CWE-264.

Aim Vulnerable to Sandbox Escape Leading to Remote Code Execution

• Code injection
• CWE-264

<=3.29.1 · no fixed version yet

Permission control vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

• Huawei HarmonyOS
• CWE-264

Cisco IOS XR Software Access Control List Bypass Vulnerability

• Cisco IOS XR Software
• CWE-264

Permissions, Privileges, and Access Controls in Video Analytics and Processing

• Qualcomm, Inc. Snapdragon
• Information disclosure
• CWE-264

Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

• Huawei HarmonyOS
• CWE-264

Permission control vulnerability in the Connectivity module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-264

Vulnerability of improper authentication in the ANS system service module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-264

Permissions, Privileges, and Access Controls issue in Automotive OS Platform

• Qualcomm, Inc. Snapdragon
• CWE-264

Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

• Huawei HarmonyOS
• CWE-264

Vulnerability of improper access control in the album module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

• Huawei HarmonyOS
• CWE-264

Permissions, Privileges, and Access Controls in Data

• Qualcomm, Inc. Snapdragon
• CWE-264

Cisco Nexus 3550-F Switches Access Control List Programming Vulnerability

• Cisco Nexus 3550 System Software
• CWE-264

Permission control vulnerability in the Gallery app Impact: Successful exploitation of this vulnerability may affect service confidentiality.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-264

Permission control vulnerability in the Wi-Fi module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

• Huawei HarmonyOS
• CWE-264

Cisco Adaptive Security Appliance (ASA) Software: A vulnerability in the Cisco FXOS CLI feature on specific hardware platforms for Cisco…

• Cisco Adaptive Security Appliance (ASA) Software
• Cisco Firepower Threat Defense Software
• CWE-264

Access permission verification vulnerability in the ringtone setting module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-264

Vulnerability of permission verification for APIs in the DownloadProviderMain module Impact: Successful exploitation of this vulnerability will affect availability.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-264

Permission verification vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect availability

• Huawei HarmonyOS
• Huawei EMUI
• CWE-264

Privilege escalation vulnerability in the account synchronisation module.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-264

Permissions, Privileges, and Access Control issues in TZ Secure OS

• Qualcomm, Inc. Snapdragon
• CWE-264

Function vulnerabilities in the Calendar module Impact: Successful exploitation of this vulnerability will affect availability.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-264

IBM Db2 on Cloud Pak for Data privilege escalation

• IBM Db2 on Cloud Pak for Data
• CWE-264

Cisco Firepower Management Center: A vulnerability in the Object Groups for Access Control Lists (ACLs) feature of Cisco…

• Cisco Firepower Management Center
• Cisco Firepower Threat Defense Software
• CWE-264

The WindowManager module has a vulnerability in permission control.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-264

Privilege escalation vulnerability in the account module Impact: Successful exploitation of this vulnerability will affect availability.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-264

Dell Display and Peripheral Manager: Dell Display and Peripheral Manager for macOS prior to 1.3 contains an improper access…

• Dell Display and Peripheral Manager
• CWE-264

Dell Pair Installer version prior to 1.2.1 contains an elevation of privilege vulnerability.

• Dell Pair
• CWE-264

Vulnerability of permission verification for APIs in the DownloadProviderMain module.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-264

Cisco IOS XR Software: A vulnerability in the classic access control list (ACL) compression feature of Cisco IOS…

• Cisco IOS XR Software
• CWE-264

Permission control vulnerability in the XLayout component.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-264

Vulnerability of API privilege escalation in the wifienhance module.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-264

Vulnerability of system file information leakage in the USB Service module.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-264

Vulnerability of permission control in the window management module.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-264

Vulnerability of incomplete permission verification in the input method module.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-264

Missing authentication in Huawei HarmonyOS and others

• Huawei HarmonyOS
• Huawei EMUI
• Authentication bypass
• CWE-264

SourceCodester Best Fee Management System Add User admin_class.php save_user access control

