CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- epson network utilityEPSON Network Utility 4.10 uses weak permissions (Everyone: Full Control) for eEBSVC.exe, which...6.9 Medium
- canonical apport, ubuntu linux +1 moreApport privilege escalation through Python module imports7.4 High
- openstack image registry and delivery service \(glance\)OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service6.8 Medium
- cisco wireless lan controller softwareThe Web Management GUI on Cisco Wireless LAN Controller (WLC) devices with software 7.4(140.0)...5.0 Medium
- cisco firesight system softwareThe policy implementation in Cisco FireSIGHT Management Center 5.3.1.7, 5.4.0.4, and 6.0.0 for...9.0 High
- apple mac os xThe MCX Application Restrictions component in Apple OS X before 10.11.1, when Managed...7.6 High
- apple mac os xcoreaudiod in Audio in Apple OS X before 10.11.1 does not initialize an unspecified data...6.8 Medium
- apple mac os xThe Sandbox subsystem in Apple OS X before 10.11.1 allows local users to gain privileges via...7.2 High
- apple mac os x serverThe Web Service component in Apple OS X Server before 5.0.15 omits an unspecified HTTP header...5.0 Medium
- accelerite radia client automationPersistent Accelerite Radia Client Automation (formerly HP Client Automation) 7.9 through 9.1...5.0 Medium
- accelerite radia client automationPersistent Accelerite Radia Client Automation (formerly HP Client Automation), possibly before 9...10.0 High
- juniper junosJuniper Junos OS before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3...6.9 Medium
- jenkins, redhat openshift +1 moreJenkins allows for Privilege Escalation by Remote Authenticated Users7.5 High
- jenkins, redhat openshift +1 moreJenkins does not Restrict Reserved Names Allowing for Privilege Escalation4.6 Medium
- jenkins, redhat openshift +1 moreJenkins allows for Privilege Escalation by Remote Authenticated Users6.5 Medium
- cisco application policy infrastructure controllerCisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain...4.6 Medium
- ibm aix, vios +1 morenetstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows...6.9 Medium
- click project click, canonical ubuntu linux +1 moreclick/install.py in click does not require files in package filesystem tarballs to start with ./ ...9.8 Critical
- solarwinds log and event managerThe command line management console (CMC) in SolarWinds Log and Event Manager (LEM) before 6.2.0...7.5 High
- google chromeThe ContainerNode::parserInsertBefore function in core/dom/ContainerNode.cpp in Blink, as used in...7.5 High
- revive-adserver revive adserverRevive Adserver before 3.2.2 does not restrict access to run-mpe.php, which allows remote...5.0 Medium
- microsoft internet explorerThe broker EditWith feature in Microsoft Internet Explorer 8 through 11 allows remote attackers...6.8 Medium
- microsoft internet explorerMicrosoft Internet Explorer 8 allows remote attackers to gain privileges via a crafted web site,...6.8 Medium
- microsoft windows 10, windows 8, windows 8.1 +6 more +8 moreThe kernel in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold...7.2 High
- microsoft windows 10, windows 7, windows 8 +6 more +8 moreThe kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1,...7.2 High
- microsoft windows 10, windows 7, windows 8 +6 more +8 moreThe kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1,...7.2 High
- cisco aironet access point softwareCisco Aironet 1850 access points with software 8.1(112.4) allow local users to gain privileges...7.2 High
- cisco anyconnect secure mobility clientThe IPC channel in Cisco AnyConnect Secure Mobility Client 2.0.0343 through 4.1(8) allows local...6.6 Medium
- cisco telepresence video communication server softwareThe process-management implementation in Cisco TelePresence Video Communication Server (VCS)...6.9 Medium
- rsa web threat detectionEMC RSA Web Threat Detection before 5.1 SP1 allows local users to obtain root privileges by...7.2 High
- zohocorp manageengine opmanagerPGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote...9.0 High
- apple mac os xThe Address Book framework in Apple OS X before 10.11 allows local users to gain privileges by...4.6 Medium
- apple mac os xrsh in the remote_cmds component in Apple OS X before 10.11 allows local users to obtain root...7.2 High
- apple mac os xThe Install Framework Legacy component in Apple OS X before 10.11 allows local users to obtain...7.2 High
- apple mac os xThe filtering implementation in AppleEvents in Apple OS X before 10.11 mishandles attempts to...6.8 Medium
- google androidmediaserver in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to gain...9.3 High
- cisco vpn clientCisco VPN Client 5.x through 5.0.07.0440 uses weak permissions for vpnclient.ini, which allows...7.2 High
- sqliteSQLite before 3.8.9, as used in Android before 5.1.1 LMY48T, allows attackers to gain privileges...6.8 Medium
- google androidThe Secure Element Evaluation Kit (aka SEEK or SmartCard API) plugin in Android before 5.1.1...9.3 High
- google androidmediaserver in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted...9.3 High
- google androidMedia Player Framework in Android before 5.1.1 LMY48T allows attackers to gain privileges via a...9.3 High
- google androidMedia Projection in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to...4.3 Medium
- google androidThe Runtime subsystem in Android before 5.1.1 LMY48T allows attackers to gain privileges via a...9.3 High
- google androidBluetooth in Android before 5.1.1 LMY48T allows attackers to remove stored SMS messages via a...6.4 Medium
- doctrine-project annotations, cache, common +7 more +9 moreZendframework Local file disclosure via XXE injection in Zend_XmlRpc7.8 High
- arkeia western digital arkeiaThe arkeiad daemon in the Arkeia Backup Agent in Western Digital Arkeia 11.0.12 and earlier...10.0 High
- igniterealtime openfireIgnite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access...6.5 Medium
- juniper pulse connect secureThe Secure Meeting (Pulse Collaboration) in Pulse Connect Secure (formerly Juniper Junos Pulse)...3.5 Low
- glpi-project glpiGLPI before 0.85.3 allows remote authenticated users to create super-admin accounts by leveraging...4.0 Medium
- ibm urbancode deployIBM UrbanCode Deploy 6.0 and 6.0.1.x before 6.0.1.10, 6.1.1.x before 6.1.1.8, and 6.1.2 writes...6.0 Medium
- Show moreLoading…