# CWE-264.

Every Advisory and CVE whose sources give the weakness CWE-264, newest first.

## Records, newest first (an older page)

- [WordPress Event Calendar – Calendar plugin <= 1.4.6 - Unauthenticated Event Deletion vulnerability](https://agentprime.io/advisories/CVE-2022-38067.md)
  `CVE-2022-38067` · CVE record: Totalsoft Event Calendar – Calendar (WordPress plugin) · CVSS 6.5 Medium · Not analysed yet · Published 9 Sept 2022 · Tags: CWE-264
- [WordPress WP Shop plugin <= 3.9.6 - Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities](https://agentprime.io/advisories/CVE-2022-36793.md)
  `CVE-2022-36793` · CVE record: wp-shop.ru WP Shop (WordPress plugin) · CVSS 6.5 Medium · Not analysed yet · Published 9 Sept 2022 · Tags: CWE-264
- [WordPress WP Shamsi plugin <= 4.1.1 - Authenticated Plugin Setting change vulnerability](https://agentprime.io/advisories/CVE-2022-38058.md)
  `CVE-2022-38058` · CVE record: wpvar.com WP Shamsi (WordPress plugin) · CVSS 4.3 Medium · Not analysed yet · Published 9 Sept 2022 · Tags: CWE-264
- [WordPress Pop-up plugin <= 1.1.5 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2022-38070.md)
  `CVE-2022-38070` · CVE record: Pop-ups Pop-up (WordPress plugin) · CVSS 5.4 Medium · Not analysed yet · Published 9 Sept 2022 · Tags: CWE-264
- [WordPress About Rentals plugin <= 1.5 - Missing Access Control vulnerability](https://agentprime.io/advisories/CVE-2022-36427.md)
  `CVE-2022-36427` · CVE record: About Rentals. Inc. About Rentals (WordPress plugin) · CVSS 7.3 High · Not analysed yet · Published 6 Sept 2022 · Tags: CWE-264
- [WordPress Accommodation System plugin <= 1.0.1 - Missing Access Control vulnerability](https://agentprime.io/advisories/CVE-2022-37344.md)
  `CVE-2022-37344` · CVE record: PHP Crafts Accommodation System (WordPress plugin) · CVSS 7.6 High · Not analysed yet · Published 6 Sept 2022 · Tags: CWE-264
- [WordPress About Me plugin <= 1.0.12 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2022-36387.md)
  `CVE-2022-36387` · CVE record: Alessio Caiazza About Me (WordPress plugin) · CVSS 7.6 High · Not analysed yet · Published 6 Sept 2022 · Tags: CWE-264
- [WordPress Beaver Builder plugin <= 2.5.4.3 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2022-36425.md)
  `CVE-2022-36425` · CVE record: The Beaver Builder Team Beaver Builder – WordPress Page Builder (WordPress plugin) · CVSS 5.4 Medium · Not analysed yet · Published 6 Sept 2022 · Tags: CWE-264
- [WordPress ЮKassa для WooCommerce plugin <= 2.3.0 - Authenticated Arbitrary Settings Update vulnerability](https://agentprime.io/advisories/CVE-2022-34868.md)
  `CVE-2022-34868` · CVE record: YooMoney ЮKassa для WooCommerce (WordPress plugin) · CVSS 8.8 High · Not analysed yet · Published 23 Aug 2022 · Tags: CWE-264
- [WordPress THE Leads Management System: 59sec LITE plugin <= 3.4.1 - Unauthenticated plugin settings change vulnerability](https://agentprime.io/advisories/CVE-2022-35242.md)
  `CVE-2022-35242` · CVE record: 59sec THE Leads Management System: 59sec LITE (WordPress plugin) · CVSS 6.5 Medium · Not analysed yet · Published 23 Aug 2022 · Tags: CWE-264
- [WordPress WP OAuth Server plugin <= 3.0.4 - Authentication Bypass vulnerability](https://agentprime.io/advisories/CVE-2022-34149.md)
  `CVE-2022-34149` · CVE record: miniOrange WP OAuth Server (WordPress plugin) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2022 · Tags: CWE-264
- [WordPress Affiliate For WooCommerce premium plugin <= 4.7.0 - Multiple Improper Access Control vulnerabilities](https://agentprime.io/advisories/CVE-2022-25649.md)
