CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- blackberry enterprise serviceThe BlackBerry Universal Device Service in BlackBerry Enterprise Service (BES) 10.0 through 10.1...7.9 High
- ovislink airlive wl2600camcgi-bin/operator/param in AirLive WL2600CAM and possibly other camera models allows remote...10.0 High
- tp-link tl-sc3130, tl-sc3130g, tl-sc3171 +2 more +4 morecgi-bin/firmwareupgrade in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and...7.8 High
- ibm infosphere optim data growth for oracle e-business suiteThe Optim E-Business Console in IBM Data Growth Solution for Oracle E-business Suite 6.0 through...4.3 Medium
- ibm infosphere optim data growth for oracle e-business suiteThe Optim E-Business Console in IBM Data Growth Solution for Oracle E-business Suite 6.0 through...5.2 Medium
- menalto gallerymodules/gallery/helpers/data_rest.php in Gallery 3 before 3.0.9 allows remote attackers to bypass...5.0 Medium
- xinetd, redhat enterprise linux +1 morexinetd does not enforce the user and group configuration directives for TCPMUX services, which...7.6 High
- xenXen 4.3.x writes hypervisor mappings to certain shadow pagetables when live migration is...5.4 Medium
- sebastien corbin make meeting scheduler moduleThe Make Meeting Scheduler module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to...6.4 Medium
- microsoft sharepoint server, office web apps +1 moreMicrosoft SharePoint Server 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to conduct...6.8 Medium
- microsoft windows 8, windows rt, windows server 2012 +2 moreThe App Container feature in the kernel-mode drivers in Microsoft Windows 8, Windows Server 2012,...3.5 Low
- adaptivecomputing torque resource managerpbs_mom in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x,...9.0 High
- gnu glibc, fedoraproject fedora +1 morept_chown in GNU C Library (aka glibc or libc6) before 2.18 does not properly check permissions...2.6 Low
- cisco nx-osDirectory traversal vulnerability in the CLI parser in Cisco NX-OS allows local users to create...6.2 Medium
- cisco nexus 7000, nx-os, nexus 7000 10-slot +2 more +4 moreThe management interface in Cisco NX-OS on Nexus 7000 devices allows remote authenticated users...4.0 Medium
- brickcom fb-100ap, md-100ap, ob-100ae +4 more +6 moreBrickcom FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040E, and possibly other camera...7.8 High
- axis media control activex controlThe AXIS Media Control (AMC) ActiveX control (AxisMediaControlEmb.dll) 6.2.10.11 for AXIS network...8.8 High
- lennart poettering rkit, redhat enterprise linux +1 moreRealtimeKit (aka rtkit) 0.5 does not properly use D-Bus for communication with a polkit authority...4.6 Medium
- spice-gtk project spice-gtk, redhat enterprise linux +1 morespice-gtk 0.14, and possibly other versions, invokes the polkit authority using the insecure...4.6 Medium
- redhat libvirt, canonical ubuntu linux, redhat enterprise linux +2 morelibvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows...4.6 Medium
- ubuntu developers language-selector, canonical ubuntu linux +1 morelanguage-selector 0.110.x before 0.110.1, 0.90.x before 0.90.1, and 0.79.x before 0.79.4 does not...4.6 Medium
- martin pitt jockey, canonical ubuntu linux +1 morebackend.py in Jockey before 0.9.7-0ubuntu7.11 does not properly use D-Bus for communication with...4.6 Medium
- canonical apt-xapian-index, ubuntu linux +1 moreapt-xapian-index before 0.45ubuntu2.1, 0.44ubuntu7.1, and 0.44ubuntu5.1 does not properly use D...4.6 Medium
- evan dandrea usb-creator, canonical ubuntu linux +1 moreusb-creator 0.2.47 before 0.2.47.1, 0.2.40 before 0.2.40ubuntu2, and 0.2.38 before 0.2.38.2 does...4.6 Medium
