CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- linux kernelThe implementation of certain splice_write file operations in the Linux kernel before 3.16 does...7.2 High
- microsoft nokia asha 501, nokia asha 501 software +1 moreMicrosoft Asha OS on the Microsoft Mobile Nokia Asha 501 phone 14.0.4 allows physically proximate...6.6 Medium
- aveva clearscada, schneider electric scada expert clearscada +1 moreSchneider Electric SCADA Expert ClearSCADA Improper Authentication6.4
- apple iphone osThe Accounts subsystem in Apple iOS before 8 allows attackers to bypass a sandbox protection...4.3 Medium
- apple iphone osThe Accessibility subsystem in Apple iOS before 8 allows attackers to interfere with screen...6.9 Medium
- apple iphone osApple iOS before 8 enables Voice Dial during all upgrade actions, which makes it easier for...2.1 Low
- apple iphone osApple iOS before 8 enables Bluetooth during all upgrade actions, which makes it easier for remote...5.8 Medium
- nongnu gksuGKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper...6.8 Medium
- emc documentum content serverEMC Documentum Content Server before 6.7 SP2 P17, 7.0 through P15, and 7.1 before P08 does not...7.1 High
- emc documentum content serverEMC Documentum Content Server before 6.7 SP2 P17, 7.0 through P15, and 7.1 before P08 does not...8.5 High
- ecava integraxor, integraxor scada server +1 moreEcava IntegraXor SCADA Server External Control of File Name or Path8.3
- moodleMoodle allows discovery of an author's username4.0 Medium
- zohocorp manageengine eventlog analyzerZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 does not properly restrict...6.5 Medium
- ibm initiate master data serviceIBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0...4.9 Medium
- ibm initiate master data serviceIBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0...4.3 Medium
- ibm rational license key serverThe Administration and Reporting Tool in IBM Rational License Key Server (RLKS) 8.1.4.x before 8...2.1 Low
- microsoft windows 8, windows 8.1, windows rt +2 more +4 moreThe Task Scheduler in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and...7.2 High
- adobe air, air sdk, flash player +2 moreAdobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and...10.0 High
- adobe air, air sdk, flash player +2 moreAdobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and...7.5 High
- canonical acpi-supportThe Debian acpi-support package before 0.140-5+deb7u3 allows local users to gain privileges via...7.2 High
- ibm cognos tm1IBM Cognos TM1 10.2.0.2 before IF1 and 10.2.2.0 before IF1 allows remote attackers to bypass...5.0 Medium
- plack project plackPlack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which...5.0 Medium
- ibm business process managerAn unspecified Ajax service in the Content Management toolkit in IBM Business Process Manager ...4.0 Medium
- ibm business process manager, websphere application server +1 moreIBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.x allow...4.0 Medium
- mozilla firefoxMozilla Firefox before 31.1 on Android does not properly restrict copying of local files onto the...4.3 Medium
- codeaurora android-msmThe device-initialization functionality in the MSM camera driver for the Linux kernel 2.6.x and 3...7.2 High
- spi-inc ganetiThe _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0...2.1 Low
- xenXen 4.4.x, when running a 64-bit kernel on an ARM system, does not properly handle traps from the...4.3 Medium
- wordpress mobile pack project mobile pack, wpmobilepack wordpress mobile pack +1 moreThe WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to...5.0 Medium
- arubanetworks clearpass policy managerThe management console in Aruba Networks ClearPass Policy Manager 6.3.0.60730 allows local users...9.0 High
- cisco cloud portalCisco Intelligent Automation for Cloud (aka Cisco Cloud Portal) does not properly implement URL...4.0 Medium
- ibm maximo asset management, smartcloud control desk, tivoli asset management for it +2 moreIBM Maximo Asset Management 6.1 through 6.5, 7.1 through 7.1.1.13, and 7.5 through 7.5.0.6;...4.9 Medium
- ibm mobile foundation, worklight +1 moreIBM Worklight Foundation 5.x and 6.x before 6.2.0.0, as used in Worklight and Mobile Foundation,...4.9 Medium
- ibm monitoring agent for unix logs, monitoring server \(ms\) and shared libraries \(ax\) +1 moreMonitoring Agent for UNIX Logs 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP09, and 6...7.2 High
- cisco transport gateway installation softwareThe web framework in Cisco Transport Gateway for Smart Call Home (aka TG-SCH or Transport Gateway...5.0 Medium
- vmware tools, vm-support, workstation +2 morevm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other...4.7 Medium
- google chromeThe Debugger extension API in browser/extensions/api/debugger/debugger_api.cc in Google Chrome...6.4 Medium
- google chromeextensions/common/url_pattern.cc in Google Chrome before 37.0.2062.94 does not prevent use of a '...6.4 Medium
- ibm emptoris sourcing portfolio, emptoris spend analysis +1 moreIBM Emptoris Sourcing Portfolio 9.5.x before 9.5.1.3, 10.0.0.x before 10.0.0.1, 10.0.1.x before...4.9 Medium
- qnap ss-839, ts-459u, ts-469u +5 more +7 moreQNAP TS-469U with firmware 4.0.7 Build 20140410, TS-459U, TS-EC1679U-RP, and SS-839 use world...2.1 Low
- ubi uplay pcUbisoft Uplay PC before 4.6.1.3217 use weak permissions (Everyone: Full Control) for the program...7.2 High
- little kernel project kernel bootloaderThe boot_linux_from_mmc function in app/aboot/aboot.c in the Little Kernel (LK) bootloader, as...1.9 Low
- tenda a5s, a5s firmware +1 moreThe Shenzhen Tenda Technology Tenda A5s router with firmware 3.02.05_CN allows remote attackers...10.0 High
- ibm websphere application serverIBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.35, 8.0.x before 8.0.0.10, and 8.5.x...5.0 Medium
- ibm websphere application serverThe addFileRegistryAccount Virtual Member Manager (VMM) SPI Admin Task in IBM WebSphere...5.0 Medium
- djangoproject django, opensuse +1 moreDjango data leakage via querystring manipulation in admin3.5 Low
- ibm powervcIBM PowerVC 1.2.0 before FixPack3 does not properly use the known_hosts file, which allows man-in...4.3 Medium
- emc documentum content serverEMC Documentum Content Server before 6.7 SP2 P16 and 7.x before 7.1 P07 allows remote...8.5 High
- rubyonrails railsActive Record subject to strong parameters protection bypass7.5 High
- emc documentum content serverEMC Documentum Content Server before 6.7 SP2 P16 and 7.x before 7.1 P07, when Oracle Database is...6.3 Medium
- Show moreLoading…