CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- google android, linux kernel +1 moreDrivers/soc/qcom/spcom.c in the Qualcomm SPCom driver in the Android kernel 2017-03-05 allows...7.0 High
- setucocms project setucocmsSetsucoCMS all versions does not properly manage sessions, which allows remote attackers to...6.5 Medium
- apache hadoopInsecure Inherited Permissions in Apache Hadoop8.8 High
- lenovo updatesRemote code execution in Lenovo Updates (not Lenovo System Update) allows man-in-the-middle...8.1 High
- lenovo customer care software development kit, lenovo group ltd. customer care software development kit (ccsdk) +1 morePrivilege escalation in Lenovo Customer Care Software Development Kit (CCSDK) versions earlier...7.8 High
- synology photo stationSynology Photo Station before 6.3-2958 allows local users to gain privileges by leveraging setuid...7.8 High
- sierrawireless aleos firmwareSierra Wireless GX 440 devices with ALEOS firmware 4.3.2 execute the management web application...8.8 High
- dell integrated remote access controller firmwareDell Integrated Remote Access Controller (iDRAC) 6 before 2.80 allows remote attackers to execute...8.8 High
- vertiv liebert multilink automated shutdownLiebert MultiLink Automated Shutdown v4.2.4 allows local users to gain privileges by replacing...7.8 High
- summerinfant baby zoom wifi monitor firmwareSummer Baby Zoom Wifi Monitor & Internet Viewing System allows remote attackers to gain...8.8 High
- sophos cyberoam cr25ing utm firmwareSophos Cyberoam UTM CR25iNG 10.6.3 MR-5 allows remote authenticated users to bypass intended...8.8 High
- cisco mobility services engineA vulnerability in the CLI command parser of the Cisco Mobility Express 2800 and 3800 Series...6.7 Medium
- cisco aironet access pointA vulnerability in login authentication management in Cisco Aironet 1800, 2800, and 3800 Series...6.7 Medium
- perforce jviews, oracle data integrator +1 moreRogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute...9.8 Critical
- cisco wireless lan controller firmwareA vulnerability in the web management interface of Cisco Wireless LAN Controller (WLC) Software...7.5 High
- linux kernelA missing authorization check in the fscrypt_process_policy function in fs/crypto/policy.c in the...6.5 Medium
- linux kernel, google android +1 moreThe eCryptfs subsystem in the Linux kernel before 3.18 allows local users to gain privileges via...7.8 High
- huawei fusionstorageThe maintenance module in Huawei FusionStorage V100R003C30U1 allows attackers to create documents...7.5 High
- huawei technologies co., ltd. utps, huawei utps firmware +1 moreHuawei UTPS earlier than UTPS-V200R003B015D16SPC00C983 has an unquoted service path vulnerability...6.7 Medium
- huawei acu2 firmware, s12700 firmware, s5700 firmware +3 more +5 moreHuawei switches S5700, S6700, S7700, S9700 with software V200R001C00SPC300, V200R002C00SPC100,...7.5 High
- huawei logcenterHuawei LogCenter V100R001C10 could allow an authenticated attacker to tamper with requests using...8.8 High
- huawei tecal e9000 chassis firmwareThe Hyper Module Management (HMM) software of Huawei Tecal E9000 Chassis V100R001C00SPC160 and...8.8 High
- huawei tecal e9000 chassis firmwareThe Hyper Module Management (HMM) software of Huawei Tecal E9000 Chassis V100R001C00SPC160 and...8.8 High
- huawei ascend p6 edge-c00 firmware, ascend p6 edge-t00 firmware, ascend p6 edge-u00 firmware +2 moreApps on Huawei Ascend P6 mobile phones with software EDGE-U00 V100R001C17B508SP01 and earlier...3.3 Low
- huawei espace meetingIn Huawei eSpace Meeting with software V100R001C03SPC201 and the earlier versions, attackers that...7.0 High
