CWE-648 Incorrect Use of Privileged APIs
baseThe product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (78)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-76460US | critical10.0OT kritisch | KEV | ||
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.
This vulnerability is due to insuffic… | ||||
| CVE-2026-20122US | medium5.4OT kritisch | KEV | ||
A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vul… | ||||
| CVE-2019-14813US | critical9.8OT erhöht | — | ||
A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAF… | ||||
| CVE-2019-14811US | high7.8OT erhöht | Exploit | ||
A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-… | ||||
| CVE-2026-9560US | high7.8 | Exploit | ||
Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC ch… | ||||
| CVE-2019-1010178US | critical9.8 | — | ||
Fred MODX Revolution < 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/components/fred/web/elfinder/c… | ||||
| CVE-2022-2023US | critical9.8 | — | ||
Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4. | ||||
| CVE-2010-3301US | high7.2 | Exploit | ||
The IA32 system call emulation functionality in arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.36-rc4-git2 on the x86_64 platform does not zero extend the %eax register a… | ||||
| CVE-2026-41386US | critical9.8 | — | ||
OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing. Attackers can… | ||||
| CVE-2019-14869US | high8.8 | — | ||
A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass… | ||||
| CVE-2026-35645US | high8.8OT erhöht | — | ||
OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function that uses a synthetic operator.admin runtime… | ||||
| CVE-2023-28062US | high8.8 | — | ||
Dell PPDM versions 19.12, 19.11 and 19.10, contain an improper access control vulnerability. A remote authenticated malicious user with low privileges could potentially exploit th… | ||||
| CVE-2022-20956US | high8.8 | — | ||
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to bypass authorization and access syste… | ||||
| CVE-2020-14306US | high8.8OT erhöht | — | ||
An incorrect access control flaw was found in the operator, openshift-service-mesh/istio-rhel8-operator all versions through 1.1.3. This flaw allows an attacker with a basic level… | ||||
| CVE-2022-23720US | high8.2OT erhöht | — | ||
PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly… | ||||
| CVE-2022-4796US | high8.1 | — | ||
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1. | ||||
| CVE-2022-4687US | high8.1 | — | ||
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0. | ||||
| CVE-2022-24821US | high8.1 | — | ||
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory o… | ||||
| CVE-2019-14812US | high7.8 | — | ||
A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-d… | ||||
| CVE-2019-10216US | high7.8 | — | ||
In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abu… | ||||
03
Angriffsmuster (2)
CAPEC-Angriffsmuster, die dies ausnutzen.
04
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan