CWE-264 (page 3)
Page 3 of 55 — CVEs classified under CWE-264, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-13013 | Medium | 5.5 | 2019-08-23 | Little Snitch versions 4.3.0 to 4.3.2 have a local privilege escalation vulnerability in their privileged helper tool. The privileged helper tool implements an… |
CVE-2016-10929 | Medium | 5.3 | 2019-08-22 | The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in. |
CVE-2017-18584 | High | 7.5 | 2019-08-22 | The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action. |
CVE-2016-10923 | Critical | 9.8 | 2019-08-22 | The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation. |
CVE-2016-10922 | Critical | 9.8 | 2019-08-22 | The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation. |
CVE-2019-14257 | High | 7.8 | 2019-08-21 | pyraw in Zenoss 2.5.3 allows local privilege escalation by modifying environment variables to redirect execution before privileges are dropped, aka ZEN-31765. |
CVE-2019-12634 | High | 7.5 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Ex… |
CVE-2019-2122 | High | 7.3 | 2019-08-20 | In LockTaskController.lockKeyguardIfNeeded of the LockTaskController.java, there was a difference in the handling of the default case between the WindowManager… |
CVE-2019-3637 | Medium | 6.7 | 2019-08-14 | Privilege Escalation vulnerability in McAfee FRP 5.x prior to 5.1.0.209 allows local users to gain elevated privileges via running McAfee Tray with elevated pr… |
CVE-2016-10886 | Critical | 9.8 | 2019-08-14 | The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions. |
CVE-2019-12808 | High | 7.8 | 2019-08-13 | ALTOOLS update service 18.1 and earlier versions contains a local privilege escalation vulnerability due to insecure permission. An attacker can overwrite an e… |
CVE-2019-1972 | Medium | 6.7 | 2019-08-08 | A vulnerability the Cisco Enterprise NFV Infrastructure Software (NFVIS) restricted CLI could allow an authenticated, local attacker with valid administrator-l… |
CVE-2017-18455 | Low | 2.7 | 2019-08-02 | In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208). |
CVE-2017-18451 | Medium | 5.3 | 2019-08-02 | cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade (SEC-257). |
CVE-2017-18450 | Medium | 4.5 | 2019-08-02 | cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert_roundcube_mysql2sqlite (SEC-255). |
CVE-2017-18413 | High | 7.8 | 2019-08-02 | In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears (SEC-299). |
CVE-2017-18399 | Low | 3.7 | 2019-08-02 | cPanel before 68.0.15 allows attackers to read root's crontab file during a short time interval upon enabling or disabling sqloptimizer (SEC-332). |
CVE-2017-18383 | High | 7.8 | 2019-08-02 | cPanel before 68.0.15 writes home-directory backups to an incorrect location (SEC-309). |
CVE-2019-11771 | High | 7.8 | 2019-07-17 | AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users. |
CVE-2019-1889 | High | 7.2 | 2019-07-04 | A vulnerability in the REST API for software device management in Cisco Application Policy Infrastructure Controller (APIC) Software could allow an authenticat… |
CVE-2019-1855 | High | 7.3 | 2019-07-04 | A vulnerability in the loading mechanism of specific dynamic link libraries in Cisco Jabber for Windows could allow an authenticated, local attacker to perform… |
CVE-2017-8230 | High | 8.8 | 2019-07-03 | On Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices, the users on the device are divided into 2 groups "admin" and "user". However, as a part of security ana… |
CVE-2017-8228 | High | 8.8 | 2019-07-03 | Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices mishandle reboots within the past two hours. Amcrest cloud services does not perform a thorough verification… |
CVE-2019-13125 | High | 7.8 | 2019-07-01 | HaboMalHunter through 2.0.0.3 in Tencent Habo allows attackers to evade dynamic malware analysis via PIE compilation. |
CVE-2019-1621 | High | 7.5 | 2019-06-27 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to gain acces… |
CVE-2019-1620 | Critical | 9.8 | 2019-06-27 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to upload arb… |
CVE-2019-1906 | Medium | 6.5 | 2019-06-20 | A vulnerability in the Virtual Domain system of Cisco Prime Infrastructure (PI) could allow an authenticated, remote attacker to change the virtual domain conf… |
CVE-2019-1626 | High | 8.8 | 2019-06-20 | A vulnerability in the vManage web-based UI (Web UI) of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to gain elevated privileges on… |