  `CVE-2022-25649` · CVE record: StoreApps Affiliate For WooCommerce (WordPress plugin) · CVSS 5.0 Medium · Not analysed yet · Published 5 Aug 2022 · Tags: CWE-264
- [WordPress Shortcode Addons plugin <= 3.1.2 - Authenticated WordPress Options Change vulnerability](https://agentprime.io/advisories/CVE-2022-33970.md)
  `CVE-2022-33970` · CVE record: Biplob018 Shortcode Addons (WordPress plugin) · CVSS 7.2 High · Not analysed yet · Published 27 Jul 2022 · Tags: CWE-264
- [WordPress Tabs plugin <= 3.6.0 - Authenticated WordPress Options Change vulnerability](https://agentprime.io/advisories/CVE-2022-36375.md)
  `CVE-2022-36375` · CVE record: Biplob Adhikari Tabs (WordPress plugin) · CVSS 7.2 High · Not analysed yet · Published 25 Jul 2022 · Tags: CWE-264
- [WordPress Flipbox plugin <= 2.6.0 - Authenticated WordPress Options Change vulnerability](https://agentprime.io/advisories/CVE-2022-33969.md)
  `CVE-2022-33969` · CVE record: Biplob Adhikari Flipbox (WordPress plugin) · CVSS 7.2 High · Not analysed yet · Published 25 Jul 2022 · Tags: CWE-264
- [WordPress Social Share Buttons by Supsystic plugin <= 2.2.3 - Multiple Broken Access Control vulnerabilities](https://agentprime.io/advisories/CVE-2022-27235.md)
  `CVE-2022-27235` · CVE record: Supsystic Social Share Buttons by Supsystic (WordPress plugin) · CVSS 6.3 Medium · Not analysed yet · Published 22 Jul 2022 · Tags: CWE-264
- [WordPress Shortcode Addons plugin <= 3.0.2 - Unauthenticated Arbitrary Option Update vulnerability](https://agentprime.io/advisories/CVE-2022-34487.md)
  `CVE-2022-34487` · CVE record: biplob018 Shortcode Addons (WordPress plugin) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2022 · Tags: CWE-264
- [WordPress Accordions plugin <= 2.0.2 - Unauthenticated WordPress Options Change vulnerability](https://agentprime.io/advisories/CVE-2022-33198.md)
  `CVE-2022-33198` · CVE record: Biplob Adhikari Accordions (WordPress plugin) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2022 · Tags: CWE-264
- [Elastic Endpoint Security: A local privilege escalation (LPE) issue was discovered in the ransomware canaries…](https://agentprime.io/advisories/CVE-2022-23714.md)
  `CVE-2022-23714` · CVE record: Elastic Endpoint Security · No CVSS score · Not analysed yet · Published 6 Jul 2022 · Tags: CWE-264
- [User account escalation in Apache Hadoop](https://agentprime.io/advisories/GHSA-58jx-f5rf-qgqf.md)
  `GHSA-58jx-f5rf-qgqf`, `CVE-2021-33036` · Maven `org.apache.hadoop:hadoop-yarn-server-common`: affected `>=2.2.0, <2.10.2 || >=3.0.0, <3.2.3 || >=3.3.0, <3.3.2`, fixed in `2.10.2`, `3.2.3`, `3.3.2` · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2022 · Tags: Path traversal, Insecure deserialization, CWE-264
- [Platinum Mobile MobileHandler.ashx access control](https://agentprime.io/advisories/CVE-2020-36528.md)
  `CVE-2020-36528` · CVE record: unspecified Platinum Mobile · CVSS 5.5 Medium · Not analysed yet · Published 3 Jun 2022 · Tags: CWE-264
- [Moodle does not revoke role capabilities correctly](https://agentprime.io/advisories/GHSA-g9m2-c2x5-fr2v.md)
  `GHSA-g9m2-c2x5-fr2v`, `CVE-2019-14879`, `PKSA-tsyk-q1km-44v1` · Packagist `moodle/moodle`: affected `>=3.5.0, <3.5.9 || >=3.6.0, <3.6.7 || >=3.7.0, <3.7.3`, fixed in `3.5.9`, `3.6.7`, `3.7.3` · CVSS 4.2 Medium · Not analysed yet · Published 24 May 2022 · Tags: CWE-264, CWE-273
- [WordPress Countdown & Clock plugin <= 2.3.2 - Pro Features Lock Bypass vulnerability](https://agentprime.io/advisories/CVE-2022-29423.md)
