CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- topline systems opportunity formTopline Opportunity Form (aka XLS Opp form) before 2015-02-15 does not properly restrict access...4.0 Medium
- emc documentum d2The Properties service in the D2FS web-service component in EMC Documentum D2 3.1 through SP1, 4...9.0 High
- redhat jboss enterprise application platformThe Role Based Access Control (RBAC) implementation in JBoss Enterprise Application Platform (EAP...4.0 Medium
- redhat jboss enterprise application platformThe org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in...3.5 Low
- jython project jython, opensuse +1 moreJython Improper Access Restrictions vulnerability4.6 Medium
- ibm tivoli storage managerdsmtca in the client in IBM Tivoli Storage Manager (TSM) 6.3 before 6.3.2.3, 6.4 before 6.4.2.2,...7.2 High
- ibm business process managerThe Search REST API in IBM Business Process Manager 8.0.1.3, 8.5.0.1, and 8.5.5.0 allows remote...4.0 Medium
- apache wss4jImproper Access Control in Apache WSS4J5.0 Medium
- cisco telepresence system software ixThe administrative web-management portal in Cisco IX 8 (.0.1) and earlier on Cisco TelePresence...6.5 Medium
- microsoft internet explorerMicrosoft Internet Explorer 9 through 11 allows remote attackers to bypass the ASLR protection...6.5 Medium
- microsoft internet explorerMicrosoft Internet Explorer 10 and 11 allows remote attackers to bypass the ASLR protection...4.3 Medium
- microsoft windows 7, windows 8, windows 8.1 +4 more +6 moreMicrosoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012...7.2 High
- microsoft windows 7, windows 8, windows 8.1 +4 more +6 morewin32k.sys in the kernel-mode drivers in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1,...6.9 Medium
- microsoft windows 7, windows 8, windows 8.1 +6 more +8 morewin32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2,...7.2 High
- microsoft internet explorerMicrosoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted...4.3 Medium
- microsoft internet explorerMicrosoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted...4.3 Medium
- microsoft internet explorerMicrosoft Internet Explorer 8 allows remote attackers to bypass the ASLR protection mechanism via...4.3 Medium
- microsoft virtual machine managerMicrosoft System Center Virtual Machine Manager (VMM) 2012 R2 Update Rollup 4 does not properly...6.9 Medium
- freetype, canonical ubuntu linux, debian linux +8 more +10 morebdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial...5.0 Medium
- cisco asyncosThe uuencode inspection engine in Cisco AsyncOS on Cisco Email Security Appliance (ESA) devices 8...4.3 Medium
- cisco unified ip phones 9900 series firmwareCisco Unified IP 9900 phones with firmware 9.4(.1) and earlier use weak permissions for...4.6 Medium
- mcafee data loss prevention endpointMcAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows local users to write to...6.9 Medium
- k7computing anti-virus plus, k7sentry.sys, total security +1 more +3 moreK7Sentry.sys in K7 Computing Ultimate Security, Anti-Virus Plus, and Total Security before 14.2.0...7.2 High
- bullguard bdagent.sys, internet security, online backup +1 more +3 morebdagent.sys in BullGuard Antivirus, Internet Security, Premium Protection, and Online Backup...7.2 High
- trendmicro tmeext.sysThe tmeext.sys driver before 2.0.0.1015 in Trend Micro Antivirus Plus, Internet Security, and...7.2 High
- avg internet security, protection +1 moreThe TDI driver (avgtdix.sys) in AVG Internet Security before 2013.3495 Hot Fix 18 and 2015.x...7.2 High
- netapp oncommand balanceNetApp OnCommand Balance before 4.2P2 contains a "default privileged account," which allows...10.0 High
- ansible towerAnsible Tower (aka Ansible UI) before 2.0.5 allows remote organization administrators to gain...6.5 Medium
- owncloud, owncloud server +1 moreThe documents application in ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3 allows remote...5.0 Medium
- servision hvg video gateway firmwaretime.htm in the web interface on SerVision HVG Video Gateway devices with firmware through 2.2...9.0 High
- huawei quidway firmwareHuawei Quidway switches with firmware before V200R005C00SPC300 allows remote attackers to gain...7.5 High
- fortinet fortiauthenticatorFortinet FortiAuthenticator 3.0.0 allows local users to bypass intended restrictions and gain...6.9 Medium
- comodo backupThe bdisk.sys driver in COMODO Backup before 4.4.1.23 allows remote attackers to gain privileges...7.5 High
- apache qpidUnspecified vulnerability in Apache Qpid 0.30 and earlier allows remote attackers to bypass...5.0 Medium
- freebsdMultiple array index errors in the Stream Control Transmission Protocol (SCTP) module in FreeBSD...4.6 Medium
- siemens ruggedcom firmwareThe integrated management service on Siemens Ruggedcom WIN51xx devices with firmware before SS4.4...10.0 High
- hp sitescopeUnspecified vulnerability in HP SiteScope 11.1x and 11.2x allows remote authenticated users to...5.5 Medium
- ibm tivoli monitoringIBM Tivoli Monitoring (ITM) 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP09, 6.2.3...8.5 High
- i-o data device np-bbrmI-O DATA DEVICE NP-BBRM routers allow remote attackers to cause a denial of service (SSDP...7.8 High
- qpr portalQPR Portal before 2012.2.1 allows remote attackers to modify or delete notes via a direct request.6.4 Medium
- symantec encryption management server, pgp universal server +1 moreSymantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allow remote...9.0 High
- apple mac os xThe Security component in Apple OS X before 10.10.2 does not properly process cached information...4.3 Medium
- apple mac os xsecurity_taskgate in Apple OS X before 10.10.2 allows attackers to read group-ACL-restricted...5.0 Medium
- apple mac os xSandbox in Apple OS X before 10.10 allows attackers to write to the sandbox-profile cache via a...7.5 High
- apple mac os xThe IOUSBControllerUserClient::ReadRegister function in the IOUSB controller in IOUSBFamily in...4.7 Medium
- apple iphone os, tvos +1 moreThe mach_port_kobject interface in the kernel in Apple iOS before 8.1.3 and Apple TV before 7.0.3...5.0 Medium
- apple iphone os, mac os x, tvos +2 moreThe kernel in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does...10.0 High
- apple iphone osThe app-installation functionality in MobileInstallation in Apple iOS before 8.1.3 allows...7.5 High
- vmware esxi, fusion, player +1 more +3 moreVMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, VMware Fusion 6.x before 6...6.4 Medium
- ibm tririga application platformIBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allows...4.3 Medium
- Show moreLoading…