CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- radicaleRadicale regex metacharacters injection in the user name5.3 Medium
- canonical ubuntu linuxThe crontab script in the ntp package before 1:4.2.6.p3+dfsg-1ubuntu3.11 on Ubuntu 12.04 LTS,...7.8 High
- moodle, fedoraproject fedora +1 moreMoodle sensitive information disclosure4.3 Medium
- debian fuseAn unspecified udev rule in the Debian fuse package in jessie before 2.9.3-15+deb8u2, in stretch...7.8 High
- ibm jazz reporting serviceReport Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0...4.3 Medium
- ibm jazz reporting serviceReport Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0...4.3 Medium
- fortinet fortiosFortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3;...9.8 Critical
- advantech webaccessAdvantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative...7.5 High
- samsung web viewerWeb Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files...8.6 High
- cisco adaptive security appliance softwareThe DCERPC Inspection implementation in Cisco Adaptive Security Appliance (ASA) Software 9.4.1...4.3 Medium
- adobe acrobat, acrobat reader, acrobat reader dc +1 more +3 moreAdobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006...8.8 High
- microsoft windows 10, windows 7, windows server 2008 +1 more +3 moreMicrosoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Windows 10...8.8 High
- microsoft windows 10, windows 7, windows 8 +6 more +8 moreThe sandbox implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,...7.8 High
- microsoft windows 10, windows 7, windows 8 +6 more +8 moreThe sandbox implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,...7.3 High
- huawei vcn500The Operation and Maintenance Unit (OMU) in Huawei VCN500 with software before V100R002C00SPC200...7.1 High
- apple mac os xDirectory Utility in Apple OS X before 10.11.1 mishandles authentication for new sessions, which...7.8 High
- acquia mollomThe Mollom module 6.x-2.7 before 6.x-2.15 for Drupal allows remote attackers to bypass intended...7.5 High
- sap afariaSAP Afaria 7.0.6001.5 allows remote attackers to bypass authorization checks and wipe or lock...9.1 Critical
- fortinet forticlientFortinet FortiClient Linux SSLVPN before build 2313, when installed on Linux in a home directory...7.8 High
- dell pre-boot authentication driverDell Pre-Boot Authentication Driver (PBADRV.sys) 1.0.1.5 allows local users to write to arbitrary...7.8 High
- google androidSyncManager in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to cause a...5.0 Medium
- google androidSetup Wizard in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows physically...6.6 Medium
- google androidThe kernel in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain...9.8 Critical
- google androidThe prctl_set_vma_anon_name function in kernel/sys.c in Android before 5.1.1 LMY49F and 6.0...7.8 High
- google androidThe Imagination Technologies driver in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01...7.8 High
- google androidThe MediaTek misc-sd driver in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows...7.8 High
- google androidThe Widevine QSEE TrustZone application in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01...7.8 High
- google androidThe Widevine QSEE TrustZone application in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01...7.8 High
- eucalyptusHPE Helion Eucalyptus 3.4.0 through 4.2.0 allows remote authenticated users to bypass an intended...7.5 High
- hp j8692a, j8693a, j8697a +51 more +53 moreHPE Network Switches with software 15.16.x and 15.17.x allow local users to bypass intended...8.4 High
- hp network switch softwareHPE Network Switches with software 15.16.x and 15.17.x allow local users to bypass intended...7.8 High
- hp jc072b hp 12500 main processing unit, jc085a hp a12518 switch chassis, jc086a hp a12508 switch chassis +84 more +86 moreHPE Networking Products, originally branded as Comware 5, Comware 7, H3C, or HP, allow remote...6.5 Medium
- eucalyptusHP Helion Eucalyptus 4.1.x before 4.1.2 and HPE Helion Eucalyptus 4.2.x before 4.2.1 allow remote...6.8 Medium
- ibm maximo asset management, smartcloud control desk, maximo asset management essentials +6 more +8 moreIBM Maximo Asset Management 7.5 before 7.5.0.8 IF6 and 7.6 before 7.6.0.2 IF1 and Maximo Asset...4.3 Medium
- ibm rational collaborative lifecycle management, rational doors next generation, rational engineering lifecycle manager +5 more +7 moreRational LifeCycle Project Administration in Jazz Team Server in IBM Rational Collaborative...3.3 Low
- ibm tivoli common reportingIBM Tivoli Common Reporting (TCR) 2.1 before IF14, 2.1.1 before IF22, 2.1.1.2 before IF9, 3.1.0.0...2.5 Low
- apache hadoopThe Hadoop connector 1.1.1, 2.4, 2.5, and 2.7.0-0 before 2.7.0-3 for IBM Spectrum Scale and...8.4 High
- ibm maximo asset management, smartcloud control desk, maximo asset management essentials +6 more +8 moreThe Scheduler in IBM Maximo Asset Management 7.5 before 7.5.0.8 IF6 and 7.6 before 7.6.0.1 FP1...5.4 Medium
- ibm installation manager, packaging utility +1 moreconsoleinst.sh in IBM Installation Manager before 1.7.4.4 and 1.8.x before 1.8.4 and Packaging...7.0 High
- ibm infosphere biginsightsThe Big SQL component in IBM InfoSphere BigInsights 3.0, 3.0.0.1, 3.0.0.2, and 4.0 allows remote...4.3 Medium
- ibm spss statisticsIBM SPSS Statistics 22.0.0.2 before IF10 and 23.0.0.2 before IF7 uses weak permissions (Everyone:...7.8 High
- zyxel gs1900-10hp firmwareBelkin F9K1102 2 devices with firmware 2.10.17 rely on client-side JavaScript code for...9.8 Critical
- zyxel pmg5318-b20a firmwareZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 allow remote authenticated users to obtain...8.0 High
- zyxel pmg5318-b20a firmwareThe diagnostic-ping implementation on ZyXEL PMG5318-B20A devices with firmware before 1.00(AANC.2...9.8 Critical
- tenda n3 wireless n150, mediabridge medialink mwn-wapr300n firmware +1 moreMediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 and Tenda N3 Wireless N150...9.8 Critical
- corega cg-wlbargs firmwareCorega CG-WLBARGS devices allow remote attackers to perform administrative operations via...9.8 Critical
- asus wl-330nul firmwareASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to execute...7.3 High
- zte zxhn h108n r1a firmwareZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote authenticated users to...4.9 Medium
- rarlab winrarThe file-execution functionality in WinRAR before 5.30 beta 5 allows local users to gain...7.4 High
- emc vplex geosynchronyEMC VPLEX GeoSynchrony 5.4 SP1 before P3 and 5.5 before Patch 1 has a default password for the...8.4 High
- Show moreLoading…