  `CVE-2022-29423` · CVE record: Adam Skaat Countdown & Clock (WordPress plugin) · CVSS 3.8 Low · Not analysed yet · Published 6 May 2022 · Tags: CWE-264
- [Playbook members are allowed to escalate their membership privileges and perform actions restricted to playbook admins.](https://agentprime.io/advisories/CVE-2022-1548.md)
  `CVE-2022-1548` · CVE record: Mattermost Mattermost Playbooks · CVSS 3.7 Low · Not analysed yet · Published 3 May 2022 · Tags: CWE-264
- [WordPress Breeze plugin <= 2.0.2 - Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2022-29444.md)
  `CVE-2022-29444` · CVE record: Cloudways Breeze (WordPress plugin) · CVSS 6.5 Medium · Not analysed yet · Published 2 May 2022 · Tags: Cross-site scripting (XSS), CWE-264
- [Rapid7 Insight Agent Privilege Escalation](https://agentprime.io/advisories/CVE-2022-0237.md)
  `CVE-2022-0237` · CVE record: Rapid7 Insight Agent · CVSS 4.0 Medium · Not analysed yet · Published 17 Mar 2022 · Tags: CWE-264
- [V8 javascript engine (heap vulnerability) can cause privilege escalation ,which can impact on some webOS TV models.](https://agentprime.io/advisories/CVE-2022-23731.md)
  `CVE-2022-23731` · CVE record: LG webOS TV · No CVSS score · Not analysed yet · Published 11 Mar 2022 · Tags: CWE-264
- [Elasticsearch privilege escalation](https://agentprime.io/advisories/GHSA-pgq6-ccqj-hpqr.md)
  `GHSA-pgq6-ccqj-hpqr`, `BIT-elasticsearch-2022-23708`, `CVE-2022-23708` · Maven `org.elasticsearch:elasticsearch`: affected `>=7.16.0, <7.17.1`, fixed in `7.17.1` · CVSS 4.3 Medium · Not analysed yet · Published 4 Mar 2022 · Tags: Privilege escalation, CWE-264
- [Elastic kibana: A flaw was discovered in Kibana in which users with Read access to the Uptime feature…](https://agentprime.io/advisories/CVE-2022-23709.md)
  `CVE-2022-23709` · CVE record: Elastic kibana · No CVSS score · Not analysed yet · Published 3 Mar 2022 · Tags: CWE-264
- [SQL injection in Apache DolphinScheduler](https://agentprime.io/advisories/GHSA-93g4-3phc-g4xw.md)
  `GHSA-93g4-3phc-g4xw`, `CVE-2021-27644` · Maven `org.apache.dolphinscheduler:dolphinscheduler-server`: affected `<1.3.6`, fixed in `1.3.6` · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2021 · Tags: SQL injection, CWE-264
- [SQL injection vulnerabilities in CMFA framework prior to SMR Oct-2021 Release 1 allow untrusted application to overwrite some CMFA framework information.](https://agentprime.io/advisories/CVE-2021-25482.md)
  `CVE-2021-25482` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.9 Medium · Not analysed yet · Published 6 Oct 2021 · Tags: CWE-264
- [An improper access control vulnerability in BluetoothSettingsProvider prior to SMR Oct-2021 Release 1 allows untrusted application to overwrite some Bluetooth information.](https://agentprime.io/advisories/CVE-2021-25472.md)
  `CVE-2021-25472` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.0 Medium · Not analysed yet · Published 6 Oct 2021 · Tags: CWE-264
- [WordPress uListing plugin <= 2.0.5 - Unauthenticated Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2021-36879.md)
  `CVE-2021-36879` · CVE record: StylemixThemes uListing (WordPress plugin) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Sept 2021 · Tags: CWE-264
- [Arista Metamako Operating System: In Arista's MOS (Metamako Operating System) software which is supported on the 7130…](https://agentprime.io/advisories/CVE-2021-28497.md)
  `CVE-2021-28497` · CVE record: Arista Metamako Operating System · CVSS 4.4 Medium · Not analysed yet · Published 9 Sept 2021 · Tags: CWE-264
- [Local privilege escalation in GNU Guix via guix-daemon and '--keep-failed'](https://agentprime.io/advisories/CVE-2021-27851.md)
