vulnerability in the Virtual Services Container of Cisco IOS XE Software could allow an authenticated, local attacker to gain root-level privileges on an aff… |
CVE-2020-3214 | Medium | 6.7 | 2020-06-03 | A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to escalate their privileges to a user with root-level privileges. The vu… |
CVE-2020-3213 | Medium | 6.7 | 2020-06-03 | A vulnerability in the ROMMON of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to those of the root user of the unde… |
CVE-2020-3208 | Medium | 6.7 | 2020-06-03 | A vulnerability in the image verification feature of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) could al… |
CVE-2019-19100 | High | 7.5 | 2020-04-29 | A privilege escalation vulnerability in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, < 4.3.11SP, < 4.4.9SP, < 4.5.4SP, <. 4.6.3SP… |
CVE-2020-8489 | High | 7.8 | 2020-04-29 | Insufficient protection of the inter-process communication functions in ABB System 800xA Information Management (all published versions) enables an attacker au… |
CVE-2020-8488 | High | 7.8 | 2020-04-29 | Insufficient protection of the inter-process communication functions in ABB System 800xA Batch Management (all published versions) enables an attacker authenti… |
CVE-2020-8487 | Medium | 6.6 | 2020-04-29 | Insufficient protection of the inter-process communication functions in ABB System 800xA Base (all published versions) enables an attacker authenticated on the… |
CVE-2020-8486 | Medium | 6.6 | 2020-04-29 | Insufficient protection of the inter-process communication functions in ABB System 800xA RNRP (all published versions) enables an attacker authenticated on the… |
CVE-2020-8485 | High | 7.8 | 2020-04-29 | Insufficient protection of the inter-process communication functions in ABB System 800xA for MOD 300 (all published versions) enables an attacker authenticated… |
CVE-2020-8484 | High | 7.8 | 2020-04-29 | Insufficient protection of the inter-process communication functions in ABB System 800xA for DCI (all published versions) enables an attacker authenticated on… |
CVE-2020-8478 | Medium | 5.3 | 2020-04-29 | Insufficient protection of the inter-process communication functions in ABB System 800xA products OPC Server for AC 800M, MMS Server for AC 800M and Base Softw… |
CVE-2019-19107 | Medium | 6.2 | 2020-04-22 | The Configuration pages in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway for user profiles and services transfer the password in plai… |
CVE-2019-19106 | Critical | 9.1 | 2020-04-22 | Improper implementation of Access Control in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway allows an unauthorized user to access data… |
CVE-2020-7255 | Low | 3.9 | 2020-04-15 | Privilege escalation vulnerability in the administrative user interface in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allo… |
CVE-2020-7259 | Medium | 6.6 | 2020-04-15 | Exploitation of Privilege/Trust vulnerability in file in McAfee Endpoint Security (ENS) Prior to 10.7.0 February 2020 Update allows local users to bypass local… |
CVE-2020-7257 | High | 8.4 | 2020-04-15 | Privilege escalation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows local users to cause the deletion… |
CVE-2020-1630 | Medium | 5.0 | 2020-04-08 | A privilege escalation vulnerability in Juniper Networks Junos OS devices configured with dual Routing Engines (RE), Virtual Chassis (VC) or high-availability… |
CVE-2020-1619 | Medium | 6.0 | 2020-04-08 | A privilege escalation vulnerability in Juniper Networks QFX10K Series, EX9200 Series, MX Series, and PTX Series with Next-Generation Routing Engine (NG-RE), a… |
CVE-2020-7263 | Medium | 6.5 | 2020-04-01 | Improper access control vulnerability in ESconfigTool.exe in McAfee Endpoint Security (ENS) for Windows all current versions allows local administrator to alte… |
CVE-2020-7260 | High | 7.3 | 2020-03-26 | DLL Side Loading vulnerability in the installer for McAfee Application and Change Control (MACC) prior to 8.3 allows local users to execute arbitrary code via… |
CVE-2020-3265 | High | 7.8 | 2020-03-19 | A vulnerability in Cisco SD-WAN Solution software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system… |
CVE-2020-7254 | High | 7.7 | 2020-03-12 | Privilege Escalation vulnerability in the command line interface in McAfee Advanced Threat Defense (ATD) 4.x prior to 4.8.2 allows local users to execute arbit… |
CVE-2020-3112 | High | 8.8 | 2020-02-19 | A vulnerability in the REST API endpoint of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to elevate privileges on the… |
CVE-2019-6195 | Medium | 4.8 | 2020-02-14 | An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user… |
CVE-2020-8093 | Medium | 5.3 | 2020-01-30 | A vulnerability in the AntivirusforMac binary as used in Bitdefender Antivirus for Mac allows an attacker to inject a library using DYLD environment variable t… |
CVE-2020-8092 | Low | 1.6 | 2020-01-30 | A privilege escalation vulnerability in BDLDaemon as used in Bitdefender Antivirus for Mac allows a local attacker to obtain authentication tokens for requests… |
CVE-2020-3115 | High | 8.8 | 2020-01-26 | A vulnerability in the CLI of the Cisco SD-WAN Solution vManage software could allow an authenticated, local attacker to elevate privileges to root-level privi… |
CVE-2019-14879 | Medium | 5.4 | 2020-01-07 | A vulnerability was found in Moodle versions 3.7.x before 3.7.3, 3.6.x before 3.6.7 and 3.5.x before 3.5.9. When a cohort role assignment was removed, the asso… |
CVE-2019-15996 | Medium | 6.7 | 2019-11-26 | A vulnerability in Cisco DNA Spaces: Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underly… |
CVE-2019-15960 | Medium | 5.4 | 2019-11-26 | A vulnerability in the Webex Network Recording Admin page of Cisco Webex Meetings could allow an authenticated, remote attacker to elevate privileges in the co… |
CVE-2019-1982 | Medium | 5.3 | 2019-11-05 | A vulnerability in the HTTP traffic filtering component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepo… |
CVE-2019-1981 | Medium | 5.8 | 2019-11-05 | A vulnerability in the normalization functionality of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower M… |
CVE-2019-1980 | Medium | 5.3 | 2019-11-05 | A vulnerability in the protocol detection component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower… |
CVE-2019-1978 | Medium | 5.8 | 2019-11-05 | A vulnerability in the stream reassembly component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower M… |