CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- libreoffice, debian linux +1 moreRemote documents loaded without prompt via IFrame5.3 Medium
- dell command \| monitor, command monitor (dcm) +1 moreDell Command | Monitor versions prior to 10.9 contain an arbitrary folder delete vulnerability...4.7 Medium
- oxilab image hover effects ultimate, biplob adhikari image hover effects ultimate (wordpress plugin) +1 moreWordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Auth. WordPress Options Change vulnerability7.2 High
- richplugins plugin for google reviews, plugin for google reviews (wordpress plugin) +1 moreWordPress Plugin for Google Reviews plugin <= 2.2.2 - Auth. Broken Access Control vulnerability4.3 Medium
- wpbrigade loginpress, loginpress | custom login page customizer (wordpress plugin) +1 moreWordPress LoginPress plugin <= 1.6.2 - Broken Access Control vulnerability5.3 Medium
- miniorange google authenticator, miniorange's google authenticator (wordpress plugin) +1 moreWordPress miniOrange's Google Authenticator plugin <= 5.6.1 - Broken Access Control vulnerability5.4 Medium
- maciej bis permalink manager lite, permalink manager lite project manager lite +1 moreWordPress Permalink Manager Lite plugin <= 2.2.20 - Broken Access Control vulnerability6.5 Medium
- wpml, onthegosystems ltd. wpml multilingual cms (wordpress plugin) +1 moreWordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability4.3 Medium
- automattic crowdsignal dashboard, automattic, inc. crowdsignal dashboard – polls, surveys & more (wordpress plugin) +1 moreWordPress Crowdsignal Dashboard plugin <= 3.0.9 - Privilege Escalation vulnerability6.3 Medium
- ezoic, ezoic inc. (wordpress plugin) +1 moreWordPress Ezoic plugin <= 2.8.8 - Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability6.1 Medium
- thriveweb wooswipe woocommerce gallery, thrive website design wooswipe woocommerce gallery (wordpress plugin) +1 moreWordPress WooSwipe WooCommerce Gallery plugin <= 2.0.1 - Auth. Broken Access Control vulnerability5.4 Medium
- wpml, onthegosystems ltd. wpml multilingual cms (wordpress plugin) +1 moreWordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability5.4 Medium
- sedlex traffic manager, traffic manager (wordpress plugin) +1 moreWordPress Traffic Manager plugin <= 1.4.5 - Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS)6.5 Medium
- zohocorp zoho crm lead magnet, zoho crm lead magnet (wordpress plugin) +1 moreWordPress Zoho CRM Lead Magnet plugin <= 1.7.5.8 - Auth. Arbitrary Options Update vulnerability8.8 High
- oxilab accordions, biplob adhikari accordions – multiple accordions or faqs builder (wordpress plugin) +1 moreWordPress Accordions plugin <= 2.0.3 - Auth. WordPress Options Change vulnerability7.2 High
- google drive, google llc drive for desktop macos +1 morePrivilege escalation in Google Drive for Desktop on MacOS5.6 Medium
- hitach vantara, hitachi vantara content platform +1 moreHitachi Content Platform Information Disclosure Vulnerability7.5 High
- cusrev customer reviews for woocommerce, customer reviews for woocommerce (wordpress plugin) +1 moreWordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Authenticated Broken Access Control vulnerability4.3 Medium
- brinidesigner awesome filterable portfolio, brinia awesome filterable portfolio (wordpress plugin) +1 moreWordPress Awesome Filterable Portfolio plugin <= 1.9.7 - Unauthenticated Plugin Settings Change vulnerability6.5 Medium
- photospace gallery project gallery, dean oakley photospace gallery (wordpress plugin) +1 moreWordPress Photospace Gallery plugin <= 2.3.5 - Broken Access Control vulnerability5.4 Medium
- total-soft event calendar, totalsoft event calendar – calendar (wordpress plugin) +1 moreWordPress Event Calendar – Calendar plugin <= 1.4.6 - Unauthenticated Event Deletion vulnerability6.5 Medium
- wp-shop wp shop, wp-shop.ru wp shop (wordpress plugin) +1 moreWordPress WP Shop plugin <= 3.9.6 - Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities6.5 Medium
- wpvar wp shamsi, wpvar.com wp shamsi (wordpress plugin) +1 moreWordPress WP Shamsi plugin <= 4.1.1 - Authenticated Plugin Setting change vulnerability4.3 Medium