• SourceCodester Best Fee Management System
• CWE-264

Inappropriate authorization vulnerability in the system apps.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-264

Permissions, Privileges, and Access Controls in Display

• Qualcomm, Inc. Snapdragon
• CWE-264

Fortinet FortiNAC: An improper permissions, privileges, and access controls vulnerability [CWE-264] in…

• Fortinet FortiNAC
• CWE-264

Shop Beat Services Vulnerable To Insecure Permissions

• Shop Beat studio
• CWE-264

Remote documents loaded without prompt via IFrame

• The Document Foundation LibreOffice
• CWE-264

Dell Command | Monitor versions prior to 10.9 contain an arbitrary folder delete vulnerability during uninstallation.

• Dell Command Monitor (DCM)
• CWE-264

WordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Auth. WordPress Options Change vulnerability

• Biplob Adhikari Image Hover Effects Ultimate (WordPress plugin)
• Privilege escalation
• CWE-264

WordPress Plugin for Google Reviews plugin <= 2.2.2 - Auth. Broken Access Control vulnerability

• RichPlugins Plugin for Google Reviews (WordPress plugin)
• CWE-264

WordPress LoginPress plugin <= 1.6.2 - Broken Access Control vulnerability

• WPBrigade LoginPress | Custom Login Page Customizer (WordPress plugin)
• CWE-264

WordPress miniOrange's Google Authenticator plugin <= 5.6.1 - Broken Access Control vulnerability

• miniOrange's Google Authenticator (WordPress plugin)
• CWE-264

WordPress Permalink Manager Lite plugin <= 2.2.20 - Broken Access Control vulnerability

• Maciej Bis Permalink Manager Lite
• CWE-264

WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability

• OnTheGoSystems Ltd. WPML Multilingual CMS (WordPress plugin)
• CWE-264

WordPress Crowdsignal Dashboard plugin <= 3.0.9 - Privilege Escalation vulnerability

• Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more (WordPress plugin)
• CWE-264

WordPress Ezoic plugin <= 2.8.8 - Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability

• Ezoic Inc. Ezoic (WordPress plugin)
• Cross-site scripting (XSS)
• CWE-264

WordPress WooSwipe WooCommerce Gallery plugin <= 2.0.1 - Auth. Broken Access Control vulnerability

• Thrive Website Design WooSwipe WooCommerce Gallery (WordPress plugin)
• CWE-264

WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability

• OnTheGoSystems Ltd. WPML Multilingual CMS (WordPress plugin)
• CWE-264

WordPress Traffic Manager plugin <= 1.4.5 - Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS)

• SedLex Traffic Manager (WordPress plugin)
• Cross-site scripting (XSS)
• CWE-264

WordPress Zoho CRM Lead Magnet plugin <= 1.7.5.8 - Auth. Arbitrary Options Update vulnerability

• Zoho CRM Lead Magnet (WordPress plugin)
• CWE-264

WordPress Accordions plugin <= 2.0.3 - Auth. WordPress Options Change vulnerability

• Biplob Adhikari Accordions – Multiple Accordions or FAQs Builder (WordPress plugin)
• CWE-264

Privilege escalation in Google Drive for Desktop on MacOS

• Google LLC Drive for Desktop MacOS
• CWE-264

Hitachi Content Platform Information Disclosure Vulnerability

• Hitachi Vantara Hitachi Content Platform
• CWE-264

WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Authenticated Broken Access Control vulnerability

• CusRev Customer Reviews for WooCommerce (WordPress plugin)
• CWE-264

WordPress Awesome Filterable Portfolio plugin <= 1.9.7 - Unauthenticated Plugin Settings Change vulnerability

• BriniA Awesome Filterable Portfolio (WordPress plugin)
• CWE-264

WordPress Photospace Gallery plugin <= 2.3.5 - Broken Access Control vulnerability

• Dean Oakley Photospace Gallery (WordPress plugin)
• CWE-264