CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- cisco nx-osCisco Application Policy Infrastructure Controller (APIC) 1.0(1.110a) and 1.0(1e) on Nexus 9000...4.0 Medium
- cisco unified communications manager im and presence serviceCisco Unified Communications Manager IM and Presence Service 9.1(1) does not properly restrict...4.0 Medium
- cisco secure access control system, identity services engine software +1 moreCisco Secure Access Control System before 5.4(0.46.2) and 5.5 before 5.5(0.46) and Cisco Identity...4.0 Medium
- cisco anyconnect secure mobility clientCisco AnyConnect Secure Mobility Client 3.1(60) on Windows does not properly validate pathnames,...7.2 High
- emc unified infrastructure manager\/provisioningEMC Unified Infrastructure Manager/Provisioning (UIM/P) 4.1 allows remote attackers to bypass...10.0 High
- services project servicesThe Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote attackers to bypass the...5.0 Medium
- open graph importer project graph importerThe Open Graph Importer (og_tag_importer) 7.x-1.x for Drupal does not properly check the create...4.0 Medium
- web-dorado spider video playerThe Spider Video Player module for Drupal allows remote authenticated users with the "access...4.9 Medium
- services basic authentication project basic authenticationThe Services Basic Authentication module 7.x-1.x through 7.x-1.3 for Drupal allows remote...5.0 Medium
- linux kernel, canonical ubuntu linux +1 moreThe overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in...7.8 High
- igreks milkystep light, milkystep professional, milkystep professional oem +2 moreIgreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers...6.4 Medium
- igreks milkystep light, milkystep professional, milkystep professional oem +2 moreIgreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers...5.0 Medium
- cisco iosThe TCL interpreter in Cisco IOS 15.2 does not properly maintain the vty state, which allows...6.9 Medium
- cisco identity services engine softwareThe administrative web interface in Cisco Identity Services Engine (ISE) before 1.3 allows remote...5.5 Medium
- cisco prime network control systemThe Device Work Center (DWC) component in Cisco Prime Network Control System (NCS) 2.1(0.0.85), 2...6.5 Medium
- cisco firesight system softwareCisco FireSIGHT System Software 5.3.1.3 and 6.0.0 allows remote authenticated users to delete an...5.5 Medium
- xclonerThe XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with...5.0 Medium
- adobe air, air sdk, flash player +2 more +4 moreThe Flash broker in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160...4.3 Medium
- microsoft internet explorerMicrosoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted...6.8 Medium
- microsoft internet explorerMicrosoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted...6.8 Medium
- comodo geekbuddyComodo GeekBuddy before 4.18.121 does not restrict access to the VNC server, which allows local...7.2 High
- sysaidSysAid Help Desk before 15.2 does not properly restrict access to certain functionality, which...7.5 High
- sybase adaptive server enterpriseSAP Adaptive Server Enterprise (ASE) before 15.7 SP132 and 16.0 before 16.0 SP01 allows remote...7.5 High
- cisco edge 340 firmwareCisco Edge 300 software 1.0 and 1.1 on Edge 340 devices allows local users to obtain root...7.2 High
- cisco anyconnect secure mobility clientCisco AnyConnect Secure Mobility Client before 3.1(8009) and 4.x before 4.0(2052) on Linux does...7.2 High
- cisco adaptive security appliance softwareThe IKEv1 implementation in Cisco ASA Software 7.x, 8.0.x, 8.1.x, and 8.2.x before 8.2.2.13...4.0 Medium
- wpmembershipThe WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain...6.5 Medium
- xenXen 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask bits, which allows...7.8 High
- xenXen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data...4.9 Medium
- sap afariaSAP Afaria does not properly restrict access to unspecified functionality, which allows remote...7.5 High
- synology cloud stationclient_chown in the sync client in Synology Cloud Station 1.1-2291 through 3.1-3320 on OS X...6.8 Medium
- visual mining netcharts serverprojectContents.jsp in the Developer tools in Visual Mining NetCharts Server allows remote...10.0 High
- arubanetworks clearpass policy managerDirectory traversal vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.4...4.0 Medium
- ibm security siteprotector systemIBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1...9.0 High
- mit kerberos 5The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not...5.8 Medium
- ibm optim workload replayIBM InfoSphere Optim Workload Replay 2.x before 2.1.0.3 relies on client-side code to verify...5.0 Medium
- cisco telepresence advanced media gateway, telepresence ip gateway, telepresence mcu software +7 more +9 moreThe web framework in Cisco TelePresence Advanced Media Gateway Series Software before 1.1(1.40),...9.0 High
- cisco hosted collaboration solutionThe administrative web interface in Cisco Hosted Collaboration Solution (HCS) 10.6(1) and earlier...6.5 Medium
- canonical ubuntu linuxApport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged...7.8 High
- fuse project fuse, debian linux +1 morefusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1)...3.6 Low
- google chrome, debian linux +1 morecore/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the...5.0 Medium
- moodleMoodle allows attackers to bypass file-management restrictions4.0 Medium
- moodleMoodle allows attackers to bypass intended login restrictions3.5 Low
- dockerArbitrary File Override in Docker Engine3.6 Low
- dockerInformation Exposure in Docker Engine7.2 High
- cisco unified communications managerCisco Unified Communications Manager 10.0(1.10000.12) allows local users to gain privileges via a...6.9 Medium
- mozilla firefoxMozilla Firefox before 38.0 on Android does not properly restrict writing URL data to the Android...2.1 Low
- microsoft silverlightMicrosoft Silverlight 5 before 5.1.40416.00 allows remote attackers to bypass intended integrity...9.3 High
- microsoft internet explorerMicrosoft Internet Explorer 11 allows remote attackers to gain privileges via a crafted web site,...6.8 Medium
- microsoft internet explorerMicrosoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted...6.8 Medium
- Show moreLoading…