# CWE-264.

Every Advisory and CVE whose sources give the weakness CWE-264, newest first.

## Records, newest first (an older page)

- [Aim Vulnerable to Sandbox Escape Leading to Remote Code Execution](https://agentprime.io/advisories/GHSA-gp5h-f9c5-8355.md)
  `GHSA-gp5h-f9c5-8355`, `CVE-2025-5321`, `PYSEC-2026-1088` · PyPI `aim`: affected `<=3.29.1`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 29 May 2025 · Tags: Code injection, CWE-264, CWE-265
- [Permission control vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality.](https://agentprime.io/advisories/CVE-2025-46587.md)
  `CVE-2025-46587` · CVE record: Huawei HarmonyOS · CVSS 6.2 Medium · Not analysed yet · Published 6 May 2025 · Tags: CWE-264
- [Cisco IOS XR Software Access Control List Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-20145.md)
  `CVE-2025-20145` · CVE record: Cisco Cisco IOS XR Software · CVSS 5.8 Medium · Not analysed yet · Published 12 Mar 2025 · Tags: CWE-264
- [Permissions, Privileges, and Access Controls in Video Analytics and Processing](https://agentprime.io/advisories/CVE-2024-53011.md)
  `CVE-2024-53011` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.9 High · Not analysed yet · Published 3 Mar 2025 · Tags: Information disclosure, CWE-264
- [Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.](https://agentprime.io/advisories/CVE-2024-56444.md)
  `CVE-2024-56444` · CVE record: Huawei HarmonyOS · CVSS 7.5 High · Not analysed yet · Published 8 Jan 2025 · Tags: CWE-264
- [Permission control vulnerability in the Connectivity module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.](https://agentprime.io/advisories/CVE-2024-56440.md)
  `CVE-2024-56440` · CVE record: Huawei HarmonyOS and 1 more · CVSS 6.2 Medium · Not analysed yet · Published 8 Jan 2025 · Tags: CWE-264
- [Vulnerability of improper authentication in the ANS system service module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.](https://agentprime.io/advisories/CVE-2023-52955.md)
  `CVE-2023-52955` · CVE record: Huawei HarmonyOS and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 8 Jan 2025 · Tags: CWE-264
- [Permissions, Privileges, and Access Controls issue in Automotive OS Platform](https://agentprime.io/advisories/CVE-2024-43064.md)
  `CVE-2024-43064` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.5 High · Not analysed yet · Published 6 Jan 2025 · Tags: CWE-264
- [Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.](https://agentprime.io/advisories/CVE-2024-54104.md)
  `CVE-2024-54104` · CVE record: Huawei HarmonyOS · CVSS 6.2 Medium · Not analysed yet · Published 12 Dec 2024 · Tags: CWE-264
- [Vulnerability of improper access control in the album module Impact: Successful exploitation of this vulnerability may affect service confidentiality.](https://agentprime.io/advisories/CVE-2024-54103.md)
  `CVE-2024-54103` · CVE record: Huawei HarmonyOS · CVSS 6.1 Medium · Not analysed yet · Published 12 Dec 2024 · Tags: CWE-264
- [Permissions, Privileges, and Access Controls in Data](https://agentprime.io/advisories/CVE-2017-9711.md)
  `CVE-2017-9711` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 6.7 Medium · Not analysed yet · Published 22 Nov 2024 · Tags: CWE-264
- [Cisco Nexus 3550-F Switches Access Control List Programming Vulnerability](https://agentprime.io/advisories/CVE-2024-20371.md)
  `CVE-2024-20371` · CVE record: Cisco Cisco Nexus 3550 System Software · CVSS 5.3 Medium · Not analysed yet · Published 6 Nov 2024 · Tags: CWE-264
- [Permission control vulnerability in the Gallery app Impact: Successful exploitation of this vulnerability may affect service confidentiality.](https://agentprime.io/advisories/CVE-2024-51527.md)
