CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft .net frameworkMicrosoft .NET Framework 4.6 and 4.6.1 mishandles library loading, which allows local users to...7.8 High
- microsoft windows 10, windows 7, windows 8.1 +4 more +6 moreThe kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,...7.8 High
- huawei policy center firmwareHuawei Policy Center with software before V100R003C10SPC020 allows remote authenticated users to...8.8 High
- nvidia gpu driver r340, gpu driver r352 +1 moreThe Escape interface in the Kernel Mode Driver layer in the NVIDIA GPU graphics driver R340...8.4 High
- nvidia gpu driver r340, gpu driver r352 +1 moreThe Escape interface in the Kernel Mode Driver layer in the NVIDIA GPU graphics driver R340...7.8 High
- apache rangerApache Ranger allows users to bypass intended access restrictions via the REST API6.5 Medium
- xen, canonical ubuntu linux +1 moreThe __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel does not properly...7.8 High
- redhat openstackThe TripleO Heat templates (tripleo-heat-templates), as used in Red Hat Enterprise Linux...7.3 High
- theforeman foreman, redhat satellite +1 moreForeman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view_hosts permissions, which...4.2 Medium
- apache rangerApache Ranger Access Restriction Bypass8.8 High
- apache rangerApache Ranger allows users to bypass intended access restrictions via direct access to module URLs7.1 High
- postgresqlThe (1) brin_page_type and (2) brin_metapage_info functions in the pageinspect extension in...9.1 Critical
- lenovo fingerprint manager, touch fingerprint +1 moreLenovo Fingerprint Manager before 8.01.57 and Touch Fingerprint before 1.00.08 use weak ACLs for...7.8 High
- apache jetspeedThe User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using...7.5 High
- prepopulate project prepopulateThe _prepopulate_request_walk function in the Prepopulate module 7.x-2.x before 7.x-2.1 for...7.3 High
- prepopulate project prepopulateThe Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the...7.3 High
- jenkins, redhat openshift +1 moreJenkins allows Execution of Code by Opening a JRMP Listener9.8 Critical
- cisco ucs invicta c3124sa applianceCisco UCS Invicta C3124SA Appliance 4.3.1 through 5.0.1, UCS Invicta Scaling System and Appliance...9.8 Critical
- cisco evolved programmable network manager, prime infrastructure, sun opensolaris +2 moreThe web API in Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable...8.1 High
- oar project oar, debian linux +1 moreThe oarsh script in OAR before 2.5.7 allows remote authenticated users of a cluster to obtain...8.8 High
- cogentdatahub cogent datahubCogent DataHub before 7.3.10 allows local users to gain privileges by leveraging the user or...7.8 High
- moodleMoodle sensitive information disclosure5.3 Medium
- moodleMoodle allows attackers to modify "Exclude grade" settings4.3 Medium
- cisco ios xrThe SCP and SFTP modules in Cisco IOS XR 5.0.0 through 5.2.5 on Network Convergence System 6000...6.5 Medium
- apple mac os xThe code-signing subsystem in Apple OS X before 10.11.4 does not properly verify file ownership,...3.3 Low
- apple tvos, watchos, iphone os +2 moreThe kernel in Apple iOS before 9.3, tvOS before 9.2, and watchOS before 2.2 does not properly...7.8 High
- apple iphone os, mac os x +1 moreAppleUSBNetworking in Apple iOS before 9.3 and OS X before 10.11.4 allows physically proximate...6.8 Medium
- ibm business process manager, websphere process server +1 moreBusiness Space in IBM WebSphere Process Server 6.1.2.0 through 7.0.0.5 and Business Process...4.3 Medium
- abb panel builder 800Untrusted search path vulnerability in ABB Panel Builder 800 5.1 allows local users to gain...7.2 High
- symantec endpoint protection managerThe SysPlant.sys driver in the Application and Device Control (ADC) component in the client in...8.8 High
- ibm tivoli netview access services** DISPUTED ** IBM Tivoli NetView Access Services (NVAS) allows remote authenticated users to...8.8 High
- microfocus arcsight enterprise security managerHPE ArcSight ESM 5.x before 5.6, 6.0, 6.5.x before 6.5C SP1 Patch 2, and 6.8c before P1, and...7.8 High
- debian linux, canonical ubuntu linux +1 morept_chown in the glibc package before 2.19-18+deb8u4 on Debian jessie; the elibc package before 2...8.4 High
- google androidSetup Wizard in Android 5.1.x before LMY49H and 6.x before 2016-03-01 allows physically proximate...6.1 Medium
- google androidlibcameraservice in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x...7.8 High
- google androidThe MediaTek connectivity kernel driver in Android 6.0.1 before 2016-03-01 allows attackers to...7.0 High
- google androidThe MediaTek Wi-Fi kernel driver in Android 6.0.1 before 2016-03-01 allows attackers to gain...7.8 High
- google androidThe Qualcomm performance component in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x...7.8 High
- ibm tivoli monitoringThe portal client in IBM Tivoli Monitoring (ITM) 6.2.2 through FP9, 6.2.3 through FP5, and 6.3.0...9.9 Critical
- microsoft windows 10, windows 7, windows 8.1 +3 more +5 moreThe USB Mass Storage Class driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2...6.8 Medium
- microsoft windows vista, windows server 2008 +1 moreMicrosoft Windows Vista SP2 and Server 2008 SP2 mishandle library loading, which allows local...8.4 High
- microsoft windows, windows 7, windows 8.1 +5 more +7 moreThe Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,...7.8 High
- microsoft windows 10, windows 7, windows 8.1 +4 more +6 moreThe kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,...7.8 High
- microsoft windows 10, windows 7, windows 8.1 +4 more +6 moreThe kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,...7.8 High
- microsoft windows 10, windows 7, windows 8.1 +4 more +6 moreThe kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,...7.8 High
- microsoft windows 10, windows 7, windows 8.1 +4 more +6 moreThe kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,...7.8 High
- microsoft windows 7, windows server 2008, windows vista +2 moreMicrosoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 do not...7.8 High
- microsoft officeMicrosoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 does not properly sign an unspecified...7.8 High
- mozilla firefoxThe FileReader class in Mozilla Firefox before 45.0 allows local users to gain privileges or...7.4 High
- mozilla firefox, thunderbird, novell suse package hub for suse linux enterprise +3 more +5 moreThe nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozilla Firefox before...8.8 High
- Show moreLoading…