CVE-2019-1625 | High | 7.8 | 2019-06-20 | A vulnerability in the CLI of Cisco SD-WAN Solution could allow an authenticated, local attacker to elevate lower-level privileges to the root user on an affec… |
CVE-2019-2003 | High | 8.8 | 2019-06-19 | In addLinks of Linkify.java, there is a possible phishing vector due to an unusual root cause. This could lead to remote code execution or misdirection of clic… |
CVE-2018-10239 | Medium | 6.7 | 2019-06-17 | A privilege escalation vulnerability in the "support access" feature on Infoblox NIOS 6.8 through 8.4.1 could allow a locally authenticated administrator to te… |
CVE-2019-0164 | High | 7.3 | 2019-06-13 | Improper permissions in the installer for Intel(R) Turbo Boost Max Technology 3.0 driver version 1.0.0.1035 and before may allow an authenticated user to poten… |
CVE-2019-0128 | High | 7.8 | 2019-06-13 | Improper permissions in the installer for Intel(R) Chipset Device Software (INF Update Utility) before version 10.1.1.45 may allow an authenticated user to esc… |
CVE-2019-2102 | High | 8.8 | 2019-06-07 | In the Bluetooth Low Energy (BLE) specification, there is a provided example Long Term Key (LTK). If a BLE device were to use this as a hardcoded LTK, it is th… |
CVE-2017-18376 | High | 8.8 | 2019-06-02 | An improper authorization check in the User API in TheHive before 2.13.4 and 3.x before 3.3.1 allows users with read-only or read/write access to escalate thei… |
CVE-2019-10132 | High | 8.8 | 2019-05-22 | A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configuration paramet… |
CVE-2019-1730 | Medium | 6.7 | 2019-05-15 | A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to bypass the limited command set of the… |
CVE-2019-1727 | Medium | 6.7 | 2019-05-15 | A vulnerability in the Python scripting subsystem of Cisco NX-OS Software could allow an authenticated, local attacker to escape the Python parser and issue ar… |
CVE-2019-1803 | Medium | 6.7 | 2019-05-03 | A vulnerability in the filesystem management for the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an authe… |
CVE-2019-1682 | High | 7.8 | 2019-05-03 | A vulnerability in the FUSE filesystem functionality for Cisco Application Policy Infrastructure Controller (APIC) software could allow an authenticated, local… |
CVE-2019-1592 | High | 7.8 | 2019-05-03 | A vulnerability in the background operations functionality of Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow… |
CVE-2016-1579 | Medium | 6.7 | 2019-04-22 | UDM provides support for running commands after a download is completed, this is currently made use of for click package installation. This functionality was n… |
CVE-2015-1341 | High | 7.4 | 2019-04-22 | Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport befor… |
CVE-2015-1327 | Low | 3.9 | 2019-04-22 | Content Hub before version 0.0+15.04.20150331-0ubuntu1.0 DBUS API only requires a file path for a content item, it doesn't actually require the confined app ha… |
CVE-2019-0796 | Medium | 5.5 | 2019-04-09 | An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulne… |
CVE-2019-0731 | High | 7.8 | 2019-04-09 | An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulne… |
CVE-2019-0730 | High | 7.8 | 2019-04-09 | An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulne… |
CVE-2019-10885 | High | 7.8 | 2019-04-05 | An issue was discovered in Ivanti Workspace Control before 10.3.90.0. Local authenticated users with low privileges in a Workspace Control managed session can… |
CVE-2015-3965 | High | 8.8 | 2019-03-23 | Hospira Symbiq Infusion System 3.13 and earlier allows remote authenticated users to trigger "unanticipated operations" by leveraging "elevated privileges" for… |
CVE-2016-9166 | High | 7.5 | 2019-03-21 | NetIQ eDirectory versions prior to 9.0.2, under some circumstances, could be susceptible to downgrade of communication security. |
CVE-2019-0135 | High | 7.8 | 2019-03-14 | Improper permissions in the installer for Intel(R) Accelerated Storage Manager in Intel(R) RSTe before version 5.5.0.2015 may allow an authenticated user to po… |
CVE-2019-0129 | High | 7.8 | 2019-03-14 | Improper permissions for Intel(R) USB 3.0 Creator Utility all versions may allow an authenticated user to potentially enable escalation of privilege via local… |