  `CVE-2024-51527` · CVE record: Huawei HarmonyOS and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 5 Nov 2024 · Tags: CWE-264
- [Permission control vulnerability in the Wi-Fi module Impact: Successful exploitation of this vulnerability may affect service confidentiality.](https://agentprime.io/advisories/CVE-2024-51524.md)
  `CVE-2024-51524` · CVE record: Huawei HarmonyOS · CVSS 4.0 Medium · Not analysed yet · Published 5 Nov 2024 · Tags: CWE-264
- [Cisco Adaptive Security Appliance (ASA) Software: A vulnerability in the Cisco FXOS CLI feature on specific hardware platforms for Cisco…](https://agentprime.io/advisories/CVE-2024-20370.md)
  `CVE-2024-20370` · CVE record: Cisco Cisco Adaptive Security Appliance (ASA) Software and 1 more · CVSS 6.0 Medium · Not analysed yet · Published 23 Oct 2024 · Tags: CWE-264
- [Access permission verification vulnerability in the ringtone setting module Impact: Successful exploitation of this vulnerability may affect service confidentiality.](https://agentprime.io/advisories/CVE-2024-45449.md)
  `CVE-2024-45449` · CVE record: Huawei HarmonyOS and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 4 Sept 2024 · Tags: CWE-264
- [Vulnerability of permission verification for APIs in the DownloadProviderMain module Impact: Successful exploitation of this vulnerability will affect availability.](https://agentprime.io/advisories/CVE-2024-45442.md)
  `CVE-2024-45442` · CVE record: Huawei HarmonyOS and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 4 Sept 2024 · Tags: CWE-264
- [Permission verification vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect availability](https://agentprime.io/advisories/CVE-2023-7265.md)
  `CVE-2023-7265` · CVE record: Huawei HarmonyOS and 1 more · CVSS 4.0 Medium · Not analysed yet · Published 8 Aug 2024 · Tags: CWE-264
- [Privilege escalation vulnerability in the account synchronisation module.](https://agentprime.io/advisories/CVE-2024-39670.md)
  `CVE-2024-39670` · CVE record: Huawei HarmonyOS and 1 more · CVSS 6.2 Medium · Not analysed yet · Published 25 Jul 2024 · Tags: CWE-264
- [Permissions, Privileges, and Access Control issues in TZ Secure OS](https://agentprime.io/advisories/CVE-2024-21469.md)
  `CVE-2024-21469` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.3 High · Not analysed yet · Published 1 Jul 2024 · Tags: CWE-264
- [Function vulnerabilities in the Calendar module Impact: Successful exploitation of this vulnerability will affect availability.](https://agentprime.io/advisories/CVE-2024-5465.md)
  `CVE-2024-5465` · CVE record: Huawei HarmonyOS and 1 more · CVSS 5.9 Medium · Not analysed yet · Published 14 Jun 2024 · Tags: CWE-264
- [IBM Db2 on Cloud Pak for Data privilege escalation](https://agentprime.io/advisories/CVE-2023-42005.md)
  `CVE-2023-42005` · CVE record: IBM Db2 on Cloud Pak for Data · CVSS 7.4 High · Not analysed yet · Published 29 May 2024 · Tags: CWE-264
- [Cisco Firepower Management Center: A vulnerability in the Object Groups for Access Control Lists (ACLs) feature of Cisco…](https://agentprime.io/advisories/CVE-2024-20361.md)
  `CVE-2024-20361` · CVE record: Cisco Cisco Firepower Management Center and 1 more · CVSS 5.8 Medium · Not analysed yet · Published 22 May 2024 · Tags: CWE-264
- [The WindowManager module has a vulnerability in permission control.](https://agentprime.io/advisories/CVE-2023-52721.md)
  `CVE-2023-52721` · CVE record: Huawei HarmonyOS and 1 more · CVSS 6.2 Medium · Not analysed yet · Published 11 May 2024 · Tags: CWE-264