  `CVE-2021-27851` · CVE record: GNU Guix guix-daemon · No CVSS score · Not analysed yet · Published 26 Apr 2021 · Tags: CWE-264
- [FAQ articles are shown to users without permission](https://agentprime.io/advisories/CVE-2021-21438.md)
  `CVE-2021-21438` · CVE record: OTRS AG FAQ and 1 more · CVSS 3.5 Low · Not analysed yet · Published 22 Mar 2021 · Tags: CWE-264
- [Config Items are shown to users without permission](https://agentprime.io/advisories/CVE-2021-21437.md)
  `CVE-2021-21437` · CVE record: OTRS AG OTRSCIsInCustomerFrontend and 1 more · CVSS 3.5 Low · Not analysed yet · Published 22 Mar 2021 · Tags: CWE-264
- [Changing the password on the module webpage does not require the user to type in the current password first.](https://agentprime.io/advisories/CVE-2021-22661.md)
  `CVE-2021-22661` · CVE record: ICX35-HWC-A, ICX35-HWC-E · No CVSS score · Not analysed yet · Published 26 Feb 2021 · Tags: CWE-264
- [privilege escalation](https://agentprime.io/advisories/CVE-2019-18945.md)
  `CVE-2019-18945` · CVE record: Micro Focus Solutions Business Manager · CVSS 7.3 High · Not analysed yet · Published 26 Feb 2021 · Tags: CWE-264
- [Agent is able to link customer's Config Items without permission](https://agentprime.io/advisories/CVE-2021-21436.md)
  `CVE-2021-21436` · CVE record: OTRS AG OTRSCIsInCustomerFrontend · CVSS 3.5 Low · Not analysed yet · Published 8 Feb 2021 · Tags: CWE-264
- [Cisco AnyConnect Secure Mobility Client Arbitrary File Read Vulnerability](https://agentprime.io/advisories/CVE-2021-1258.md)
  `CVE-2021-1258` · CVE record: Cisco Cisco AnyConnect Secure Mobility Client · CVSS 5.5 Medium · Not analysed yet · Published 13 Jan 2021 · Tags: CWE-264
- [Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.](https://agentprime.io/advisories/GHSA-qhh5-9738-g9mx.md)
  `GHSA-qhh5-9738-g9mx`, `CVE-2020-13922`, `PYSEC-2021-876` · PyPI `apache-dolphinscheduler`: affected `*`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 11 Jan 2021 · Tags: CWE-264
- [Cisco IOS Software for Cisco Industrial Routers Virtual-LPWA Unauthorized Access Vulnerability](https://agentprime.io/advisories/CVE-2020-3426.md)
  `CVE-2020-3426` · CVE record: Cisco Cisco IOS 15.2(6)E4 · CVSS 7.5 High · Not analysed yet · Published 24 Sept 2020 · Tags: CWE-264
- [Cisco Unified Customer Voice Portal Insecure Direct Object Reference Vulnerability](https://agentprime.io/advisories/CVE-2019-16017.md)
  `CVE-2019-16017` · CVE record: Cisco Cisco Unified Customer Voice Portal (CVP) · CVSS 6.8 Medium · Not analysed yet · Published 23 Sept 2020 · Tags: CWE-264
- [Cisco IOS XR Software Authenticated User Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2020-3473.md)
  `CVE-2020-3473` · CVE record: Cisco Cisco IOS XR Software · CVSS 7.8 High · Not analysed yet · Published 4 Sept 2020 · Tags: CWE-264
- [Cisco IOS XR Authenticated User Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2020-3530.md)
  `CVE-2020-3530` · CVE record: Cisco Cisco IOS XR Software · CVSS 8.4 High · Not analysed yet · Published 4 Sept 2020 · Tags: CWE-264
- [Cisco Smart Software Manager On-Prem Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2020-3443.md)
  `CVE-2020-3443` · CVE record: Cisco Cisco Smart Software Manager On-Prem · CVSS 8.8 High · Not analysed yet · Published 26 Aug 2020 · Tags: CWE-264
- [Cisco Vision Dynamic Signage Director Role-Based Access Control Vulnerability](https://agentprime.io/advisories/CVE-2020-3485.md)