CVE-2019-0121 | High | 7.8 | 2019-03-14 | Improper permissions in Intel(R) Matrix Storage Manager 8.9.0.1023 and before may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2019-9768 | High | 7.5 | 2019-03-14 | Thinkst Canarytokens through commit hash 4e89ee0 (2019-03-01) relies on limited variation in size, metadata, and timestamp, which makes it easier for attackers… |
CVE-2019-1723 | Critical | 9.8 | 2019-03-13 | A vulnerability in the Cisco Common Services Platform Collector (CSPC) could allow an unauthenticated, remote attacker to access an affected device by using an… |
CVE-2019-9637 | High | 7.5 | 2019-03-09 | An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename() across filesystems is implemented, it is pos… |
CVE-2019-1602 | High | 7.8 | 2019-03-08 | A vulnerability in the filesystem permissions of Cisco NX-OS Software could allow an authenticated, local attacker to access sensitive data that could be used… |
CVE-2019-3779 | High | 8.8 | 2019-03-08 | Cloud Foundry Container Runtime, versions prior to 0.29.0, deploys Kubernetes clusters utilize the same CA (Certificate Authority) to sign and trust certs for… |
CVE-2019-1600 | Medium | 4.4 | 2019-03-07 | A vulnerability in the file system permissions of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to access sensitive… |
CVE-2019-1596 | High | 7.8 | 2019-03-07 | A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to escalate their privilege level to roo… |
CVE-2019-1594 | High | 7.4 | 2019-03-06 | A vulnerability in the 802.1X implementation for Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) cond… |
CVE-2019-1593 | High | 7.8 | 2019-03-06 | A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to escalate their privilege level by exe… |
CVE-2019-1591 | High | 7.8 | 2019-03-06 | A vulnerability in a specific CLI command implementation of Cisco Nexus 9000 Series ACI Mode Switch Software could allow an authenticated, local attacker to es… |
CVE-2019-3475 | High | 7.8 | 2019-02-20 | A local privilege escalation vulnerability in the famtd component of Micro Focus Filr 3.0 allows a local attacker authenticated as a low privilege user to esca… |
CVE-2019-1660 | Medium | 5.3 | 2019-02-07 | A vulnerability in the Simple Object Access Protocol (SOAP) of Cisco TelePresence Management Suite (TMS) software could allow an unauthenticated, remote attack… |
CVE-2019-1648 | High | 7.8 | 2019-01-24 | A vulnerability in the user group configuration of the Cisco SD-WAN Solution could allow an authenticated, local attacker to gain elevated privileges on an aff… |
CVE-2019-1646 | High | 7.8 | 2019-01-24 | A vulnerability in the local CLI of the Cisco SD-WAN Solution could allow an authenticated, local attacker to escalate privileges and modify device configurati… |
CVE-2018-11462 | Critical | 9.8 | 2018-12-12 | A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1… |
CVE-2018-11461 | Medium | 6.6 | 2018-12-12 | A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1… |
CVE-2018-0284 | Medium | 6.5 | 2018-11-08 | A vulnerability in the local status page functionality of the Cisco Meraki MR, MS, MX, Z1, and Z3 product lines could allow an authenticated, remote attacker t… |
CVE-2016-2121 | Medium | 4.0 | 2018-10-31 | A permissions flaw was found in redis, which sets weak permissions on certain files and directories that could potentially contain sensitive information. A loc… |
CVE-2015-7266 | High | 7.5 | 2018-10-30 | The Interactive Advertising Bureau (IAB) OpenRTB 2.3 protocol implementation might allow remote attackers to conceal the status of ad transactions and potentia… |
CVE-2016-10730 | High | 7.8 | 2018-10-24 | An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. Amstar is an Amanda Application API scri… |
CVE-2018-0417 | High | 7.8 | 2018-10-17 | A vulnerability in TACACS authentication with Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, local attacker to perform certain oper… |
CVE-2018-13802 | High | 7.2 | 2018-10-10 | A vulnerability has been identified in ROX II (All versions < V2.12.1). An authenticated attacker with a high-privileged user account access via SSH could circ… |
CVE-2018-13801 | High | 8.8 | 2018-10-10 | A vulnerability has been identified in ROX II (All versions < V2.12.1). An attacker with network access to port 22/tcp and valid low-privileged user credential… |
CVE-2018-15370 | Medium | 6.8 | 2018-10-05 | A vulnerability in Cisco IOS ROM Monitor (ROMMON) Software for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, local attacker to bypass Cis… |