- intel anti-virus engine (ave), mcafee anti-malware scan engine +1 moreSoftware Integrity Attacks vulnerability in Intel Security Anti-Virus Engine (AVE) 5200 through...7.3 High
- gitlabMultiple versions of GitLab expose a dangerous method to any authenticated user that could lead...8.2 High
- ibm cognos business intelligenceIBM Cognos Business Intelligence 10.2 could allow a user with lower privilege Capabilities to...8.8 High
- allwinner linux-3.4-sunxiThe sunxi-debug driver in Allwinner 3.4 legacy kernel for H3, A83T and H8 devices allows local...7.8 High
- samsung galaxy app, account app +1 moreSamsung Account (AKA com.osp.app.signin) before 1.6.0069 and 2.x before 2.1.0069 allows man-in...8.0 High
- samsung galaxy app, account app +1 moreGALAXY Apps (aka Samsung Apps, Samsung Updates, or com.sec.android.app.samsungapps) before...8.0 High
- cloudera managerCloudera Manager 4.x, 5.0.x before 5.0.6, 5.1.x before 5.1.5, 5.2.x before 5.2.5, and 5.3.x...3.3 Low
- apache hadoop, cloudera cdh +1 moreImproper Authentication in Apache Hadoop6.5 Medium
- cloudera cdhThe JobHistory Server in Cloudera CDH 4.x before 4.6.0 and 5.x before 5.0.0 Beta 2, when using...3.1 Low
- kankunit konke smart plug firmwareThe Konke Smart Plug K does not require authentication for TELNET sessions, which allows remote...9.8 Critical
- novell edirectoryNDSD in Novell eDirectory before 9.0.2 did not calculate ACLs on LDAP objects across partition...7.5 High
- netiq access governance suiteA logged-in user in NetIQ Access Governance Suite 6.0 through 6.4 could escalate privileges to...8.8 High
- google androidThe Qualcomm SPCom driver in Android before 7.0 allows local users to execute arbitrary code...7.8 High
- openinfosecfoundation suricataThe MemcmpLowercase function in Suricata before 2.0.6 improperly excludes the first byte from...9.8 Critical
- opendaylight l2switchhosttracker in OpenDaylight l2switch allows remote attackers to change the host location...5.3 Medium
- pluck-cms pluckPluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature.9.8 Critical
- cisco aironet access point softwareA vulnerability in the web-based GUI of Cisco Mobility Express 1800 Series Access Points could...9.8 Critical
- cisco virtualized packet core, asr 5000 series software +1 moreA privilege escalation vulnerability in the Secure Shell (SSH) subsystem in the StarOS operating...8.8 High
- alienvault ossim, unified security management +1 moreThe logcheck function in session.inc in AlienVault OSSIM before 5.3.1, when an action has been...9.8 Critical
- intel mcafee security scan plus (ssp), mcafee security scan plus +1 moreArbitrary command execution vulnerability in Intel Security McAfee Security Scan Plus (SSP) 3.11...7.8 High
- intel data loss prevention endpoint (dlpe), mcafee data loss prevention endpoint +1 moreAccess control vulnerability in Intel Security Data Loss Prevention Endpoint (DLPe) 9.4.200 and 9...7.8 High
- intel mcafee application control (mac), mcafee application control, application control (mac) +2 morePrivilege escalation vulnerability in Intel Security McAfee Application Control (MAC) 7.0 and 6.x...7.8 High
- intel security scan plus (ssp), mcafee security scan plus +1 morePrivilege escalation vulnerability in Windows 7 and Windows 10 in McAfee Security Scan Plus (SSP)...8.8 High
- intel mcafee email gateway (meg), mcafee email gateway, email gateway (meg) +2 moreFile extension filtering vulnerability in Intel Security McAfee Email Gateway (MEG) before 7.6...6.5 Medium
- intel cloudav (beta), mcafee cloud av, security scan plus +1 more +3 moreMalicious file execution vulnerability in Intel Security CloudAV (Beta) before 0.5.0.151.3 allows...7.0 High
- Show moreLoading…