- [Privilege escalation vulnerability in the account module Impact: Successful exploitation of this vulnerability will affect availability.](https://agentprime.io/advisories/CVE-2024-32996.md)
  `CVE-2024-32996` · CVE record: Huawei HarmonyOS and 1 more · CVSS 6.2 Medium · Not analysed yet · Published 11 May 2024 · Tags: CWE-264
- [Dell Display and Peripheral Manager: Dell Display and Peripheral Manager for macOS prior to 1.3 contains an improper access…](https://agentprime.io/advisories/CVE-2024-22452.md)
  `CVE-2024-22452` · CVE record: Dell Dell Display and Peripheral Manager · CVSS 7.3 High · Not analysed yet · Published 4 Mar 2024 · Tags: CWE-264
- [Dell Pair Installer version prior to 1.2.1 contains an elevation of privilege vulnerability.](https://agentprime.io/advisories/CVE-2023-44281.md)
  `CVE-2023-44281` · CVE record: Dell Dell Pair · CVSS 6.6 Medium · Not analysed yet · Published 24 Jan 2024 · Tags: CWE-264
- [Vulnerability of permission verification for APIs in the DownloadProviderMain module.](https://agentprime.io/advisories/CVE-2023-52106.md)
  `CVE-2023-52106` · CVE record: Huawei HarmonyOS and 1 more · CVSS 4.4 Medium · Not analysed yet · Published 16 Jan 2024 · Tags: CWE-264
- [Cisco IOS XR Software: A vulnerability in the classic access control list (ACL) compression feature of Cisco IOS…](https://agentprime.io/advisories/CVE-2023-20190.md)
  `CVE-2023-20190` · CVE record: Cisco Cisco IOS XR Software · CVSS 5.8 Medium · Not analysed yet · Published 13 Sept 2023 · Tags: CWE-264
- [Permission control vulnerability in the XLayout component.](https://agentprime.io/advisories/CVE-2023-39406.md)
  `CVE-2023-39406` · CVE record: Huawei HarmonyOS and 1 more · No CVSS score · Not analysed yet · Published 13 Aug 2023 · Tags: CWE-264
- [Vulnerability of API privilege escalation in the wifienhance module.](https://agentprime.io/advisories/CVE-2023-39394.md)
  `CVE-2023-39394` · CVE record: Huawei HarmonyOS and 1 more · No CVSS score · Not analysed yet · Published 13 Aug 2023 · Tags: CWE-264
- [Vulnerability of system file information leakage in the USB Service module.](https://agentprime.io/advisories/CVE-2023-39391.md)
  `CVE-2023-39391` · CVE record: Huawei HarmonyOS and 1 more · No CVSS score · Not analysed yet · Published 13 Aug 2023 · Tags: CWE-264
- [Vulnerability of permission control in the window management module.](https://agentprime.io/advisories/CVE-2023-39387.md)
  `CVE-2023-39387` · CVE record: Huawei HarmonyOS and 1 more · No CVSS score · Not analysed yet · Published 13 Aug 2023 · Tags: CWE-264
- [Vulnerability of incomplete permission verification in the input method module.](https://agentprime.io/advisories/CVE-2023-39384.md)
  `CVE-2023-39384` · CVE record: Huawei HarmonyOS and 1 more · No CVSS score · Not analysed yet · Published 13 Aug 2023 · Tags: CWE-264
- [Missing authentication in Huawei HarmonyOS and others](https://agentprime.io/advisories/CVE-2023-39380.md)
  `CVE-2023-39380` · CVE record: Huawei HarmonyOS and 1 more · No CVSS score · Not analysed yet · Published 13 Aug 2023 · Tags: Authentication bypass, CWE-264
- [SourceCodester Best Fee Management System Add User admin_class.php save_user access control](https://agentprime.io/advisories/CVE-2023-3599.md)
  `CVE-2023-3599` · CVE record: SourceCodester Best Fee Management System · CVSS 6.3 Medium · Not analysed yet · Published 10 Jul 2023 · Tags: CWE-264
- [Inappropriate authorization vulnerability in the system apps.](https://agentprime.io/advisories/CVE-2022-48508.md)
  `CVE-2022-48508` · CVE record: Huawei HarmonyOS and 1 more · No CVSS score · Not analysed yet · Published 6 Jul 2023 · Tags: CWE-264
