CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- freeipaFreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers...3.5 Low
- microsoft kerberos key distribution center (kdc), windows 7, windows 8 +4 more +6 moreThe Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista...9.0 High
- ibm tivoli storage managerThe server in IBM Tivoli Storage Manager (TSM) 5.x and 6.x before 6.3.5.10 and 7.x before 7.1.1...2.1 Low
- apple iphone osApple iOS before 8.1.1 allows physically proximate attackers to bypass the lock-screen protection...2.1 Low
- apple iphone osThe Sandbox Profiles subsystem in Apple iOS before 8.1.1 does not properly implement the...7.5 High
- apple iphone os, tvos +1 moredyld in Apple iOS before 8.1.1 and Apple TV before 7.0.2 does not properly handle overlapping...2.1 Low
- apple iphone osApple iOS before 8.1.1 does not properly enforce the failed-passcode limit, which makes it easier...7.2 High
- vtiger crmviews/Index.php in the Install module in vTiger 6.0 before Security Patch 2 does not properly...5.0 Medium
- cisco iosCisco IOS on Aironet access points, when "dot11 aaa authenticator" debugging is enabled, allows...7.1 High
- adobe air, air sdk, flash player +1 more +3 moreAdobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X...6.4 Medium
- adobe air, air sdk, flash player +1 more +3 moreAdobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X...6.4 Medium
- adobe air, air sdk, flash player +1 more +3 moreAdobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X...6.4 Medium
- adobe air, air sdk, flash player +1 more +3 moreAdobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X...5.0 Medium
- adobe flash playerAdobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X...5.0 Medium
- adobe flash playerAdobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X...10.0 High
- adobe flash playerAdobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X...10.0 High
- rockwellautomation connected components workbenchRockwell Automation Connected Components Workbench (CCW) before 7.00.00 allows remote attackers...7.5 High
- huawei ec156, ec176, ec177 +1 more +3 moreUntrusted search path vulnerability in Huawei Mobile Partner for Windows 23.009.05.03.1014 allows...7.2 High
- redhat openshiftRed Hat OpenShift Enterprise before 2.2 does not properly restrict access to gears, which allows...7.5 High
- redhat openshiftRed Hat OpenShift Enterprise before 2.2 allows local users to obtain IP address and port number...2.1 Low
- drupal organic groups menuThe Organic Groups Menu (aka OG Menu) module before 7.x-2.2 for Drupal allows remote...3.5 Low
- adobe air, air sdk, flash player +1 more +3 moreAdobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and...7.5 High
- microsoft internet explorerMicrosoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted...4.3 Medium
- microsoft internet explorerMicrosoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted...4.3 Medium
- microsoft internet explorerMicrosoft Internet Explorer 8 and 9 allows remote attackers to bypass the ASLR protection...5.0 Medium
- microsoft active directory federation servicesMicrosoft Active Directory Federation Services (AD FS) 2.0, 2.1, and 3.0, when a configured SAML...5.0 Medium
- microsoft internet information servicesThe IP Security feature in Microsoft Internet Information Services (IIS) 8.0 and 8.5 does not...5.1 Medium
- microsoft windows 7, windows server 2003, windows server 2008 +3 more +5 moreMicrosoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows...7.8 High
- microsoft windows server 2003Microsoft Windows Server 2003 SP2 allows local users to gain privileges via a crafted IOCTL call...7.2 High
- citrix netscaler application delivery controller firmware, netscaler gateway firmware +1 moreCitrix NetScaler Application Delivery Controller and NetScaler Gateway 10.5.50.10 before 10.5-52...4.9 Medium
- kde kde-workspace, plasma-desktop +1 moreThe KDE Clock KCM policykit helper in kde-workspace before 4.11.14 and plasma-desktop before 5.1...7.2 High
- compal broadband networks cg6640e wireless gateway, firmware, ch664oe wireless gateway +2 moreThe Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640...5.0 Medium
- ibm cognos mobileIBM Cognos Mobile 10.1.1 before FP3 IF1, 10.2.0 before FP2 IF1, and 10.2.1 before FP4 IF1...4.3 Medium
- estsoft alupdateESTsoft ALUpdate 8.5.1.0.0 uses weak permissions (Users: Full Control) for the (1) AlUpdate...4.6 Medium
- pro softnet corporation ibackupiBackup 10.0.0.32 and earlier uses weak permissions (Everyone: Full Control) for ib_service.exe,...7.2 High
- espocrminstall/index.php in EspoCRM before 2.6.0 allows remote attackers to re-install the application...5.0 Medium
- deeproot linux deepofixThe SMTP server in DeepOfix 3.3 and earlier allows remote attackers to bypass authentication via...5.0 Medium
- avamar virtual edition 7.0, 7.0.2-43, 6.0 +1 more +3 moreEMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x through 7.0.2-43 do...5.0 Medium
- electric cloud electriccommanderElectric Cloud ElectricCommander before 4.2.6 and 5.x before 5.0.3 uses world-writable...4.6 Medium
- centrify suite, directcontrol +1 moreadsetgroups in Centrify Server Suite 2008 through 2014.1 and Centrify DirectControl 3.x through 4...4.9 Medium
- openmrsThe administration module in OpenMRS 2.1 Standalone Edition allows remote authenticated users to...4.0 Medium
- bananadance banana dancefunctions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to read arbitrary...5.0 Medium
- bulbsecurity smartphone pentest frameworkThe btinstall installation script in Bulb Security Smartphone Pentest Framework (SPF) before 0.1...4.6 Medium
- bulbsecurity smartphone pentest frameworkBulb Security Smartphone Pentest Framework (SPF) before 0.1.3 does not properly restrict access...5.0 Medium
- ibm qradar security information and event managerIBM Security QRadar SIEM QRM 7.1 MR1 and QRM/QVM 7.2 MR2 does not include the HTTPOnly flag in a...4.3 Medium
- cisco asyncosThe ZIP inspection engine in Cisco AsyncOS 8.5 and earlier on the Cisco Email Security Appliance ...5.0 Medium
- apple os x serverMail Service in Apple OS X Server before 4.0 does not enforce SACL changes until after a service...2.1 Low
- apple mac os xNetFS Client Framework in Apple OS X before 10.10 does not ensure that the disabling of File...6.8 Medium
- apple mac os xLaunchServices in Apple OS X before 10.10 allows attackers to bypass intended sandbox...6.8 Medium
- apple mac os xDock in Apple OS X before 10.10 does not properly manage the screen-lock state, which allows...2.1 Low
- Show moreLoading…