CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft internet explorerMicrosoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted...6.8 Medium
- microsoft windows 7, windows 8, windows 8.1 +6 more +8 moreThe Service Control Manager (SCM) in Microsoft Windows Server 2003 SP2, Windows Vista SP2,...6.9 Medium
- microsoft internet explorerMicrosoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted...6.8 Medium
- microsoft internet explorerMicrosoft Internet Explorer 11 allows remote attackers to bypass the ASLR protection mechanism...4.3 Medium
- microsoft .net frameworkThe Windows Forms (aka WinForms) libraries in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5...9.3 High
- lenovo system updateLenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable...7.2 High
- apple safari, iphone os +1 moreThe page-loading implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6...4.3 Medium
- apple safari, iphone os +1 moreThe history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and...4.3 Medium
- samsung security managerSamsung Security Manager (SSM) before 1.31 allows remote attackers to execute arbitrary code by...10.0 High
- redhat enterprise virtualization managerRed Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 uses weak permissions on the...2.1 Low
- redhat enterprise virtualization managerRed Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 ignores the permission to deny...6.8 Medium
- emc rsa identity management and governanceEMC RSA Identity Management and Governance (IMG) 6.9 before P04 and 6.9.1 before P01 does not...7.5 High
- hospira lifecare pca3, lifecare pca5, lifecare pcainfusion firmware +2 moreThe communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require...10.0 High
- magentoThe fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition ...6.5 Medium
- ibm websphere application serverWebSphereOauth20SP.ear in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.39, 8.0 before...9.3 High
- ibm websphere application serverIBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 does not properly...5.5 Medium
- views project viewsThe Views module before 6.x-2.18, 6.x-3.x before 6.x-3.2, and 7.x-3.x before 7.x-3.10 for Drupal...4.0 Medium
- redhat jboss enterprise application platformThe default configuration for the Command Line Interface in Red Hat Enterprise Application...2.1 Low
- microsoft win32k, windows 2003 server, windows 7 +2 more +4 moreWin32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server...7.8 High
- google chrome, debian linux, opensuse +2 moreGoogle Chrome before 42.0.2311.90 does not always ask the user before proceeding with...4.3 Medium
- google chrome, opensuse +1 moreThe NaClSandbox::InitializeLayerTwoSandbox function in components/nacl/loader/sandbox_linux...7.5 High
- google chrome, debian linux +1 moreThe FileSystem API in Google Chrome before 40.0.2214.91 allows remote attackers to bypass the...4.3 Medium
- google chrome, canonical ubuntu linux, debian linux +2 moreThe MediaElementAudioSourceNode::process function in modules/webaudio/MediaElementAudioSourceNode...4.3 Medium
- google chrome, canonical ubuntu linux, debian linux +2 moreThe ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in the HTML parser in...5.0 Medium
- cisco secure desktopA certain Cisco JAR file, as distributed in Cache Cleaner in Cisco Secure Desktop (CSD), allows...9.3 High
- openstack swift, canonical ubuntu linux +1 moreOpenStack Swift Unauthorized delete of versioned Swift object5.5 Medium
- microsoft internet explorerMicrosoft Internet Explorer 6 through 11 allows remote attackers to bypass the ASLR protection...4.3 Medium
- microsoft xml core servicesMicrosoft XML Core Services (aka MSXML) 3.0 allows remote attackers to bypass the Same Origin...4.3 Medium
- microsoft windows 7, windows 8, windows 8.1 +6 more +8 moreMicrosoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows...7.2 High
- microsoft windows 7, windows 8, windows 8.1 +6 more +8 moreMicrosoft Windows Server 2003 R2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows...7.2 High
- microsoft windows server 2012Microsoft Active Directory Federation Services (AD FS) 3.0 on Windows Server 2012 R2 does not...5.8 Medium
- microsoft windows 7, windows server 2008 +1 moreTask Scheduler in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to...7.2 High
- apport project apportThe crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to...7.2 High
- cisco web security applianceCisco Web Security Appliance (WSA) devices with software 8.5.0-ise-147 do not properly restrict...7.2 High
- apple xcodeClang in LLVM, as used in Apple Xcode before 6.3, performs incorrect register allocation in a way...5.0 Medium
- juniper junosJuniper Junos 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D20,...7.2 High
- apple iphone os, mac os x, tvos +2 moreThe (1) setreuid and (2) setregid system-call implementations in the kernel in Apple iOS before 8...6.9 Medium
- apple iphone osAppleKeyStore in Apple iOS before 8.3 does not properly restrict a certain passcode-confirmation...1.9 Low
- mcafee advanced threat defenseThe web interface in McAfee Advanced Threat Defense (MATD) before 3.4.4.63 does not properly...4.0 Medium
- mcafee advanced threat defenseMcAfee Advanced Threat Defense (MATD) before 3.4.4.63 allows remote authenticated users to bypass...5.5 Medium
- mozilla firefox, oracle solaris +1 moreThe Reader mode feature in Mozilla Firefox before 37.0.1 on Android, and Desktop Firefox pre...5.0 Medium
- broadcom spectrumCA Spectrum 9.2.x and 9.3.x before 9.3 H02 does not properly validate serialized Java objects,...9.0 High
- ibm websphere datapower xc10 appliance firmwareThe IBM WebSphere DataPower XC10 appliance 2.1 before 2.1.0.3 allows remote attackers to hijack...6.8 Medium
- ibm dominoNotes System Diagnostic (NSD) in IBM Domino 8.5.x before 8.5.3 FP6 IF6 and 9.x before 9.0.1 FP3...7.2 High
- qualiteam x-cartX-Cart before 5.1.11 allows remote authenticated users to read or delete address data of...6.5 Medium
- antlabs inngate ig 3.00 e, inngate ig 3.01 e, inngate ig 3.02 e +4 more +6 moreThe ANTlabs InnGate firmware on IG 3100, IG 3101, InnGate 3.00 E, InnGate 3.01 E, InnGate 3.02 E,...10.0 High
- cisco unified communications domain managerCisco Unified Communications Domain Manager 8.1(4) allows remote authenticated users to execute...6.5 Medium
- typo3 neosTYPO3 Neos 1.1.x before 1.1.3 and 1.2.x before 1.2.3 allows remote editors to access, create, and...6.5 Medium
- sap clinical task tracker, emr unwired +1 moreSAP EMR Unwired (com.sap.mobile.healthcare.emr.v2) and Clinical Task Tracker (com.sap.mobile...6.4 Medium
- mozilla firefox, thunderbird +1 moreMozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not...5.0 Medium
- Show moreLoading…