CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- sap businessobjectsSAP BusinessObjects Edge 4.1 allows remote attackers to obtain the...10.0 High
- emc documentum content serverEMC Documentum Content Server before 6.7 SP1 P29, 6.7 SP2 before P18, 7.0 before P16, and 7.1...9.0 High
- ibm business process managerThe import/export functionality in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0...6.5 Medium
- dockerArbitrary Code Execution10.0 High
- zenoss coreThe default configuration of Zenoss Core before 5 allows remote attackers to read or modify...7.5 High
- google androidAndroidManifest.xml in Android before 5.0.0 does not require the SEND_SMS permission for the...3.3 Low
- google androidThe addAccount method in src/com/android/settings/accounts/AddAccountSettings.java in the...7.2 High
- google androidluni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation...7.2 High
- zenoss coreZenoss Core through 5 Beta 3 allows remote attackers to bypass intended access restrictions by...5.0 Medium
- zenoss coreZenoss Core through 5 Beta 3 allows remote attackers to bypass intended access restrictions and...7.5 High
- dockerAccess Restriction Bypass in Docker5.0 Medium
- bmc track-it\!BMC Track-It! 11.3 allows remote attackers to gain privileges and execute arbitrary code by...5.0 Medium
- vmware vcloud automation centerThe VMware Remote Console (VMRC) function in VMware vCloud Automation Center (vCAC) 6.0.1 through...9.0 High
- adobe acrobat, microsoft windows, adobe acrobat reader +1 more +3 moreAdobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allow...5.0 Medium
- icecastIcecast before 2.4.0 does not change the supplementary group privileges when <changeowner> is...4.6 Medium
- plex media serverPlex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist,...7.5 High
- entrypass n5200 active network control panelEntryPass N5200 Active Network Control Panel does not properly restrict access, which allows...7.8 High
- emc documentum content serverEMC Documentum Content Server 7.0, 7.1 before 7.1 P10, and 6.7 before SP2 P19 allows remote...9.0 High
- huawei p2-6011 firmwareThe hx170dec device driver in Huawei P2-6011 before V100R001C00B043 allows local users to read...7.2 High
- sddm project sddm, fedoraproject fedora +1 moreSimple Desktop Display Manager (SDDM) before 0.10.0 allows local users to gain root privileges...7.8 High
- thomsonreuters fixed assets csThe installer in Thomson Reuters Fixed Assets CS 13.1.4 and earlier uses weak permissions for...7.2 High
- cchgroup prosystem fx engagementCCH Wolters Kluwer ProSystem fx Engagement (aka PFX Engagement) 7.1 and earlier uses weak...7.2 High
- ossechost-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without...7.2 High
- redhat packstackOpenStack PackStack 2012.2.1, when the Open vSwitch (OVS) monolithic plug-in is not used, does...5.0 Medium
- fasttoggle project fasttoggleThe Fasttoggle module 7.x-1.3 and 7.x-1.4 for Drupal allows remote attackers to block or unblock...5.8 Medium
- linux kernelThe Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group...4.6 Medium
- wibu codemeter runtimeWibu-Systems CodeMeter Runtime before 5.20 uses weak permissions (read and write access for all...7.2 High
- jexperts channel platformJExperts Channel Platform 5.0.33_CCB allows remote authenticated users to bypass access...6.5 Medium
- arubanetworks airwaveThe web interface in Aruba Networks AirWave before 7.7.14 and 8.x before 8.0.5 allows remote...9.0 High
- canonical ubuntu linuxmountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount...7.2 High
- mantisbtMantisBT before 1.2.18 allows remote authenticated users to bypass the ...4.0 Medium
- digium asterisk, certified asterisk +1 moreThe DB dialplan function in Asterisk Open Source 1.8.x before 1.8.32, 11.x before 11.1.4.1, 12.x...9.0 High
- digium asterisk, certified asterisk +1 moreConfBridge in Asterisk 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and...6.5 Medium
- digium asteriskThe res_pjsip_acl module in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 does...7.5 High
- digium asterisk, certified asterisk +1 moreThe (1) VoIP channel drivers, (2) DUNDi, and (3) Asterisk Manager Interface (AMI) in Asterisk...5.0 Medium
- moodleMoodle does not consider the moodle/tag:edit capability before adding a tag4.0 Medium
- moodleMoodle allows attackers to remove wiki pages5.5 Medium
- moodleMoodle does not verify group permissions4.0 Medium
- moodleMoodle allows attackers to bypass the mod/lti:view capability requirement4.0 Medium
- cisco unified communications manager im and presence serviceCisco Unified Communications Manager IM and Presence Service 9.1(1) produces different returned...5.0 Medium
- tibco managed file transfer command center, managed file transfer internet server, slingshot +1 more +3 moreTIBCO Managed File Transfer Internet Server before 7.2.4, Managed File Transfer Command Center...6.4 Medium
- canonical ubuntu, ubuntu apparmor +1 moreapparmor_parser in the apparmor package before 2.8.95~2430-0ubuntu5.1 in Ubuntu 14.04 allows...6.4 Medium
- ubercartThe Ubercart module 7.x-3.x before 7.x-3.7 for Drupal does not properly protect the per-user...4.0 Medium
- protected pages project pagesThe Protected Pages module 7.x-2.x before 7.x-2.4 for Drupal allows remote attackers to bypass...7.5 High
- twilio project twilioThe Twilio module 7.x-1.x before 7.x-1.9 for Drupal does not properly restrict access to the...5.5 Medium
- web component roles project component rolesThe Webform Component Roles module 6.x-1.x before 6.x-1.8 and 7.x-1.x before 7.x-1.8 for Drupal...6.4 Medium
- zte zxhn h108l firmwareZTE ZXHN H108L with firmware 4.0.0d_ZRQ_GR4 allows remote attackers to modify the CWMP...5.0 Medium
- lantronix xprintserverLantronix xPrintServer does not properly restrict access to ips/, which allows remote attackers...10.0 High
- mulesoft mule enterprise management consoleMule Enterprise Management Console (MMC) does not properly restrict access to handler...6.5 Medium
- drupal, debian linux +1 moreDrupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a...6.8 Medium
- Show moreLoading…