CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeThe CSPSource::hostMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content...4.3 Medium
- google chromeThe DOM implementation in Blink, as used in Google Chrome before 47.0.2526.73, does not prevent...7.5 High
- google chromeThe DOM implementation in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the...7.5 High
- google chromeThe provisional-load commit implementation in WebKit/Source/bindings/core/v8/WindowProxy.cpp in...7.5 High
- google chromeThe DOM implementation in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the...7.5 High
- cisco ios xeCisco IOS XE 15.4(3)S on ASR 1000 devices improperly loads software packages, which allows local...7.2 High
- siemens simatic cp 343-1 firmware, simatic cp 443-1 firmware, simatic tim 3v-ie firmware +1 more +3 moreA vulnerability has been identified in SIMATIC NET CP 342-5 (incl. SIPLUS variants) (All versions...9.7 High
- jenkins, redhat openshift +1 moreJenkins allows Unauthorized Viewing of Queue API Information5.0 Medium
- jenkins, redhat openshift +1 moreJenkins allows Administrators to Access API Tokens6.5 Medium
- jenkinsJenkins improperly ensures trust separation6.8 Medium
- gnome display manager, fedoraproject fedora +1 moreGNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the...7.2 High
- redhat enterprise linuxThe grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, when used on UEFI...2.6 Low
- apache cordovaApache Cordova-Android before 4.1.0, when an application relies on a remote server, improperly...4.3 Medium
- apple iphone osThe kernel in Apple iOS before 8.4.1 does not properly restrict debugging features, which allows...4.3 Medium
- arista eosArista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and...10.0 High
- apache cxfImproper Access Control in Apache CXF4.0 Medium
- canonical ubuntu linuxThe lxd-unix.socket systemd unit file in the Ubuntu lxd package before 0.20-0ubuntu4.1 uses world...4.6 Medium
- ipsilon project ipsilonIpsilon denial of service by deleting a SAML2 Service Provider (SP)5.5 Medium
- ipsilon project ipsilonIpsilon denial of service via a duplicate SP name4.0 Medium
- strongswan, canonical ubuntu linux +1 moreThe server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4...5.0 Medium
- ibm system networking switch center, lenovo switch center +1 moreThe administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5...7.2 High
- adobe air, air sdk, flash player +1 more +3 moreAdobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11...7.8 High
- microsoft windows 10, windows 7, windows 8 +6 more +8 moreThe kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1,...6.9 Medium
- microsoft windows 10, windows 7, windows 8 +6 more +8 moreThe kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1,...6.9 Medium
- microsoft windows 7, windows server 2008, windows vista +2 moreBuffer overflow in the Network Driver Interface Standard (NDIS) implementation in Microsoft...7.2 High
- microsoft access, excel, infopath +11 more +13 moreMicrosoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007...9.3 High
- microsoft windows 10, windows 7, windows 8 +6 more +8 moreMicrosoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8,...7.2 High
- sudo project sudosudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a...7.2 High
- cisco connected grid network management systemThe web GUI in Cisco Connected Grid Network Management System (CG-NMS) 3.0(0.35) and 3.0(0.54)...4.0 Medium
- ibm security guardiumdiag in IBM Security Guardium 8.2 before p6015, 9.0 before p6015, 9.1, 9.5, and 10.0 before p6015...7.2 High
- ibm sterling b2b integrator, sterling integrator +1 moreIBM Sterling Integrator 5.1 before 5010004_8 and Sterling B2B Integrator 5.2 before 5020500_9...5.5 Medium
- ibm powerha system mirrorCSPOC in IBM PowerHA SystemMirror on AIX 6.1 and 7.1 allows remote authenticated users to perform...8.5 High
- squid-cache squid, opensuse +1 moreSquid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow...4.0 Medium
- f5 big-ip analytics, big-ip edge gateway, big-iq adc +15 more +17 moreThe datastor kernel module in F5 BIG-IP Analytics, APM, ASM, Link Controller, and LTM 11.1.0...9.0 High
- cisco mobility services engineCisco Mobility Services Engine (MSE) through 8.0.120.7 uses weak permissions for unspecified...6.9 Medium
- sddm project sddm, fedoraproject fedora +1 moredaemon/Greeter.cpp in sddm before 0.13.0 does not properly disable the KDE crash handler, which...4.6 Medium
- hp arcsight command center, arcsight connector appliance, arcsight logger +4 more +6 moreHP ArcSight Logger 6.0.0.7307.1, ArcSight Command Center 6.8.0.1896.0, and ArcSight Connector...7.2 High
- ibm infosphere information serverIBM InfoSphere Information Server 11.3 and 11.5 allows remote authenticated DataStage users to...5.5 Medium
- ibm tivoli storage managerThe Reporting and Monitoring component in Tivoli Monitoring in IBM Tivoli Storage Manager 6.3...7.2 High
- mozilla firefoxMozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 improperly control the ability of a...5.0 Medium
- google androidTelephony in Android 5.x before 5.1.1 LMY48X allows attackers to gain privileges, and...5.8 Medium
- google androidlibmedia in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows attackers to gain...9.3 High
- mediawikiMediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not properly...4.0 Medium
- apache ambariApache Ambari before 2.0.2 or 2.1.x before 2.1.1 allows remote authenticated users to gain...6.5 Medium
- cisco secure access control serverThe report-generation web interface in the Solution Engine in Cisco Secure Access Control Server ...4.0 Medium
- cisco secure access control serverThe Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote...4.0 Medium
- xenThe mod_l2_entry function in arch/x86/mm.c in Xen 3.4 through 4.6.x does not properly validate...7.2 High
- techno project japan enisys gwTechno Project Japan Enisys Gw before 1.4.1 allows remote attackers to bypass intended access...5.0 Medium
- ibm websphere portalIBM WebSphere Portal 8.5.0 before CF08 allows remote attackers to bypass intended access...6.8 Medium
- xscreensaver project xscreensaver, canonical ubuntu linux +1 moredriver/subprocs.c in XScreenSaver before 5.34 does not properly perform an internal consistency...2.1 Low
- Show moreLoading…