CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- linux kernelThe ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to...6.7 Medium
- dovestones ad self password resetThe PasswordReset.Controllers.ResetController.ChangePasswordIndex method in PasswordReset.dll in...10.0 Critical
- emc isilon onefsEMC Isilon OneFS 7.1 before 7.1.1.8, 7.2.0 before 7.2.0.4, and 7.2.1 before 7.2.1.1 allows remote...8.0 High
- searchbloxSearchBlox 8.3 before 8.3.1 allows remote attackers to write to the config file, and consequently...10.0 Critical
- blueman project bluemanblueman - security update8.4 High
- sap mobile platformThe SysAdminWebTool servlets in SAP Mobile Platform allow remote attackers to bypass...7.5 High
- acunetix web vulnerability scannerThe AcuWVSSchedulerv10 service in Acunetix Web Vulnerability Scanner (WVS) before 10 build...7.2 High
- tryton trytond, debian linux +1 moretrytond arbitrary fields write via a sequence of records4.3 Medium
- redhat jboss enterprise application platformRed Hat JBoss Enterprise Application Platform (EAP) before 6.4.5 does not properly authorize...3.5 Low
- kaspersky total security 2015Kaspersky Total Security 2015 15.0.2.361 allocates memory with Read, Write, Execute (RWX)...6.4 Medium
- avg internet securityAVG Internet Security 2015 allocates memory with Read, Write, Execute (RWX) permissions at...6.4 Medium
- mcafee virusscan enterpriseThe Buffer Overflow Protection (BOP) feature in McAfee VirusScan Enterprise before 8.8 Patch 6...2.6 Low
- samba, canonical ubuntu linux, debian linux +2 morevfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3,...7.2 High
- lepide active directory self serviceThe password reset functionality in Lepide Active Directory Self Service allows remote...7.4 High
- mozilla firefox, fedoraproject fedora, opensuse leap +1 more +3 moreThe WebExtension APIs in Mozilla Firefox before 43.0 allow remote attackers to gain privileges,...4.0 Medium
- cisco telepresence video communication server softwareCisco TelePresence Video Communication Server (VCS) Expressway X8.6 allows remote authenticated...4.0 Medium
- cisco videoscape distribution suite service managerCisco Videoscape Distribution Suite Service Manager (VDS-SM) 3.4.0 and earlier does not always...6.5 Medium
- cisco prime service catalogCisco Prime Service Catalog 10.0, 10.0(R2), 10.1, and 11.0 does not properly restrict access to...6.5 Medium
- linux kernel** DISPUTED ** kernel/ptrace.c in the Linux kernel through 4.4.1 mishandles uid and gid mappings,...7.0 High
- apple mac os xThe File Bookmark component in Apple OS X before 10.11.2 allows attackers to bypass a sandbox...10.0 High
- apple mac os xThe kernel loader in EFI in Apple OS X before 10.11.2 allows local users to gain privileges via a...7.2 High
- apple iphone os, mac os x +1 moreApple OS X before 10.11.2 and tvOS before 9.1 allow local users to bypass intended configuration...4.6 Medium
- apple mac os xkext tools in Apple OS X before 10.11.2 mishandles kernel-extension loading, which allows local...7.2 High
- apple tvos, iphone os +1 moreMobileStorageMounter in Apple iOS before 9.2 and tvOS before 9.1 mishandles the timing of trust...9.3 High
- apple tvos, watchos, iphone os +1 more +3 moreAppSandbox in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1...6.8 Medium
- gnu grub2, fedoraproject fedora +1 moreMultiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to...6.9 Medium
- microsoft windows, windows 10 1507 +1 moreThe kernel in Microsoft Windows 10 Gold allows local users to gain privileges via a crafted...7.8 High
- microsoft windows 10, windows 7, windows 8 +6 more +8 moreThe kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1,...7.2 High
- microsoft windows 10, windows 7, windows 8 +6 more +8 moreThe kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1,...7.2 High
- microsoft windows 10, windows 7, windows 8 +6 more +8 moreThe kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1,...7.2 High
- microsoft edgeMicrosoft Edge allows remote attackers to gain privileges via a crafted web site, aka "Microsoft...6.8 Medium
- microsoft edge, internet explorer +1 moreMicrosoft Internet Explorer 11 and Microsoft Edge mishandle content types, which allows remote...9.3 High
- microsoft windows 10, windows 8, windows 8.1 +3 more +5 moreMicrosoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and...7.2 High
- microsoft windows 10, windows 7, windows 8 +6 more +8 moreMicrosoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8,...7.2 High
- adobe air, air sdk, flash player +1 more +3 moreAdobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and...10.0 High
- google androidWi-Fi in Android 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted...9.3 High
- google androidSystemUI in Android 5.x before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain...9.3 High
- google androidlibstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain...9.3 High
- google androidThe kernel in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain...9.3 High
- bluecoat unified agentBlue Coat Unified Agent before 4.6.2 does not prevent modification of its configuration files...2.1 Low
- f5 big-ip edge gateway, big-iq adc, big-iq cloud +15 more +17 moreThe iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0...9.0 High
- canonical lxcfs, ubuntu linux +1 moreThe do_write_pids function in lxcfs.c in LXCFS before 0.12 does not properly check permissions,...7.2 High
- canonical lxcfs, ubuntu linux +1 moreLXCFS before 0.12 does not properly enforce directory escapes, which might allow local users to...4.6 Medium
- google chromePDFium, as used in Google Chrome before 47.0.2526.73, does not properly restrict use of chrome:...4.3 Medium
- moodleMoodle allows attackers to bypass intended access restrictions4.3 Medium
- moodleMoodle allows attackers to read SCORM contents4.3 Medium
- moodleMoodle sensitive information disclosure4.3 Medium
- moodleMoodle does not properly implement group-based access restrictions4.3 Medium
- cisco webex meetingsThe Cisco WebEx Meetings application before 8.5.1 for Android improperly initializes custom...4.3 Medium
- google chromeThe CSPSourceList::matches function in WebKit/Source/core/frame/csp/CSPSourceList.cpp in the...4.3 Medium
- Show moreLoading…