CVE-2018-0463 | High | 7.5 | 2018-10-05 | A vulnerability in the Cisco Network Plug and Play server component of Cisco Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacke… |
CVE-2018-0453 | High | 8.2 | 2018-10-05 | A vulnerability in the Sourcefire tunnel control channel protocol in Cisco Firepower System Software running on Cisco Firepower Threat Defense (FTD) sensors co… |
CVE-2018-0440 | High | 7.2 | 2018-10-05 | A vulnerability in the web interface of Cisco Data Center Network Manager could allow an authenticated application administrator to execute commands on the und… |
CVE-2018-0437 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Umbrella Enterprise Roaming Client (ERC) could allow an authenticated, local attacker to elevate privileges to Administrator. To e… |
CVE-2018-0432 | High | 8.8 | 2018-10-05 | A vulnerability in the error reporting feature of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to gain elevated privileges on an aff… |
CVE-2013-4451 | Critical | 9.8 | 2018-09-21 | gitolite commit fa06a34 through 3.5.3 might allow attackers to have unspecified impact via vectors involving world-writable permissions when creating (1) ~/.gi… |
CVE-2016-7070 | High | 8.0 | 2018-09-11 | A privilege escalation flaw was found in the Ansible Tower. When Tower before 3.0.3 deploys a PostgreSQL database, it incorrectly configures the trust level of… |
CVE-2016-8657 | High | 7.8 | 2018-07-31 | It was discovered that EAP packages in certain versions of Red Hat Enterprise Linux use incorrect permissions for /etc/sysconfig/jbossas configuration files. T… |
CVE-2018-0399 | Critical | 9.8 | 2018-07-18 | Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to retrieve a cleartext passwor… |
CVE-2018-0398 | Critical | 9.8 | 2018-07-18 | Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a server-side reques… |
CVE-2014-2079 | Medium | 5.5 | 2018-07-16 | X File Explorer (aka xfe) might allow local users to bypass intended access restrictions and gain access to arbitrary files by leveraging failure to use direct… |
CVE-2016-9489 | High | 8.8 | 2018-07-13 | In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e… |
CVE-2016-9486 | High | 7.8 | 2018-07-13 | On Windows endpoints, the SecureConnector agent must run under the local SYSTEM account or another administrator account in order to enable full functionality… |
CVE-2016-9485 | High | 7.8 | 2018-07-13 | On Windows endpoints, the SecureConnector agent must run under the local SYSTEM account or another administrator account in order to enable full functionality… |
CVE-2016-6564 | High | 8.1 | 2018-07-13 | Android devices with code from Ragentek contain a privileged binary that performs over-the-air (OTA) update checks. Additionally, there are multiple techniques… |
CVE-2018-0330 | High | 8.8 | 2018-06-20 | A vulnerability in the NX-API management application programming interface (API) in devices running, or based on, Cisco NX-OS Software could allow an authentic… |
CVE-2018-0294 | Medium | 6.7 | 2018-06-20 | A vulnerability in the write-erase feature of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to configure an unautho… |
CVE-2018-0293 | High | 8.8 | 2018-06-20 | A vulnerability in role-based access control (RBAC) for Cisco NX-OS Software could allow an authenticated, remote attacker to execute CLI commands that should… |
CVE-2016-9075 | Critical | 9.8 | 2018-06-11 | An issue where WebExtensions can use the mozAddonManager API to elevate privilege due to privileged pages being allowed in the permissions list. This allows a… |
CVE-2016-9073 | High | 7.5 | 2018-06-11 | WebExtensions can bypass security checks to load privileged URLs and potentially escape the WebExtension sandbox. This vulnerability affects Firefox < 50. |
CVE-2016-9070 | High | 8.0 | 2018-06-11 | A maliciously crafted page loaded to the sidebar through a bookmark can reference a privileged chrome window and engage in limited JavaScript operations violat… |
CVE-2016-5295 | High | 7.8 | 2018-06-11 | This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate privilege by having the Maintenance Service invoke the Mozilla Updater… |
CVE-2011-3172 | Medium | 5.4 | 2018-06-08 | A vulnerability in pam_modules of SUSE Linux Enterprise allows attackers to log into accounts that should have been disabled. Affected releases are SUSE Linux… |