  `CVE-2020-3485` · CVE record: Cisco Cisco Vision Dynamic Signage Director · CVSS 6.3 Medium · Not analysed yet · Published 26 Aug 2020 · Tags: CWE-264
- [GOG Galaxy GalaxyClientService Privilege Escalation](https://agentprime.io/advisories/CVE-2020-7352.md)
  `CVE-2020-7352` · CVE record: GOG GOG GalaxyClientService · CVSS 8.4 High · Not analysed yet · Published 6 Aug 2020 · Tags: CWE-264
- [local snapd exploit through cloud-init](https://agentprime.io/advisories/CVE-2020-11933.md)
  `CVE-2020-11933` · CVE record: Canonical snapd and 1 more · CVSS 7.3 High · Not analysed yet · Published 29 Jul 2020 · Tags: CWE-264
- [Rockwell Automation FactoryTalk View SE](https://agentprime.io/advisories/CVE-2020-12028.md)
  `CVE-2020-12028` · CVE record: Rockwell Automation FactoryTalk View SE · CVSS 7.3 High · Critical (CVSS 7+ and EPSS) · EPSS 0.53 · Not analysed yet · Published 20 Jul 2020 · Tags: CWE-264
- [Cisco SD-WAN Solution Software Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2020-3379.md)
  `CVE-2020-3379` · CVE record: Cisco Cisco SD-WAN Solution · CVSS 5.3 Medium · Not analysed yet · Published 16 Jul 2020 · Tags: CWE-264
- [Cisco SD-WAN Solution Software Static Credentials Vulnerability](https://agentprime.io/advisories/CVE-2020-3180.md)
  `CVE-2020-3180` · CVE record: Cisco Cisco SD-WAN vManage · CVSS 8.4 High · Not analysed yet · Published 16 Jul 2020 · Tags: CWE-264
- [Cisco IOS XE Software Web UI Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2020-3229.md)
  `CVE-2020-3229` · CVE record: Cisco Cisco IOS XE Software 16.2.2 · CVSS 8.8 High · Not analysed yet · Published 3 Jun 2020 · Tags: CWE-264
- [Cisco IOx for IOS XE Software Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2020-3227.md)
  `CVE-2020-3227` · CVE record: Cisco Cisco IOS XE Software 16.3.1 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Jun 2020 · Tags: CWE-264
- [Cisco IOS XE Software Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2020-3215.md)
  `CVE-2020-3215` · CVE record: Cisco Cisco IOS XE Software 3.8.0S · CVSS 6.7 Medium · Not analysed yet · Published 3 Jun 2020 · Tags: CWE-264
- [Cisco IOS XE Software Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2020-3214.md)
  `CVE-2020-3214` · CVE record: Cisco Cisco IOS XE Software 16.11.1 · CVSS 6.7 Medium · Not analysed yet · Published 3 Jun 2020 · Tags: CWE-264
- [Cisco IOS XE Software Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2020-3213.md)
  `CVE-2020-3213` · CVE record: Cisco Cisco IOS XE Software 3.8.0S · CVSS 6.7 Medium · Not analysed yet · Published 3 Jun 2020 · Tags: CWE-264
- [Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers Image Verification Bypass Vulnerability](https://agentprime.io/advisories/CVE-2020-3208.md)
  `CVE-2020-3208` · CVE record: Cisco Cisco IOS 12.2(60)EZ16 · CVSS 6.7 Medium · Not analysed yet · Published 3 Jun 2020 · Tags: CWE-264
- [Privilege escalation via B&R Automation Studio upgrade service](https://agentprime.io/advisories/CVE-2019-19100.md)
  `CVE-2019-19100` · CVE record: B&R Automation Studio · CVSS 7.5 High · Not analysed yet · Published 29 Apr 2020 · Tags: CWE-264

Newest: <https://agentprime.io/advisories/tag/cwe-264.md>
Older: <https://agentprime.io/advisories/tag/cwe-264.md?cursor=WyIyMDIwLTA0LTI5VDAyOjA5OjIxLjAwMDAwMFoiLCJDVkUtMjAxOS0xOTEwMCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-264&cursor=WyIyMDIyLTA5LTEyVDE5OjI0OjAyLjk5ODAwMFoiLCJDVkUtMjAyMi0zODEzNSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-264/?cursor=WyIyMDIyLTA5LTEyVDE5OjI0OjAyLjk5ODAwMFoiLCJDVkUtMjAyMi0zODEzNSJd>. Everything for agents: <https://agentprime.io/llms.txt>.