CWE-648: Incorrect Use of Privileged APIs
The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- usememos memos, usememos/memos +1 moreIncorrect Use of Privileged APIs in usememos/memos8.1 High
- cisco identity services engine, identity services engine software +1 moreA vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE)...7.1 High
- ping identity pingid windows login, pingidentity pingid integration for windows login +1 morePingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file7.5 High
- polonel polonel/trudesk, trudesk project trudesk +1 moreIncorrect Use of Privileged APIs in polonel/trudesk10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreIncorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx6.8 Medium
- naver whale browser, navercorp whale +1 moreThe Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension...7.1 High
- naver whale browser, navercorp whale +1 moreA Built-in extension in Whale browser before 3.12.129.46 allows attackers to compromise the...4.3 Medium
- mongodb ops managerPotential privilege escalation in Ops Manager API8.1 High
- centos, containers bubblewrap, debian linux +1 more +3 morePrivilege escalation in setuid mode via user namespaces in Bubblewrap7.2 High
- artifex ghostscript, fedoraproject fedora, opensuse leap +2 moreA flaw was found in all versions of ghostscript 9.x before 9.28, where the `.charkeys` procedure,...7.3 High
- artifex ghostscript, debian linux, fedoraproject fedora +2 more +4 moreA flaw was found in, ghostscript versions prior to 9.28, in the .pdfexectoken and other...7.3 High
- artifex ghostscript, debian linux, fedoraproject fedora +9 more +11 moreA flaw was found in ghostscript, versions 9.x before 9.28, in the setsystemparams procedure where...7.3 High
- artifex ghostscript, fedoraproject fedora +1 moreA flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure...7.3 High
- artifex ghostscript, debian linux, fedoraproject fedora +2 more +4 moreA flaw was found in, ghostscript versions prior to 9.28, in the .pdf_hook_DSC_Creator procedure...7.3 High
- artifex ghostscript, redhat 3scale api management, enterprise linux +6 more +8 moreIt was found that the .buildfont1 procedure did not properly secure its privileged calls,...7.3 High
- fred modx revolution, modx fred +1 moreFred MODX Revolution < 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact...9.8 Critical
- artifex ghostscript, canonical ubuntu linux, debian linux +3 more +5 moreIt was found that in ghostscript some privileged operators remained accessible from various...7.3 High
- artifex ghostscript, debian linux, fedoraproject fedora +9 more +11 moreIt was found that the forceput operator could be extracted from the DefineResource method in...7.3 High
- artifex ghostscript, debian linux, fedoraproject fedora +8 more +10 moreIt was found that the superexec operator was available in the internal dictionary in ghostscript...7.3 High