CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeThe PendingScript::notifyFinished function in WebKit/Source/core/dom/PendingScript.cpp in Google...9.8 Critical
- google chromeThe Extensions subsystem in Google Chrome before 49.0.2623.75 does not properly maintain own...8.8 High
- google chromeThe PPB_Flash_MessageLoop_Impl::InternalRun function in content/renderer/pepper...8.8 High
- google chromeThe ContainerNode::parserRemoveChild function in WebKit/Source/core/dom/ContainerNode.cpp in...8.8 High
- roundup-tracker roundup, debian linux +1 moreRoundup sensitive data disclosure vulnerability4.3 Medium
- eximExim before 4.86.2, when installed setuid root, allows local users to gain privileges via the...7.0 High
- ibm websphere portalIBM WebSphere Portal 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0...3.1 Low
- wiresharkUntrusted search path vulnerability in the WiresharkApplication class in ui/qt...7.8 High
- drupal, debian linux +1 moreDrupal saving user accounts can sometimes grant the user all roles8.1 High
- xymon, debian linux +1 morelib/xymond_ipc.c in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 use weak permissions (666) for an...3.3 Low
- cisco nx-osCisco NX-OS 7.0(1)N1(1), 7.0(1)N1(3), and 7.0(4)N1(1) on Nexus 2000 Fabric Extender devices has a...9.8 Critical
- apache tomcat, canonical ubuntu linux, debian linux +2 moreImproper Verification of Source of a Communication Channel in Apache Tomcat6.3 Medium
- apache tomcat, canonical ubuntu linux, debian linux +2 moreImproper Access Control in Apache Tomcat8.8 High
- moodleThe Forum module in Moodle 2.7.x before 2.7.10 allows remote authenticated users to post to...4.3 Medium
- moodlemod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups...4.3 Medium
- ibm tivoli storage flashcopy manager for vmware, tivoli storage manager for virtual environments data protection for vmware +1 moreThe Data Protection component in the VMware vSphere GUI in IBM Tivoli Storage Manager for Virtual...10.0 Critical
- google chrome, debian linux, novell suse package hub for suse linux enterprise +2 more +4 moreGoogle Chrome before 48.0.2564.116 allows remote attackers to bypass the Blink Same Origin Policy...9.8 Critical
- cisco asr 5000 series softwareThe SSH implementation in Cisco StarOS before 19.3.M0.62771 and 20.x before 20.0.M0.62768 on ASR...7.5 High
- microsoft internet explorerMicrosoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy...8.8 High
- microsoft internet explorerMicrosoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy...8.8 High
- symantec encryption management serverSymantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows local users to obtain root...7.8 High
- cacti, opensuse leap, opensuse +2 moreauth_login.php in Cacti before 0.8.8g allows remote authenticated users who use web...8.8 High
- citrix netscalerCitrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 11.x before 11.0...9.8 Critical
- cybozu officeCybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access...5.4 Medium
- cybozu officeCybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access...5.4 Medium
- cybozu officeCybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access...5.4 Medium
- cybozu officeCybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended calendar...5.4 Medium
- ibm tivoli storage managerThe server in IBM Spectrum Protect (aka Tivoli Storage Manager) 5.5 and 6.x before 6.3.5.1 and 7...3.7 Low
- google chrome, debian linux, opensuse +2 moreThe Developer Tools (aka DevTools) subsystem in Google Chrome before 48.0.2564.109 does not...8.8 High
- google chrome, debian linux, opensuse +2 moreThe Chrome Instant feature in Google Chrome before 48.0.2564.109 does not ensure that a New Tab...4.3 Medium
- google chrome, debian linux, opensuse +2 moreThe Extensions subsystem in Google Chrome before 48.0.2564.109 does not prevent use of the Object...8.8 High
- google chrome, debian linux, opensuse +2 moreThe DOM implementation in Google Chrome before 48.0.2564.109 does not properly restrict frame...8.8 High
- cisco sparkThe REST interface in Cisco Spark 2015-06 allows remote attackers to cause a denial of service ...5.3 Medium
- cisco sparkThe REST interface in Cisco Spark 2015-07-04 allows remote attackers to bypass intended access...7.5 High
- cisco prime collaborationThe CLI in Cisco Prime Collaboration 9.0 and 11.0 allows local users to execute arbitrary OS...6.7 Medium
- mozilla firefoxMozilla Firefox before 44.0.2 does not properly restrict the interaction between Service Workers...8.8 High
- postgresql, canonical ubuntu linux, debian linux +2 morePostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x...8.8 High
- microsoft windows 10, windows 7, windows 8.1 +4 more +6 moreThe WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7...7.8 High
- microsoft windows 10, windows 7, windows 8.1 +4 more +6 moreThe kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,...7.8 High
- microsoft windows, windows 7, windows server 2008 +1 more +3 moreThe kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1...7.8 High
- microsoft windows 10, windows 7, windows 8.1 +1 more +3 moreThe Remote Desktop Protocol (RDP) implementation in Microsoft Windows 7 SP1, Windows 8.1, Windows...8.1 High
- google androidpackages/SystemUI/src/com/android/systemui/recents/AlternateRecentsComponent.java in Setup Wizard...6.1 Medium
- google androidThe interceptKeyBeforeDispatching function in policy/src/com/android/internal/policy/impl...6.1 Medium
- google androidmedia/libmedia/SoundPool.cpp in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G,...7.8 High
- google androidUse-after-free vulnerability in the wifi_cleanup function in bcmdhd/wifi_hal/wifi_hal.cpp in Wi...8.8 High
- google androidThe get_build_id function in elf_utils.cpp in Debuggerd in Android 6.x before 2016-02-01 allows...8.4 High
- google androidThe Qualcomm Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and...8.4 High
- google androidThe performance event manager for Qualcomm ARM processors in Android 4.x before 4.4.4, 5.x before...8.4 High
- kubernetesAuthorization bypass in Openshift9.8 Critical
- lexmark printer firmwareRace condition in the initialization process on Lexmark printers with firmware ATL before ATL.02...9.8 Critical
- Show moreLoading…