- michael vogt ubuntu-system-service, canonical ubuntu linux +1 moreubuntu-system-service 0.2.4 before 0.2.4.1. 0.2.3 before 0.2.3.1, and 0.2.2 before 0.2.2.1 does...4.6 Medium
- canonical ubuntu linux, marc deslauriers software-properties +1 moredbus/SoftwarePropertiesDBus.py in Software Properties 0.92.17 before 0.92.17.3, 0.92.9 before 0...4.6 Medium
- watchguard server centerMultiple untrusted search path vulnerabilities in (1) Watchguard Log Collector (wlcollector.exe)...7.2 High
- enea ose, emerson dl 8000 remote terminal unit, roc 800 remote terminal unit +1 more +3 moreThe kernel in ENEA OSE on the Emerson Process Management ROC800 RTU with software 3.50 and...10.0 High
- cisco unified computing systemThe high-availability service in the Fabric Interconnect component in Cisco Unified Computing...6.8 Medium
- ibm infosphere information serverIBM InfoSphere Information Server 8.0, 8.1, 8.5 through FP3, 8.7, and 9.1 allows remote attackers...5.8 Medium
- f5 big-ip access policy managerThe access policy logon page (logon.inc) in F5 BIG-IP APM 11.1.0 through 11.2.1 allows remote...4.3 Medium
- tp-link tl-sc3130, tl-sc3130g, tl-sc3171 +2 more +4 moreThe TP-Link IP Cameras TL-SC3171, TL-SC3130, TL-SC3130G, TL-SC3171G, and possibly other models...7.1 High
- arubanetworks clearpass, clearpass guest +1 moreThe Sponsorship Confirmation functionality in Aruba Networks ClearPass 5.x, 6.0.1, and 6.0.2, and...5.0 Medium
- ibm maximo asset managementIBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows...4.0 Medium
- ibm maximo asset managementIBM Maximo Asset Management 6.2 through 6.2.8, 7.1 through 7.1.1.12, and 7.5 before 7.5.0.5...6.5 Medium
- ibm maximo asset managementIBM Maximo Asset Management 7.1 through 7.1.1.12 and 7.5 before 7.5.0.5 allows remote...4.0 Medium
- ibm maximo asset managementIBM Maximo Asset Management 6.2 before 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.3 allows...6.8 Medium
- zabbixZabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging...3.5 Low
- metaclassy bywordThe Metaclassy Byword app 2.x before 2.1 for iOS does not require confirmation of Replace file...5.0 Medium
- apache strutsApache Struts2 Broken Access Control Vulnerability5.8 Medium
- redhat libvirtThe virSecurityManagerSetProcessLabel function in libvirt 0.10.2.7, 1.0.5.5, and 1.1.1, when the...6.9 Medium
- adcisolutions node view permissionsThe Node View Permissions module 7.x-1.x before 7.x-1.2 for Drupal does not properly implement...5.0 Medium
- apple iphone osPasscode Lock in Apple iOS before 7.0.2 does not properly manage the lock state, which allows...4.4 Medium
- apple iphone osPasscode Lock in Apple iOS before 7.0.2 on iPhone devices allows physically proximate attackers...3.3 Low
- cisco unified computing systemThe remote debug shell on the PALO adapter card in Cisco Unified Computing System (UCS) allows...6.5 Medium
- openvz vzkernelvzkernel before 042stab080.2 in the OpenVZ modification for the Linux kernel 2.6.32 does not...4.7 Medium
- werner baumann davfs2WEB-DAV Linux File System (davfs2) 1.4.6 and 1.4.7 allow local users to gain privileges via...7.2 High
- ibm rational clearcaseThe RemoteClient component in IBM Rational ClearCase 8.0.0.03 through 8.0.0.07, and 8.0.1, uses...6.9 Medium
- google android, motorola defy xt +1 moreA certain configuration of Android 2.3.7 on the Motorola Defy XT phone for Republic Wireless uses...6.9 Medium
- ibm data studio web console, db2 recovery expert, infosphere optim configuration manager +1 more +3 moreIBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere...1.9 Low
- Show moreLoading…