- mypopups pop-up, pop-ups pop-up (wordpress plugin) +1 moreWordPress Pop-up plugin <= 1.1.5 - Privilege Escalation vulnerability5.4 Medium
- accommodation-system project accommodation-system, php crafts accommodation system (wordpress plugin) +1 moreWordPress Accommodation System plugin <= 1.0.1 - Missing Access Control vulnerability7.6 High
- about rentals. inc. rentals (wordpress plugin), about-rentals project about-rentals +1 moreWordPress About Rentals plugin <= 1.5 - Missing Access Control vulnerability7.3 High
- about-me project about-me, alessio caiazza about me (wordpress plugin) +1 moreWordPress About Me plugin <= 1.0.12 - Broken Access Control vulnerability7.6 High
- fastlinemedia beaver builder, the beaver builder team beaver builder – wordpress page builder (wordpress plugin) +1 moreWordPress Beaver Builder plugin <= 2.5.4.3 - Broken Access Control vulnerability5.4 Medium
- yookassa yukassa for woocommerce, yoomoney юkassa для woocommerce (wordpress plugin) +1 moreWordPress ЮKassa для WooCommerce plugin <= 2.3.0 - Authenticated Arbitrary Settings Update vulnerability8.8 High
- 59sec the leads management system: 59sec lite (wordpress plugin), the leads management system\ +1 moreWordPress THE Leads Management System: 59sec LITE plugin <= 3.4.1 - Unauthenticated plugin settings change vulnerability6.5 Medium
- miniorange wp oauth server, wp oauth server (wordpress plugin) +1 moreWordPress WP OAuth Server plugin <= 3.0.4 - Authentication Bypass vulnerability9.8 Critical
- storeapps affiliate for woocommerce, affiliate for woocommerce (wordpress plugin) +1 moreWordPress Affiliate For WooCommerce premium plugin <= 4.7.0 - Multiple Improper Access Control vulnerabilities5.0 Medium
- oxilab shortcode addons, biplob018 shortcode addons (wordpress plugin) +1 moreWordPress Shortcode Addons plugin <= 3.1.2 - Authenticated WordPress Options Change vulnerability7.2 High
- biplob adhikari tabs (wordpress plugin), oxilab responsive tabs +1 moreWordPress Tabs plugin <= 3.6.0 - Authenticated WordPress Options Change vulnerability7.2 High
- oxilab flipbox, biplob adhikari flipbox (wordpress plugin) +1 moreWordPress Flipbox plugin <= 2.6.0 - Authenticated WordPress Options Change vulnerability7.2 High
- supsystic social share buttons, social share buttons by supsystic (wordpress plugin) +1 moreWordPress Social Share Buttons by Supsystic plugin <= 2.2.3 - Multiple Broken Access Control vulnerabilities6.3 Medium
- oxilab shortcode addons, biplob018 shortcode addons (wordpress plugin) +1 moreWordPress Shortcode Addons plugin <= 3.0.2 - Unauthenticated Arbitrary Option Update vulnerability9.8 Critical
- oxilab accordions, biplob adhikari accordions (wordpress plugin) +1 moreWordPress Accordions plugin <= 2.0.2 - Unauthenticated WordPress Options Change vulnerability9.8 Critical
- elastic endpoint securityA local privilege escalation (LPE) issue was discovered in the ransomware canaries features of...7.8 High
- apache hadoopApache Hadoop Privilege escalation vulnerability8.8 High
- platinumchina platinum mobilePlatinum Mobile MobileHandler.ashx access control5.5 Medium
- adam skaat countdown & clock (wordpress plugin), edmonsoft countdown builder +1 moreWordPress Countdown & Clock plugin <= 2.3.2 - Pro Features Lock Bypass vulnerability3.8 Low
- mattermost playbooksPlaybook members are allowed to escalate their membership privileges and perform actions restricted to playbook admins.3.7 Low
- cloudways breeze, breeze (wordpress plugin) +1 moreWordPress Breeze plugin <= 2.0.2 - Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability6.5 Medium
- rapid7 insight agentRapid7 Insight Agent Privilege Escalation4.0 Medium
- lg webosV8 javascript engine (heap vulnerability) can cause privilege escalation ,which can impact on...7.8 High
- elastic kibanaA flaw was discovered in Kibana in which users with Read access to the Uptime feature could...4.3 Medium
- elastic elasticsearchElasticsearch privilege escalation4.3 Medium
- apache dolphinschedulerDolphinScheduler mysql jdbc connector parameters deserialize remote code execution8.8 High
- google android, samsung mobile devices +1 moreSQL injection vulnerabilities in CMFA framework prior to SMR Oct-2021 Release 1 allow untrusted...5.9 Medium
- Show moreLoading…