CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- pixabay images project imagespixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly...7.5 High
- google chromeUnquoted Windows search path vulnerability in the GoogleChromeDistribution:...4.6 Medium
- midgard-project midgard2, opensuse +1 moreThe default D-Bus access control rule in Midgard2 10.05.7.1 allows local users to send arbitrary...7.2 High
- genetechsolutions pie registerThe Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain...5.0 Medium
- google chrome, chromium, opensuse +4 more +6 moreGoogle Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote...4.3 Medium
- sap enterprise resource planningThe Dealer Portal in SAP ERP does not properly restrict access, which allows remote attackers to...7.5 High
- adb p.dga4001n firmwareThe ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6...9.4 High
- broadcom symantec critical system protection, symantec data center security +1 moreThe management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and...7.2 High
- pivotal software rabbitmqRabbitMQ before 3.4.0 allows remote attackers to bypass the loopback_users restriction via a...5.0 Medium
- moodleMoodle allows attackers to bypass a messaging-disabled setting4.0 Medium
- ibm sas connectivity module firmware, sas raid module firmware +1 moreIBM BladeCenter SAS Connectivity Module (aka NSSM) and SAS RAID Module (aka RSSM) before 1.3.3...5.0 Medium
- puppet stdlibThe puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8...6.5 Medium
- mediawikiMediaWiki 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote...5.0 Medium
- juniper junosJuniper Junos 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D25, 12.1X47 before 12.1X47-D15,...6.9 Medium
- sambaSamba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory...8.5 High
- ibm aix, vios +1 morelquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain...7.2 High
- mozilla firefox, opensuse +1 moreMozilla Firefox before 35.0 on Windows allows remote attackers to bypass the Gecko Media Plugin ...7.1 High
- siemens simatic wincc sm\@rtclientThe Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for iOS allows local users to bypass an...1.9 Low
- microsoft windows 7, windows 8, windows 8.1 +5 more +7 moremrxdav.sys (aka the WebDAV driver) in the kernel-mode drivers in Microsoft Windows Server 2003...4.7 Medium
- microsoft windows 7, windows 8, windows 8.1 +5 more +7 moreThe Network Location Awareness (NLA) service in Microsoft Windows Server 2003 SP2, Windows Vista...6.1 Medium
- microsoft windows 7, windows 8, windows 8.1 +6 more +8 moreThe User Profile Service (aka ProfSvc) in Microsoft Windows Server 2003 SP2, Windows Vista SP2,...7.2 High
- microsoft windows 7, windows 8, windows 8.1 +4 more +6 moreThe AhcVerifyAdminContext function in ahcache.sys in the Application Compatibility component in...7.2 High
- microsoft windows 8, windows 8.1, windows rt +2 more +4 moreThe Windows Error Reporting (WER) component in Microsoft Windows 8, Windows 8.1, Windows Server...1.9 Low
- realnetworks realarcade installerRealNetworks GameHouse RealArcade Installer (aka ActiveMARK Game Installer) 2.6.0.481 and 3.0.7...7.2 High
- glpi-project glpiGLPI before 0.84.7 does not properly restrict access to cost information, which allows remote...5.0 Medium
- cisco secure access control systemThe RBAC component in Cisco Secure Access Control System (ACS) allows remote authenticated users...6.5 Medium
- asus wrt firmware, t-mobile tm-ac1900 +1 morecommon.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and other...10.0 High
- vdgsecurity vdg senseVDG Security SENSE (formerly DIVA) before 2.3.15 allows remote attackers to bypass authentication...6.4 Medium
- redhat openstack, openstack image registry and delivery service \(glance\) +1 moreThe V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.2.2 and 2014.1.4...5.5 Medium
- redhat libvirtThe qemu implementation of virConnectGetAllDomainStats in libvirt before 1.2.11 does not properly...4.0 Medium
- canonical ubuntu linux, linuxcontainers cgmanager +1 morecmanager 0.32 does not properly enforce nesting when modifying cgroup properties, which allows...2.1 Low
- kofax e-transactions sender sendboxThe SaveMessage method in the LEADeMail.LEADSmtp.20 ActiveX control in LTCML14n.dll 14.0.0.34 in...6.4 Medium
- easewe software ftp ocx activex controlThe EaseWeFtp.FtpLibrary ActiveX control in EaseWeFtp.ocx in Easewe FTP OCX 4.5.0.9 does not...7.5 High
- ashampoo gmbh \& co. 3d cad professional 3The SaveData method in the Cygnicon.ViewControl.1 ActiveX control in CyViewer.ocx in Ashampoo 3D...6.4 Medium
- idrive inc online backupThe SaveToFile method in the UniBasicPack.UniTextBox ActiveX control in UniBasic100_EDA1811C.ocx...6.4 Medium
- diego uscanga atube catcherThe SaveDecrypted method in the ChilkatCrypt2.ChilkatOmaDrm.1 ActiveX control in ChilkatCrypt2...6.4 Medium
- ibm websphere service registry and repositoryIBM WebSphere Service Registry and Repository (WSRR) 8.5 before 8.5.0.1, when Chrome and WebSEAL...2.1 Low
- facebook hiphop virtual machineFacebook HipHop Virtual Machine (HHVM) before 3.1.0 does not drop supplemental group memberships...5.0 Medium
- ibm websphere service registry and repositoryIBM WebSphere Service Registry and Repository (WSRR) 6.3.x before 6.3.0.5, 7.0.x through 7.0.0.5,...4.0 Medium
- ibm websphere service registry and repositoryIBM WebSphere Service Registry and Repository (WSRR) 7.0.x before 7.0.0.5 does not perform access...4.0 Medium
- ibm websphere service registry and repositoryIBM WebSphere Service Registry and Repository (WSRR) 7.0.x before 7.0.0.5 and 7.5.x before 7.5.0...4.0 Medium
- cisco meraki ms, meraki mr, meraki mr firmware +3 more +5 moreCisco-Meraki MS, MR, and MX devices with firmware before 2014-09-24 allow remote authenticated...7.7 High
- cisco meraki ms, meraki mr, meraki mr firmware +3 more +5 moreCisco-Meraki MS, MR, and MX devices with firmware before 2014-09-24 allow physically proximate...7.2 High
- ibm security appscan, security appscan source +1 moreIBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7...5.5 Medium
- cisco identity services engine softwareThe Sponsor Portal in Cisco Identity Services Engine (ISE) allows remote authenticated users to...4.0 Medium
- innominate mguard, mguard firmware +1 moreInnominate mGuard Improper Privilege Management8.5
- otrs help deskThe GenericInterface in OTRS Help Desk 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before...6.0 Medium
- huawei p7-l10 firmwareThe PackageInstaller module in Huawei P7-L10 smartphones before V100R001C00B136 allows remote...4.3 Medium
- redhat libvirt, canonical ubuntu linux, mageia +5 more +7 moreThe (1) qemuDomainMigratePerform and (2) qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c...2.1 Low
- ibm websphere application serverIBM WebSphere Application Server Liberty Profile 8.5.x before 8.5.5.4 allows remote attackers to...5.1 Medium
- Show moreLoading…