CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- saltstack saltSaltStack Privilege Escalation vulnerability10.0 High
- citrix xendesktopCitrix XenDesktop 7.0, when upgraded from XenDesktop 5.x, does not properly enforce policy rule...5.8 Medium
- saltstack saltMinion identity not validated in saltstack4.9 Medium
- openstack grizzly, havana +1 moreOpenStack Identity Keystone Privilege Escalation vulnerability3.3 Low
- openbravo erpThe XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read...3.5 Low
- ruby-lang ruby, opensuse +1 more(1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel...6.4 Medium
- redhat libvirtThe virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the...8.5 High
- cisco iosThe IKEv2 implementation in Cisco IOS, when AES-GCM or AES-GMAC is used, allows remote attackers...4.3 Medium
- mozilla firefoxPDF.js in Mozilla Firefox before 25.0 and Firefox ESR 24.x before 24.1 does not properly handle...8.3 High
- drupalThe File module in Drupal 7.x before 7.11, when using unspecified field access modules, allows...3.5 Low
- redhat jboss enterprise application platform, jboss enterprise portal platform +1 moreRed Hat JBoss Enterprise Application Platform (EAP) before 6.1.0 and JBoss Portal before 6.1.0...3.7 Low
- openstack glance, canonical ubuntu linux +1 moreOpenStack Image Registry and Delivery Service (Glance) Folsom, Grizzly before 2013.1.4, and...3.5 Low
- f5 nginxThe default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions...7.5 High
- canonical ubuntu linuxApport 2.12.5 and earlier uses weak permissions for core dump files created by setuid binaries,...4.9 Medium
- wellintech kingviewThe KCHARTXYLib.KChartXY ActiveX control in KChartXY.ocx before 65.30.30000.10002 in WellinTech...5.8 Medium
- ibm flex system managerIBM Flex System Manager (FSM) 1.3.0 allows remote attackers to bypass intended access...6.8 Medium
- cisco ios, catalyst 3750-x +1 moreCisco IOS on Catalyst 3750X switches has default Service Module credentials, which makes it...6.8 Medium
- cisco identity services engine softwareCisco Identity Services Engine does not properly restrict the creation of guest accounts, which...5.0 Medium
- emc rsa authentication agentEMC RSA Authentication Agent 7.1.x before 7.1.2 for Web for Internet Information Services has a...7.5 High
- apple keynoteApple Keynote before 6.0 does not properly handle the interaction between Keynote presentation...7.2 High
- dell quest one password managerThe Dell Quest One Password Manager, possibly 5.0, allows remote attackers to bypass CAPTCHA...5.0 Medium
- apple mac os xThe syslog implementation in Apple Mac OS X before 10.9 allows local users to obtain sensitive...2.1 Low
- apple mac os xSmart Card Services in Apple Mac OS X before 10.9 does not properly implement certificate...4.3 Medium
- apple mac os xApple Mac OS X before 10.9 does not preserve a certain administrative system-preferences setting...5.8 Medium
- apple mac os xThe Screen Lock implementation in Apple Mac OS X before 10.9, when hibernation and autologin are...4.0 Medium
- apple mac os xThe Screen Lock implementation in Apple Mac OS X before 10.9 does not immediately accept Keychain...1.9 Low
- apple mac os xPower Management in Apple Mac OS X before 10.9 does not properly handle the interaction between...2.1 Low
- apple mac os xApp Sandbox in Apple Mac OS X before 10.9 allows attackers to bypass intended sandbox...7.5 High
- apple mac os xLaunchServices in Apple Mac OS X before 10.9 does not properly restrict Unicode characters in...5.0 Medium
- apple mac os xCoreGraphics in Apple Mac OS X before 10.9 allows local users to bypass secure input mode and log...3.3 Low
- apple mac os xCoreGraphics in Apple Mac OS X before 10.9, when display-sleep mode is used, does not ensure that...1.9 Low
- apple mac os xsocketfilterfw in Application Firewall in Apple Mac OS X before 10.9 does not properly implement...6.4 Medium
- apple iphone osPasscode Lock in Apple iOS before 7.0.3 on iPhone devices allows physically proximate attackers...2.1 Low
- apple iphone osPasscode Lock in Apple iOS before 7.0.3 on iPhone devices allows physically proximate attackers...3.3 Low
- ibm websphere datapower xc10 appliance, websphere datapower xc10 appliance firmware +1 moreIBM WebSphere DataPower XC10 appliances 2.5.0 do not require authentication for all...7.1 High
- vmware vcenter serverSession fixation vulnerability in the vSphere Web Client Server in VMware vCenter Server 5.0...6.8 Medium
- vbulletinThe install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create...7.5 High
- dlink di-524up, di-604s, di-604up +10 more +12 moreThe web interface on D-Link DIR-100, DIR-120, DI-624S, DI-524UP, DI-604S, DI-604UP, DI-604+, and...10.0 High
- cisco unified computing systemThe fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to...4.6 Medium
- cisco unified computing systemThe Baseboard Management Controller (BMC) in Cisco Unified Computing System (UCS) allows local...6.8 Medium
- clutter project clutter, opensuse +1 moreThe translate_hierarchy_event function in x11/clutter-device-manager-xi2.c in Clutter, when...2.1 Low
- cisco identity services engine, identity services engine software +1 moreThe Sponsor Portal in Cisco Identity Services Engine (ISE) uses weak permissions for uploaded...5.0 Medium
- ruckuswireless zoneflex 2942, zoneflex 2942 firmware +1 moreRuckus Wireless Zoneflex 2942 devices with firmware 9.6.0.0.267 allow remote attackers to bypass...7.2 High
- cisco nx-osCisco NX-OS allows local users to gain privileges, and read or modify arbitrary files, via the...6.8 Medium
- cisco nx-osCisco NX-OS allows local users to gain privileges and execute arbitrary commands via the sed e...6.8 Medium
- cisco adaptive security appliance softwareThe SSL implementation in Cisco Adaptive Security Appliance (ASA) Software 9.0 before 9.0(2.6)...10.0 High
- cisco firewall services module softwareThe authorization functionality in Cisco Firewall Services Module (FWSM) 3.1.x and 3.2.x before 3...6.6 Medium
- hp imc service operation management software module, intelligent management center +1 moreUnspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Service Operation...7.5 High
- cisco unified computing systemThe fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to...4.6 Medium
- cisco unified computing systemThe fabric-interconnect component in Cisco Unified Computing System (UCS) uses the same privilege...6.8 Medium
- Show moreLoading…