- [Permissions, Privileges, and Access Controls in Display](https://agentprime.io/advisories/CVE-2023-21641.md)
  `CVE-2023-21641` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 6.6 Medium · Not analysed yet · Published 4 Jul 2023 · Tags: CWE-264
- [Fortinet FortiNAC: An improper permissions, privileges, and access controls vulnerability \[CWE-264\] in…](https://agentprime.io/advisories/CVE-2023-22633.md)
  `CVE-2023-22633` · CVE record: Fortinet FortiNAC · CVSS 7.2 High · Not analysed yet · Published 13 Jun 2023 · Tags: CWE-264
- [Shop Beat Services Vulnerable To Insecure Permissions](https://agentprime.io/advisories/CVE-2022-36246.md)
  `CVE-2022-36246` · CVE record: Shop Beat studio · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 May 2023 · Tags: CWE-264
- [Remote documents loaded without prompt via IFrame](https://agentprime.io/advisories/CVE-2023-2255.md)
  `CVE-2023-2255` · CVE record: The Document Foundation LibreOffice · No CVSS score · Not analysed yet · Published 25 May 2023 · Tags: CWE-264
- [Dell Command | Monitor versions prior to 10.9 contain an arbitrary folder delete vulnerability during uninstallation.](https://agentprime.io/advisories/CVE-2023-24573.md)
  `CVE-2023-24573` · CVE record: Dell Dell Command Monitor (DCM) · CVSS 4.7 Medium · Not analysed yet · Published 10 Feb 2023 · Tags: CWE-264
- [WordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Auth. WordPress Options Change vulnerability](https://agentprime.io/advisories/CVE-2022-42459.md)
  `CVE-2022-42459` · CVE record: Biplob Adhikari Image Hover Effects Ultimate (WordPress plugin) · CVSS 7.2 High · Not analysed yet · Published 18 Nov 2022 · Tags: Privilege escalation, CWE-264
- [WordPress Plugin for Google Reviews plugin <= 2.2.2 - Auth. Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2022-45369.md)
  `CVE-2022-45369` · CVE record: RichPlugins Plugin for Google Reviews (WordPress plugin) · CVSS 4.3 Medium · Not analysed yet · Published 18 Nov 2022 · Tags: CWE-264
- [WordPress LoginPress plugin <= 1.6.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2022-41839.md)
  `CVE-2022-41839` · CVE record: WPBrigade LoginPress | Custom Login Page Customizer (WordPress plugin) · CVSS 5.3 Medium · Not analysed yet · Published 18 Nov 2022 · Tags: CWE-264
- [WordPress miniOrange's Google Authenticator plugin <= 5.6.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2022-42461.md)
  `CVE-2022-42461` · CVE record: miniOrange miniOrange's Google Authenticator (WordPress plugin) · CVSS 5.4 Medium · Not analysed yet · Published 18 Nov 2022 · Tags: CWE-264
- [WordPress Permalink Manager Lite plugin <= 2.2.20 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2022-41781.md)
  `CVE-2022-41781` · CVE record: Maciej Bis Permalink Manager Lite · CVSS 6.5 Medium · Not analysed yet · Published 18 Nov 2022 · Tags: CWE-264
- [WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2022-38974.md)
  `CVE-2022-38974` · CVE record: OnTheGoSystems Ltd. WPML Multilingual CMS (WordPress plugin) · CVSS 4.3 Medium · Not analysed yet · Published 18 Nov 2022 · Tags: CWE-264
- [WordPress Crowdsignal Dashboard plugin <= 3.0.9 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2022-45069.md)
  `CVE-2022-45069` · CVE record: Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more (WordPress plugin) · CVSS 6.3 Medium · Not analysed yet · Published 17 Nov 2022 · Tags: CWE-264
- [WordPress Ezoic plugin <= 2.8.8 - Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability](https://agentprime.io/advisories/CVE-2022-41132.md)
  `CVE-2022-41132` · CVE record: Ezoic Inc. Ezoic (WordPress plugin) · CVSS 6.1 Medium · Not analysed yet · Published 17 Nov 2022 · Tags: Cross-site scripting (XSS), CWE-264
- [WordPress WooSwipe WooCommerce Gallery plugin <= 2.0.1 - Auth. Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2022-45066.md)
  `CVE-2022-45066` · CVE record: Thrive Website Design WooSwipe WooCommerce Gallery (WordPress plugin) · CVSS 5.4 Medium · Not analysed yet · Published 17 Nov 2022 · Tags: CWE-264
- [WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2022-38461.md)
  `CVE-2022-38461` · CVE record: OnTheGoSystems Ltd. WPML Multilingual CMS (WordPress plugin) · CVSS 5.4 Medium · Not analysed yet · Published 17 Nov 2022 · Tags: CWE-264
- [WordPress Traffic Manager plugin <= 1.4.5 - Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS)](https://agentprime.io/advisories/CVE-2022-42460.md)
  `CVE-2022-42460` · CVE record: SedLex Traffic Manager (WordPress plugin) · CVSS 6.5 Medium · Not analysed yet · Published 10 Nov 2022 · Tags: Cross-site scripting (XSS), CWE-264
- [WordPress Zoho CRM Lead Magnet plugin <= 1.7.5.8 - Auth. Arbitrary Options Update vulnerability](https://agentprime.io/advisories/CVE-2022-41978.md)
  `CVE-2022-41978` · CVE record: Zoho CRM Zoho CRM Lead Magnet (WordPress plugin) · CVSS 8.8 High · Not analysed yet · Published 9 Nov 2022 · Tags: CWE-264
- [WordPress Accordions plugin <= 2.0.3 - Auth. WordPress Options Change vulnerability](https://agentprime.io/advisories/CVE-2022-38104.md)
  `CVE-2022-38104` · CVE record: Biplob Adhikari Accordions – Multiple Accordions or FAQs Builder (WordPress plugin) · CVSS 7.2 High · Not analysed yet · Published 21 Oct 2022 · Tags: CWE-264
- [Privilege escalation in Google Drive for Desktop on MacOS](https://agentprime.io/advisories/CVE-2022-3421.md)
  `CVE-2022-3421` · CVE record: Google LLC Drive for Desktop MacOS · CVSS 5.6 Medium · Not analysed yet · Published 17 Oct 2022 · Tags: CWE-264
- [Hitachi Content Platform Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2021-28052.md)
  `CVE-2021-28052` · CVE record: Hitachi Vantara Hitachi Content Platform · CVSS 7.5 High · Not analysed yet · Published 26 Sept 2022 · Tags: CWE-264
- [WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Authenticated Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2022-38134.md)
  `CVE-2022-38134` · CVE record: CusRev Customer Reviews for WooCommerce (WordPress plugin) · CVSS 4.3 Medium · Not analysed yet · Published 23 Sept 2022 · Tags: CWE-264
- [WordPress Awesome Filterable Portfolio plugin <= 1.9.7 - Unauthenticated Plugin Settings Change vulnerability](https://agentprime.io/advisories/CVE-2022-35238.md)
  `CVE-2022-35238` · CVE record: BriniA Awesome Filterable Portfolio (WordPress plugin) · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2022 · Tags: CWE-264
- [WordPress Photospace Gallery plugin <= 2.3.5 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2022-38135.md)
  `CVE-2022-38135` · CVE record: Dean Oakley Photospace Gallery (WordPress plugin) · CVSS 5.4 Medium · Not analysed yet · Published 12 Sept 2022 · Tags: CWE-264

Newest: <https://agentprime.io/advisories/tag/cwe-264.md>
Older: <https://agentprime.io/advisories/tag/cwe-264.md?cursor=WyIyMDIyLTA5LTEyVDE5OjI0OjAyLjk5ODAwMFoiLCJDVkUtMjAyMi0zODEzNSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-264&cursor=WyIyMDI1LTA2LTA2VDA2OjM0OjE0LjE3MzAwMFoiLCJDVkUtMjAyNS00ODkwMyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-264/?cursor=WyIyMDI1LTA2LTA2VDA2OjM0OjE0LjE3MzAwMFoiLCJDVkUtMjAyNS00ODkwMyJd>. Everything for agents: <https://agentprime.io/llms.txt>.